add size to s3.bytes

falcosecurity · Feb 2, 2024 · a14366f · a14366f
1 parent 58c7c01
commit a14366f
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/plugins/cloudtrail/pkg/cloudtrail/extract.go b/plugins/cloudtrail/pkg/cloudtrail/extract.go
@@ -587,14 +587,22 @@ func getfieldU64(jdata *fastjson.Value, field string) (bool, uint64) {
 		if out != nil {
 			tot = tot + getvalueU64(out)
 		}
-		return (in != nil || out != nil), tot
+		size := jdata.Get("detail", "object", "size")
+		if size != nil {
+			tot = tot + getvalueU64(size)
+		}
+		return (in != nil || out != nil || size != nil), tot
 	case "s3.bytes.in":
 		var tot uint64 = 0
 		in := jdata.Get("additionalEventData", "bytesTransferredIn")
 		if in != nil {
 			tot = tot + getvalueU64(in)
 		}
-		return (in != nil), tot
+		size := jdata.Get("detail", "object", "size")
+		if size != nil {
+			tot = tot + getvalueU64(size)
+		}
+		return (in != nil || size != nil), tot
 	case "s3.bytes.out":
 		var tot uint64 = 0
 		out := jdata.Get("additionalEventData", "bytesTransferredOut")