From 2a6342065da713e6ad104e5c121e95fc2fbb7cb6 Mon Sep 17 00:00:00 2001 From: Dwi Siswanto Date: Sat, 8 Jun 2024 04:26:51 +0700 Subject: [PATCH] feat(falcosidekick): added new `ListenAddr` field in `falcoEvent` (#196) * feat(falcosidekick): added new `ListenAddr` field in `falcoEvent` Signed-off-by: Dwi Siswanto * feat(teler): impl new `ListenAddr` output fields for Falco event Signed-off-by: Dwi Siswanto * docs(README): add new `ListenAddr` field desc Signed-off-by: Dwi Siswanto --------- Signed-off-by: Dwi Siswanto --- README.md | 1 + falcosidekick.go | 1 + teler.go | 1 + 3 files changed, 3 insertions(+) diff --git a/README.md b/README.md index fa35dee..4cac185 100644 --- a/README.md +++ b/README.md @@ -439,6 +439,7 @@ The event forwarded to Falco Sidekick instance includes the following informatio * **`teler.caller`**: Identifies the application source that invoked teler-waf. * **`teler.id`**: Represents a unique identifier for the rejected request. * **`teler.threat`**: Specifies the category of the threat. + * **`teler.listen_addr`**: Denotes the network address on which teler-waf is listening for incoming requests. * **`request.body`**: Contains the body of the associated request. * **`request.headers`**: Lists the headers from the associated request. * **`request.ip_addr`**: Discloses the IP address of the associated request. diff --git a/falcosidekick.go b/falcosidekick.go index c06a745..abe3b87 100644 --- a/falcosidekick.go +++ b/falcosidekick.go @@ -29,6 +29,7 @@ type falcoEvent struct { Caller string `json:"teler.caller"` ID string `json:"teler.id"` Threat string `json:"teler.threat"` + ListenAddr string `json:"teler.listen_addr"` RequestBody string `json:"request.body"` RequestHeaders string `json:"request.headers"` RequestIPAddr string `json:"request.ip_addr"` diff --git a/teler.go b/teler.go index 18880c7..b300c9f 100644 --- a/teler.go +++ b/teler.go @@ -431,6 +431,7 @@ func (t *Teler) sendLogs(r *http.Request, k threat.Threat, id string, msg string event.OutputFields.Caller = t.caller event.OutputFields.ID = id event.OutputFields.Threat = cat + event.OutputFields.ListenAddr = listenAddr event.OutputFields.RequestBody = string(body) event.OutputFields.RequestHeaders = string(jsonHeaders) event.OutputFields.RequestIPAddr = ipAddr