add Zincsearch output

Signed-off-by: Thomas Labarussias <[email protected]>

README.md

@@ -53,6 +53,7 @@ It works as a single endpoint for as many as you want `Falco` instances :
 - [**AWS CloudWatchLogs**](https://aws.amazon.com/cloudwatch/features/)
 - [**Grafana**](https://grafana.com/) (annotations)
 - **Syslog**
+- [**Zincsearch**](https://docs.zincsearch.com/)
 
 ### Object Storage
 
@@ -500,6 +501,14 @@ mqtt:
   # password: "" # Password if the authentication is enabled in the broker
   # checkcert: true # check if ssl certificate of the output is valid (default: true)
   # minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
+
+zincsearch:
+  # hostport: "" # http://{domain or ip}:{port}, if not empty, ZincSearch output is enabled
+  # index: "falco" # index (default: falco)
+  # username: "" # use this username to authenticate to ZincSearch (default: "")
+  # password: "" # use this password to authenticate to ZincSearch (default: "")
+  # checkcert: true # check if ssl certificate of the output is valid (default: true)
+  # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
 ```
 
 Usage :
@@ -932,6 +941,12 @@ care of lower/uppercases**) : `yaml: a.b --> envvar: A_B` :
 - **MQTT_PASSWORD**: password if the authentication is enabled in the broker
 - **MQTT_CHECKCERT**: check if ssl certificate of the output is valid (default: `true`)
 - **MQTT_PRUNEBYPRIORITY**: if true; the events with lowest severity are pruned first, in FIFO order (default: `false`)
+- **ZINC_HOSTPORT**: http://{domain or ip}:{port}, if not empty, ZincSearch output is enabled
+- **ZINC_INDEX**: index (default: falco)
+- **ZINC_USERNAME**: this username to authenticate to ZincSearch (default: "")
+- **ZINC_PASSWORD**: use this password to authenticate to ZincSearch (default: "")
+- **ZINC_CHECKCERT**: if ssl certificate of the output is valid (default: true)
+- **ZINC_MINIMUMPRIORITY**: minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug
 
 #### Slack/Rocketchat/Mattermost/Googlechat Message Formatting
 

config.go

@@ -349,6 +349,13 @@ func getConfig() *types.Configuration {
 	v.SetDefault("MQTT.CheckCert", true)
 	v.SetDefault("MQTT.MinimumPriority", "")
 
+	v.SetDefault("Zincsearch.HostPort", "")
+	v.SetDefault("Zincsearch.Index", "falco")
+	v.SetDefault("Zincsearch.Username", "")
+	v.SetDefault("Zincsearch.Password", "")
+	v.SetDefault("Zincsearch.CheckCert", true)
+	v.SetDefault("Zincsearch.MinimumPriority", "")
+
 	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
 	v.AutomaticEnv()
 	if *configFile != "" {

config_example.yaml

@@ -334,4 +334,12 @@ mqtt:
   # user: "" # User if the authentication is enabled in the broker
   # password: "" # Password if the authentication is enabled in the broker
   # checkcert: true # check if ssl certificate of the output is valid (default: true)
-  # minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
+  # minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
+
+zincsearch:
+  # hostport: "" # http://{domain or ip}:{port}, if not empty, ZincSearch output is enabled
+  # index: "falco" # index (default: falco)
+  # username: "" # use this username to authenticate to ZincSearch (default: "")
+  # password: "" # use this password to authenticate to ZincSearch (default: "")
+  # checkcert: true # check if ssl certificate of the output is valid (default: true)
+  # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)

handlers.go

@@ -336,4 +336,8 @@ func forwardEvent(falcopayload types.FalcoPayload) {
 	if config.MQTT.Broker != "" && (falcopayload.Priority >= types.Priority(config.MQTT.MinimumPriority) || falcopayload.Rule == testRule) {
