Merge remote-tracking branch 'origin/main' into fix/cre-2025-0026

Author: lsibilla

rules/cre-2024-0021/keda-nil-pointer.yaml

@@ -40,7 +40,7 @@ rules:
       set:
         window: 5s
         event:
-          source: cre.log.keda-operator.2.*
+          source: cre.log.keda-operator
         match:
           - value: "ResolveScaleTargetPodSpec"
           - value: "scale_resolvers.go"

rules/cre-2025-0028/opentelemetry-python-fails-to.yaml

@@ -38,7 +38,7 @@ rules:
   rule:
     set:
       event:
-        source: cre.log.opentelemetry-python
+        source: cre.log.opentelemetry-collector
       window: 5s
       match:
         - value: ERROR opentelemetry.context:Failed to detach context

rules/cre-2025-0034/datadog-agent-disabled-due-to.yaml

@@ -40,6 +40,6 @@ rules:
   rule:
     set:
       event:
-        source: cre.log.datadog
+        source: cre.log.datadog.agent
       match:
         - regex: .*DD_API_KEY undefined\. Metrics, logs and events will not be reported to DataDog.*

rules/cre-2025-0059/dd-cws-instrumentation-webhook-fails.yaml

@@ -43,7 +43,7 @@ rules:
   rule:
     set:
       event:
-        source: cre.log.datadog
+        source: cre.log.datadog.agent
       match:
         - regex: 'failed to register CWS Instrumentation webhook.*cluster_agent\.service_account_name'
 

rules/cre-2025-0060/dd-openmetrics-scrape-404.yaml

@@ -37,6 +37,6 @@ rules:
   rule:
     set:
       event:
-        source: cre.log.datadog
+        source: cre.log.datadog.agent
       match:
         - regex: "Error running check:.*http://[0-9.]+:7801/metrics: 404 Client Error: Not Found for url: http://[0-9.]+:7801/metrics"

rules/cre-2025-0069/kubernetes-fsgroup-nfs-ignored.yaml

@@ -49,7 +49,7 @@ rules:
       set:
         window: 5s
         event:
-          source: cre.k8s.manifest
+          source: cre.prequel.kubernetes.resource.persistentvolumes.v1
         match:
           - jq: '.kind == "PersistentVolume" and (.spec.nfs != null)'
           - jq: >

rules/cre-2025-0071/coredns-unavailable-dns-outage.yaml

@@ -53,6 +53,6 @@ rules:
     rule:
       set:
         event:
-          source: cre.log.kubernetes
+          source: cre.kubernetes
         match:
           - regex: "Scaled down replica set coredns-.+ from [1-9]+ to 0|Stopping container coredns|Readiness probe failed.+connection refused" 

rules/cre-2025-0088/nats-slow-consumer-concise.yaml

@@ -47,7 +47,7 @@ rules:
     rule:
       set:
         event:
-          source: cre.log.nats.jetstream
+          source: cre.log.nats
         match:
           - regex: '(?i)jetstream\s+failed\s+to\s+store.*maximum\s+bytes\s+exceeded'
             count: 1

rules/cre-2025-0090/loki-log-line-long.yaml

@@ -46,9 +46,11 @@ rules:
         - grafana
       references:
         - "https://grafana.com/docs/grafana-cloud/send-data/logs/troubleshoot/#line-too-long"
+      impactScore: 5
+      mitigationScore: 5
     rule:
       set: # Using 'set' for single event matching, as it's a single log line detection
         event:
-          source: Alloy log
+          source: cre.log.alloy
         match:
           - regex: level=error(.+)final error sending batch(.+)component_id=loki\.write\.endpoint(.+)error(.+)server returned HTTP status 400 Bad Request(.+)Max entry size(.+)exceeded for stream

rules/cre-2025-0099/redpanda-memory-startup-crash.yaml

@@ -61,7 +61,7 @@ rules:
       sequence:
         window: "120s"
         event:
-          source: application-logs
+          source: cre.log.redpanda
           origin: true
         order:
           - permission_failures