falcosecurity / plugins

Falco plugins registry
Apache License 2.0
86 stars 80 forks source link

Adding a custom logger as an event input source #526

Open wzyhay opened 2 months ago

wzyhay commented 2 months ago

Motivation When I add rules for custom data sources, it is not always so convenient. Can the team add new event sources for rule debugging, such as logs or test demos?

Feature The scenario is that there is a huge event stream, which requires a lot of rules to filter alarms, but it is also necessary to verify whether each rule is effective. The event source of the existing plug-in is not so convenient to use. It would be great if users could write a log file to simulate adding corresponding logs and use it as an input source to verify whether the custom rules can be hit normally through the engine.

Alternatives

Additional context