 		go mqttClient.MQTTPublish(falcopayload)
 	}
+
+	if config.Zincsearch.HostPort != "" && (falcopayload.Priority >= types.Priority(config.Zincsearch.MinimumPriority) || falcopayload.Rule == testRule) {
+		go zincsearchClient.ZincsearchPost(falcopayload)
+	}
 }

main.go

@@ -56,6 +56,7 @@ var (
 	yandexClient        *outputs.Client
 	syslogClient        *outputs.Client
 	mqttClient          *outputs.Client
+	zincsearchClient    *outputs.Client
 
 	statsdClient, dogstatsdClient *statsd.Client
 	config                        *types.Configuration
@@ -570,6 +571,16 @@ func init() {
 		}
 	}
 
+	if config.Zincsearch.HostPort != "" {
+		var err error
+		zincsearchClient, err = outputs.NewClient("Zincsearch", config.Zincsearch.HostPort+"/api/"+config.Zincsearch.Index+"/_doc", false, config.Zincsearch.CheckCert, config, stats, promStats, statsdClient, dogstatsdClient)
+		if err != nil {
+			config.Zincsearch.HostPort = ""
+		} else {
+			outputs.EnabledOutputs = append(outputs.EnabledOutputs, "Zincsearch")
+		}
+	}
+
 	log.Printf("[INFO]  : Falco Sidekick version: %s\n", GetVersionInfo().GitVersion)
 	log.Printf("[INFO]  : Enabled Outputs : %s\n", outputs.EnabledOutputs)
 

outputs/zincsearch.go

@@ -0,0 +1,37 @@
+package outputs
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/falcosecurity/falcosidekick/types"
+)
+
+// ZincsearchPost posts event to Zincsearch
+func (c *Client) ZincsearchPost(falcopayload types.FalcoPayload) {
+	c.Stats.Zincsearch.Add(Total, 1)
+
+	if c.Config.Zincsearch.Username != "" && c.Config.Zincsearch.Password != "" {
+		c.BasicAuth(c.Config.Zincsearch.Username, c.Config.Zincsearch.Password)
+	}
+
+	fmt.Println(c.EndpointURL)
+	err := c.Post(falcopayload)
+	if err != nil {
+		c.setZincsearchErrorMetrics()
+		log.Printf("[ERROR] : Zincsearch - %v\n", err)
+		return
+	}
+
+	// Setting the success status
+	go c.CountMetric(Outputs, 1, []string{"output:zincsearch", "status:ok"})
+	c.Stats.Zincsearch.Add(OK, 1)
+	c.PromStats.Outputs.With(map[string]string{"destination": "zincsearch", "status": OK}).Inc()
+}
+
+// setZincsearchErrorMetrics set the error stats
+func (c *Client) setZincsearchErrorMetrics() {
+	go c.CountMetric(Outputs, 1, []string{"output:zincsearch", "status:error"})
+	c.Stats.Zincsearch.Add(Error, 1)
+	c.PromStats.Outputs.With(map[string]string{"destination": "zincsearch", "status": Error}).Inc()
+}

stats.go

@@ -69,6 +69,7 @@ func getInitStats() *types.Statistics {
 		MQTT:              getOutputNewMap("mqtt"),
 		PolicyReport:      getOutputNewMap("policyreport"),
 		NodeRed:           getOutputNewMap("nodered"),
+		Zincsearch:        getOutputNewMap("zincsearch"),
 	}
 	stats.Falco.Add(outputs.Emergency, 0)
 	stats.Falco.Add(outputs.Alert, 0)

types/types.go

@@ -73,6 +73,7 @@ type Configuration struct {
 	Syslog             SyslogConfig
 	NodeRed            NodeRedOutputConfig
 	MQTT               MQTTConfig
+	Zincsearch         zincsearchOutputConfig
 }
 
 // SlackOutputConfig represents parameters for Slack
@@ -524,6 +525,16 @@ type fissionConfig struct {
 	MutualTLS       bool
 }
 
+// zincsearchOutputConfig represents config parameters for Zincsearch
+type zincsearchOutputConfig struct {
+	HostPort        string
+	Index           string
+	Username        string
+	Password        string
+	CheckCert       bool
+	MinimumPriority string
+}
+
 // Statistics is a struct to store stastics
 type Statistics struct {
 	Requests          *expvar.Map
@@ -577,6 +588,7 @@ type Statistics struct {
 	PolicyReport      *expvar.Map
 	NodeRed           *expvar.Map
 	MQTT              *expvar.Map
+	Zincsearch        *expvar.Map
 }
 
 // PromStatistics is a struct to store prometheus metrics