Skip to content

Commit 34e68d4

Browse files
ZaulaoZaulao
authored
Merge branch 'falcosecurity:main' into feat/cloudtrail-ssm-request-params
2 parents 5186e26 + fb2ad64 commit 34e68d4

File tree

5 files changed

+45
-36
lines changed

5 files changed

+45
-36
lines changed

‎plugins/container/CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Changelog
22

3+
## v0.6.3
4+
5+
* [`9a3ee4c`](https://github.com/falcosecurity/plugins/commit/9a3ee4c) fix(plugins/container): correct image parsing with registry port
6+
7+
38
## v0.6.2
49

510
* [`bff3406`](https://github.com/falcosecurity/plugins/commit/bff3406) perf(container): cache cgroup path to container ID resolution results

‎plugins/container/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules")
99
# project metadata
1010
project(
1111
container
12-
VERSION 0.6.2
12+
VERSION 0.6.3
1313
DESCRIPTION "Falco container metadata enrichment Plugin"
1414
LANGUAGES CXX)
1515

‎plugins/gcpaudit/README.md‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -87,33 +87,33 @@ For more details about what Cloud logging log queries, see the [GCP official doc
8787
# Supported Fields
8888

8989
<!-- README-PLUGIN-FIELDS -->
90-
| NAME | TYPE | ARG | DESCRIPTION |
91-
|-------------------------------|----------|------|-------------------------------------------------|
92-
| `gcp.user` | `string` | None | GCP principal email who committed the action |
93-
| `gcp.callerIP` | `string` | None | GCP principal caller IP |
94-
| `gcp.userAgent` | `string` | None | GCP principal caller useragent |
95-
| `gcp.authorizationInfo` | `string` | None | GCP authorization information affected resource |
96-
| `gcp.serviceName` | `string` | None | GCP API service name |
97-
| `gcp.policyDelta` | `string` | None | GCP service resource access policy |
98-
| `gcp.request` | `string` | None | GCP API raw request |
99-
| `gcp.methodName` | `string` | None | GCP API service method executed |
100-
| `gcp.cloudfunctions.function` | `string` | None | GCF name |
101-
| `gcp.cloudsql.databaseId` | `string` | None | GCP SQL database ID |
102-
| `gcp.compute.instanceId` | `string` | None | GCE instance ID |
103-
| `gcp.compute.networkId` | `string` | None | GCP network ID |
104-
| `gcp.compute.subnetwork` | `string` | None | GCP subnetwork name |
105-
| `gcp.compute.subnetworkId` | `string` | None | GCP subnetwork ID |
106-
| `gcp.dns.zone` | `string` | None | GCP DNS zoned |
107-
| `gcp.iam.serviceAccount` | `string` | None | GCP service account |
108-
| `gcp.iam.serviceAccountId` | `string` | None | GCP IAM unique ID |
109-
| `gcp.location` | `string` | None | GCP region |
110-
| `gcp.logging.sink` | `string` | None | GCP logging sink |
111-
| `gcp.projectId` | `string` | None | GCP project ID |
112-
| `gcp.resourceName` | `string` | None | GCP resource name |
113-
| `gcp.resourceType` | `string` | None | GCP resource type |
114-
| `gcp.resourceLabels` | `string` | None | GCP resource labels |
115-
| `gcp.storage.bucket` | `string` | None | GCP bucket name |
116-
| `gcp.time` | `string` | None | Timestamp of the event in RFC3339 format |
90+
| NAME | TYPE | ARG | DESCRIPTION |
91+
|-------------------------------|----------|------|------------------------------------------|
92+
| `gcp.user` | `string` | None | GCP principal, actor of the action |
93+
| `gcp.callerIP` | `string` | None | Actor's IP |
94+
| `gcp.userAgent` | `string` | None | Actor's User Agent |
95+
| `gcp.authorizationInfo` | `string` | None | GCP authorization (JSON) |
96+
| `gcp.serviceName` | `string` | None | GCP API service name |
97+
| `gcp.policyDelta` | `string` | None | GCP service resource access policy delta |
98+
| `gcp.request` | `string` | None | GCP API raw request (JSON) |
99+
| `gcp.methodName` | `string` | None | GCP API service method executed |
100+
| `gcp.cloudfunctions.function` | `string` | None | GCF name |
101+
| `gcp.cloudsql.databaseId` | `string` | None | GCP SQL database ID |
102+
| `gcp.compute.instanceId` | `string` | None | GCE instance ID |
103+
| `gcp.compute.networkId` | `string` | None | GCP network ID |
104+
| `gcp.compute.subnetwork` | `string` | None | GCP subnetwork name |
105+
| `gcp.compute.subnetworkId` | `string` | None | GCP subnetwork ID |
106+
| `gcp.dns.zone` | `string` | None | GCP DNS zone |
107+
| `gcp.iam.serviceAccount` | `string` | None | GCP service account |
108+
| `gcp.iam.serviceAccountId` | `string` | None | GCP IAM unique ID |
109+
| `gcp.location` | `string` | None | GCP region |
110+
| `gcp.logging.sink` | `string` | None | GCP logging sink |
111+
| `gcp.projectId` | `string` | None | GCP project ID |
112+
| `gcp.resourceName` | `string` | None | GCP resource name |
113+
| `gcp.resourceType` | `string` | None | GCP resource type |
114+
| `gcp.resourceLabels` | `string` | None | GCP resource labels (JSON) |
115+
| `gcp.storage.bucket` | `string` | None | GCP bucket name |
116+
| `gcp.time` | `string` | None | Timestamp of the event in RFC3339 format |
117117
<!-- /README-PLUGIN-FIELDS -->
118118

