uhei commented 6 months ago

Adding CloudTrail fields requestParameters as ct.request and responseElements as ct.response.

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area plugins

What this PR does / why we need it:

There are too many parameters/elements in requestParameters/responseElements for all the different API calls to have a dedicated field for every one. Nevertheless, I want to be able to filter or search for the content of these fields in Logray.

This commit provides the entire content of the two fields.

Maybe we can have a 'Custom CloudTrail requestParameters fields' option in Logray (like we have it for 'Custom HTTP Header Fields') in the future. But this needs to be discussed in a separate issue in the Wireshark project.

github-actions[bot] commented 6 months ago

Rules files suggestions

aws_cloudtrail_rules.yaml

Comparing a28b81cc0837575be80da1121c382e7efb687fca with latest tag cloudtrail-0.11.0

No changes detected

leogr commented 6 months ago

cc @Issif

Issif commented 6 months ago

/lgtm

makes sense to avoid these elements for the ouput

poiana commented 6 months ago

LGTM label has been added.

Git tree hash: 7d5540011f8ab46bfa899fb3abe429468ef6486f

poiana commented 6 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Issif, leogr, uhei

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/plugins/blob/master/OWNERS)~~ [leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

falcosecurity / plugins

feat(cloudtrail): Add ct.response and ct.request field #417

Rules files suggestions

aws_cloudtrail_rules.yaml