search

falcosecurity / falco

Cloud Native Runtime Security
https://falco.org
Apache License 2.0
7.29k stars 897 forks source link

new(metrics): add host_ifinfo metric #3253

Closed incertum closed 1 month ago

incertum commented 3 months ago

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area CI

What this PR does / why we need it:

For fleet management and inventory purposes, having the host ifinfo available is highly valuable, in addition to evt.hostname, kernel_release, and many other wrapper/base metric fields.

In addition to incorporating the new metric field into the metrics framework, I would also like to propose adding new filter checks similar to evt.hostname to libs (details to be discussed later).

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new(metrics): add host_ifinfo metric
incertum commented 3 months ago

@FedeDP @sgaist @mrgian thanks.

github-actions[bot] commented 3 months ago

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

FedeDP commented 3 months ago

/milestone 0.39.0

incertum commented 3 months ago

/hold needs a libs bump after merging https://github.com/falcosecurity/libs/pull/1937.

FedeDP commented 1 month ago

I think you can now rebase on top of Falco master ;)

incertum commented 1 month ago

I think you can now rebase on top of Falco master ;)

Rebased, thanks.

poiana commented 1 month ago

LGTM label has been added.

Git tree hash: dd0c218c324ac0e01bf1d25b092ad4cc3822fcec

poiana commented 1 month ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, incertum

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/falco/blob/master/OWNERS)~~ [Andreagit97,FedeDP,incertum] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
FedeDP commented 1 month ago

/unhold