search

openrca / orca

Root Cause Analysis for Kubernetes
https://openrca.io
Apache License 2.0
88 stars 10 forks source link

Falco alerts mapping #35

Closed bzurkowski closed 4 years ago

bzurkowski commented 4 years ago

Falco provides a comprehensive set of alerting rules for Kubernetes such as:

Open RCA enables connecting some of these alerts to elements present in the infra graph by using a mapping file. The entries in the file are of the form:

- name: "Create Sensitive Mount Pod"
  source_mapping:
    origin: kubernetes
    kind: pod
    properties:
      name: ka.resp.name
      namespace: ka.target.namespace

The example above describes that whenever there is a Create Sensitive Mount Pod alert detected, it should be mapped to graph element of kubernetes origin and pod kind, and connected to an element with properties name and namespace with values fetched from labels in alert payload, named correspondingly ka.resp.name and ka.target.namespace.

The mapping file is not complete. There is still a significant number of alerts that Open RCA cannot recognize. The remaining alerting rules should be reviewed and integrated into the mapping.

bzurkowski commented 4 years ago

This enhancement might be partially blocked by https://github.com/openrca/orca/issues/13.

aleksandra-galara commented 4 years ago

Hi, I'd like to work on this issue, so if you can.. assign it to me! ;)

aleksandra-galara commented 4 years ago

Hi, I've created the list of Falco alerts:

Are there any alerts, which shouldn't be mapped? ;)

bzurkowski commented 4 years ago

It's actually easier to point out the ones that could be mapped 😄

Others, as you suggested offline, warn about creation/deletion of K8S entities. Since OpenRCA records all cluster events, we can skip them.