119119
# Development

‎plugins/gcpaudit/pkg/gcpaudit/extract.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,29 +27,29 @@ import (
2727

2828
func (p *Plugin) Fields() []sdk.FieldEntry {
2929
return []sdk.FieldEntry{
30-
{Type: "string", Name: "gcp.user", Display: "User", Desc: "GCP principal email who committed the action"},
31-
{Type: "string", Name: "gcp.callerIP", Display: "Caller IP", Desc: "GCP principal caller IP"},
32-
{Type: "string", Name: "gcp.userAgent", Display: "User Agent", Desc: "GCP principal caller useragent"},
33-
{Type: "string", Name: "gcp.authorizationInfo", Display: "Authorization Info", Desc: "GCP authorization information affected resource"},
30+
{Type: "string", Name: "gcp.user", Display: "User", Desc: "GCP principal, actor of the action"},
31+
{Type: "string", Name: "gcp.callerIP", Display: "Caller IP", Desc: "Actor's IP"},
32+
{Type: "string", Name: "gcp.userAgent", Display: "User Agent", Desc: "Actor's User Agent"},
33+
{Type: "string", Name: "gcp.authorizationInfo", Display: "Authorization Info", Desc: "GCP authorization (JSON)"},
3434
{Type: "string", Name: "gcp.serviceName", Display: "Service Name", Desc: "GCP API service name"},
35-
{Type: "string", Name: "gcp.policyDelta", Display: "Policy", Desc: "GCP service resource access policy"},
36-
{Type: "string", Name: "gcp.request", Display: "Request", Desc: "GCP API raw request"},
35+
{Type: "string", Name: "gcp.policyDelta", Display: "Policy", Desc: "GCP service resource access policy delta"},
36+
{Type: "string", Name: "gcp.request", Display: "Request", Desc: "GCP API raw request (JSON)"},
3737
{Type: "string", Name: "gcp.methodName", Display: "Method", Desc: "GCP API service method executed"},
3838
{Type: "string", Name: "gcp.cloudfunctions.function", Display: "Function Name", Desc: "GCF name"},
3939
{Type: "string", Name: "gcp.cloudsql.databaseId", Display: "Database ID", Desc: "GCP SQL database ID"},
4040
{Type: "string", Name: "gcp.compute.instanceId", Display: "Instance ID", Desc: "GCE instance ID"},
4141
{Type: "string", Name: "gcp.compute.networkId", Display: "Network ID", Desc: "GCP network ID"},
4242
{Type: "string", Name: "gcp.compute.subnetwork", Display: "Subnetwork Name", Desc: "GCP subnetwork name"},
4343
{Type: "string", Name: "gcp.compute.subnetworkId", Display: "Subnetwork ID", Desc: "GCP subnetwork ID"},
44-
{Type: "string", Name: "gcp.dns.zone", Display: "DNS Zone", Desc: "GCP DNS zoned"},
44+
{Type: "string", Name: "gcp.dns.zone", Display: "DNS Zone", Desc: "GCP DNS zone"},
4545
{Type: "string", Name: "gcp.iam.serviceAccount", Display: "Service Account", Desc: "GCP service account"},
4646
{Type: "string", Name: "gcp.iam.serviceAccountId", Display: "Service Account ID", Desc: "GCP IAM unique ID"},
4747
{Type: "string", Name: "gcp.location", Display: "Location", Desc: "GCP region"},
4848
{Type: "string", Name: "gcp.logging.sink", Display: "Sink", Desc: "GCP logging sink"},
4949
{Type: "string", Name: "gcp.projectId", Display: "Project ID", Desc: "GCP project ID"},
5050
{Type: "string", Name: "gcp.resourceName", Display: "Resource Name", Desc: "GCP resource name"},
5151
{Type: "string", Name: "gcp.resourceType", Display: "Resource Type", Desc: "GCP resource type"},
52-
{Type: "string", Name: "gcp.resourceLabels", Display: "Resource Labels", Desc: "GCP resource labels"},
52+
{Type: "string", Name: "gcp.resourceLabels", Display: "Resource Labels", Desc: "GCP resource labels (JSON)"},
5353
{Type: "string", Name: "gcp.storage.bucket", Display: "Bucket Name", Desc: "GCP bucket name"},
5454
{Type: "string", Name: "gcp.time", Display: "Timestamp of the event", Desc: "Timestamp of the event in RFC3339 format"},
5555
}

‎plugins/okta/pkg/okta/okta.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,10 @@ func (oktaPlugin *Plugin) Extract(req sdk.ExtractRequest, evt sdk.EventReader) e
375375
req.SetValue(data.SecurityContext.Domain)
376376
case "okta.security.isproxy":
377377
req.SetValue(data.SecurityContext.IsProxy)
378+
case "okta.target.displayName":
379+
if len(data.Target) > 0 {
380+
req.SetValue(data.Target[0].DisplayName)
381+
}
378382
case "okta.target.user.id":
379383
for _, i := range data.Target {
380384
if i.Type == "User" {

0 commit comments

Comments
 (0)