search

falcosecurity / plugins

Falco plugins registry
Apache License 2.0
82 stars 75 forks source link

General rules clean up #392

Closed mikegcoleman closed 8 months ago

mikegcoleman commented 8 months ago

What type of PR is this?

Uncomment one (or more) /kind <> lines: /kind cleanup

/area plugins

There were some grammatical errors in the rules themselves. Also some rules output messages were wrong (e.g. it would say "an object was created" when the rule was for deletion). I also separated some rules into two rules - in particular I tried to create "delete" and "modify" rules separately since I think admins would prefer to have more specificity in their output.

Which issue(s) this PR fixes: Fixes #391

Special notes for your reviewer:

poiana commented 8 months ago

Welcome @mikegcoleman! It looks like this is your first PR to falcosecurity/plugins 🎉

leogr commented 8 months ago

Hey @mikegcoleman

It looks like there're some yaml validation issues. Could you take a look at the failing tests and fix them, please?

For example https://github.com/falcosecurity/plugins/actions/runs/7414200888/job/20294145856?pr=392

mikegcoleman commented 8 months ago

@leogr fixed the formatting issues. took a note to run the yaml validator before submitting a PR next time :)

github-actions[bot] commented 8 months ago

Rules files suggestions

gcp_auditlog_rules.yaml

Comparing 77d72e0768f297e5a896ecf8678e1abeebfa15a9 with latest tag gcpaudit-0.2.2

Major changes:

Minor changes:

leogr commented 8 months ago

Major changes:

  • Rule GCP IAM serviceAccount key deleted has been removed
  • Rule GCP IAM serviceAccount deleted has been removed
  • Rule GCP IAM serviceAccount modified has been removed
  • Rule GCP backendService deleted has been removed
  • Rule GCP IAM serviceAccount created has been removed
  • Rule GCP IAM serviceAccount key created has been removed
  • Rule GCP IAM principle modified has been removed
  • Rule GCP cloud function updated or deleted has been removed
  • Rule GCP KMS updated or deleted has been removed
  • Rule GCP Pub/Sub Subscriber modified has been removed

Note for releasers: we can just bump the minor since the major is still 0 cc @LucaGuerra @Andreagit97 @jasondellaluce

poiana commented 8 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr, mikegcoleman

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[plugins/gcpaudit/OWNERS](https://github.com/falcosecurity/plugins/blob/master/plugins/gcpaudit/OWNERS)~~ [leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
poiana commented 8 months ago

LGTM label has been added.

Git tree hash: c1ddb2d29737afa468576f67647a128c16193e90