gis-9071 add mapping to falco

nazargesyk · nazargesyk · commit 94e7de5708b5 · 2024-11-19T09:53:56.000+02:00
diff --git a/uncoder-core/app/translator/mappings/platforms/falco/aws_cloudtrail.yml b/uncoder-core/app/translator/mappings/platforms/falco/aws_cloudtrail.yml
@@ -0,0 +1,8 @@
+platform: Falco
+source: aws_cloudtrail
+
+field_mapping:
+  eventSource: ct.src
+  eventName: ct.name
+  errorCode: ct.error
+  RequestParameters: json.value[/requestParameters]
diff --git a/uncoder-core/app/translator/platforms/falco/mapping.py b/uncoder-core/app/translator/platforms/falco/mapping.py
@@ -1,4 +1,4 @@
-from app.translator.core.mapping import BasePlatformMappings, LogSourceSignature
+from app.translator.core.mapping import BaseStrictLogSourcesPlatformMappings, LogSourceSignature
 from app.translator.platforms.falco.const import falco_rule_details
 
 
@@ -10,7 +10,7 @@ def is_suitable(self) -> bool:
         return True
 
 
-class FalcoRuleMappings(BasePlatformMappings):
+class FalcoRuleMappings(BaseStrictLogSourcesPlatformMappings):
     def prepare_log_source_signature(self, mapping: dict) -> FalcoRuleLogSourceSignature:  # noqa: ARG002
         return FalcoRuleLogSourceSignature()
 
