search

falcosecurity / falco

Cloud Native Runtime Security
https://falco.org
Apache License 2.0
7.39k stars 902 forks source link

Add hostname to slack notification #483

Closed ashishxooa closed 5 years ago

ashishxooa commented 5 years ago

Hi,

Is there a way where I can append the hostname to the messages I 'm getting on slack?

Eg. I 've received the below alert. Which gives me the container id, now this container ID could be anywhere on my servers running docker.

10:19:08.010189604: Informational Container with sensitive mount started (user=root command=runc:[1:CHILD] init docker123321-mysql (id=c2feddeb9679) image=alpine:latest mounts=/etc:/mnt/etc::true:rprivate)

How do I know quickly the host from this alert? It could be variable like $Hostname or even hard-coded value but it's needed. Thanks.

mfdii commented 5 years ago

@mstemm Sysdig doesn't have a hostname field. I assume we should open this against sysdig?

mstemm commented 5 years ago

Yeah I guess handling it in sysdig would be fine. It's on the line between something that should be added in the event or something added to the alert.

stale[bot] commented 5 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

leodido commented 5 years ago

@mfdii @mstemm could you please update the status of this?

/triage support

mstemm commented 5 years ago

No changes yet. You could always add the hostname when creating the json that goes to the slack webhook, but there isn't anything automatic from falco.

ashishxooa commented 5 years ago

@mstemm so different web hook configuration for different hosts?

mstemm commented 5 years ago

What the fix for this would look like would be to add filtercheck fields something like %host.name to sysdig, and then using them in falco. Then the text of the falco alert would have the hostname.

What I meant by "add the hostname when creating the json" was that you could change the json however you wished before sending it to the slack webhook, including adding a hostname.

fntlnz commented 5 years ago

Closing in favor of https://github.com/falcosecurity/falco/issues/528