Skip to content

Commit f5d1c0d

Browse files
nazargesyknazargesyk
committed
gis-9071 add new platform falco
1 parent 3e2c071 commit f5d1c0d

File tree

6 files changed

+163
-0
lines changed

6 files changed

+163
-0
lines changed

‎uncoder-core/app/translator/mappings/platforms/falco/default.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
platform: Falco
2+
source: default
3+
4+
5+
field_mapping:
6+
{}

‎uncoder-core/app/translator/platforms/falco/__init__.py

Whitespace-only changes.

‎uncoder-core/app/translator/platforms/falco/const.py

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
from app.translator.core.models.platform_details import PlatformDetails
2+
3+
FALCO_RULE_DETAILS = {
4+
"platform_id": "falco-yaml-rule",
5+
"name": "Falco YAML Rule",
6+
"platform_name": "Rule (YAML)",
7+
"group_id": "falco",
8+
"group_name": "Falco",
9+
}
10+
11+
falco_rule_details = PlatformDetails(**FALCO_RULE_DETAILS)

‎uncoder-core/app/translator/platforms/falco/mapping.py

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
from app.translator.core.mapping import BasePlatformMappings, LogSourceSignature
2+
from app.translator.platforms.falco.const import falco_rule_details
3+
4+
5+
class FalcoRuleLogSourceSignature(LogSourceSignature):
6+
7+
def is_suitable(self) -> bool:
8+
return True
9+
10+
11+
class FalcoRuleMappings(BasePlatformMappings):
12+
13+
def prepare_log_source_signature(self, mapping: dict) -> FalcoRuleLogSourceSignature:
14+
return FalcoRuleLogSourceSignature()
15+
16+
17+
falco_rule_mappings = FalcoRuleMappings(platform_dir="falco", platform_details=falco_rule_details)

‎uncoder-core/app/translator/platforms/falco/renders/__init__.py

Whitespace-only changes.

‎uncoder-core/app/translator/platforms/falco/renders/falco.py

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
"""
2+
Uncoder IO Community Edition License
3+
-----------------------------------------------------------------
4+
Copyright (c) 2024 SOC Prime, Inc.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-----------------------------------------------------------------
18+
"""
19+
from typing import Optional
20+
21+
import yaml
22+
23+
from app.translator.const import DEFAULT_VALUE_TYPE
24+
from app.translator.core.mapping import LogSourceSignature, SourceMapping
25+
from app.translator.core.models.platform_details import PlatformDetails
26+
from app.translator.core.models.query_container import MetaInfoContainer
27+
from app.translator.core.render import BaseFieldValueRender, PlatformQueryRender
28+
from app.translator.core.str_value_manager import StrValueManager
29+
from app.translator.managers import render_manager
30+
from app.translator.platforms.falco.const import falco_rule_details
31+
from app.translator.platforms.falco.mapping import falco_rule_mappings, FalcoRuleMappings
32+
33+
34+
class FalcoFieldValueRender(BaseFieldValueRender):
35+
details = falco_rule_details
36+
str_value_manager: StrValueManager = None
37+
#
38+
# def equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
39+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.EQ.capitalize())
40+
41+
# def not_equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
42+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.NOT_EQ.capitalize())
43+
#
44+
# def less_modifier(self, field: str, value: Union[int, str]) -> str: # noqa: ARG002
45+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.LT.capitalize())
46+
#
47+
# def less_or_equal_modifier(self, field: str, value: Union[int, str]) -> str: # noqa: ARG002
48+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.LTE.capitalize())
49+
#
50+
# def greater_modifier(self, field: str, value: Union[int, str]) -> str: # noqa: ARG002
51+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.GT.capitalize())
52+
#
53+
# def greater_or_equal_modifier(self, field: str, value: Union[int, str]) -> str: # noqa: ARG002
54+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.GTE.capitalize())
55+
#
56+
# def contains_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
57+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.CONTAINS.capitalize())
58+
#
59+
# def not_contains_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
60+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.NOT_CONTAINS.capitalize())
61+
#
62+
# def endswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
63+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.ENDSWITH.capitalize())
64+
#
65+
# def not_endswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
66+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.NOT_ENDSWITH.capitalize())
67+
#
68+
# def startswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
69+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.STARTSWITH.capitalize())
70+
#
71+
# def not_startswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
72+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.NOT_STARTSWITH.capitalize())
73+
#
74+
# def regex_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
75+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.REGEX.capitalize())
76+
#
77+
# def not_regex_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
78+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.NOT_REGEX.capitalize())
79+
#
80+
# def keywords(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
81+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.KEYWORD.capitalize())
82+
#
83+
# def is_none(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
84+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.IS_NONE.capitalize())
85+
#
86+
# def is_not_none(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: # noqa: ARG002
87+
# raise UnsupportedRenderMethod(platform_name=self.details.name, method=OperatorType.IS_NOT_NONE.capitalize())
88+
89+
90+
@render_manager.register
91+
class FalcoRuleRender(PlatformQueryRender):
92+
details: PlatformDetails = falco_rule_details
93+
mappings: FalcoRuleMappings = falco_rule_mappings
94+
95+
or_token = "or"
96+
and_token = "and"
97+
not_token = "not"
98+
99+
comment_symbol = "//"
100+
101+
field_value_render = FalcoFieldValueRender(or_token=or_token)
102+
103+
def generate_prefix(self, log_source_signature: Optional[LogSourceSignature], functions_prefix: str = "") -> str: # noqa: ARG002
104+
return ""
105+
106+
107+
def finalize_query(
108+
self,
109+
prefix: str,
110+
query: str,
111+
functions: str,
112+
meta_info: Optional[MetaInfoContainer] = None,
113+
source_mapping: Optional[SourceMapping] = None, # noqa: ARG002
114+
not_supported_functions: Optional[list] = None,
115+
unmapped_fields: Optional[list[str]] = None,
116+
*args, # noqa: ARG002
117+
**kwargs, # noqa: ARG002
118+
) -> str:
119+
query = super().finalize_query(prefix=prefix, query=query, functions=functions)
120+
default_output = "shell in a container (user=%user.name container_id=%container.id container_name=%container.name)"
121+
rule = {
122+
"rule": meta_info.title or "Falco Rule",
123+
"condition": query,
124+
"desc": meta_info.description or "Falco Rule",
125+
"output": default_output,
126+
"priority": "alert",
127+
}
128+
rule = yaml.dump(rule, default_flow_style=False, sort_keys=False)
129+
return rule

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy