feat: add more Cloudtrail fields #413
Conversation
Add more fields as defined at https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html Signed-off-by: Uli Heilmeier <[email protected]>
|
Welcome @uhei! It looks like this is your first PR to falcosecurity/plugins 🎉 |
|
cc @Issif |
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
|
LGTM label has been added. Git tree hash: 3b1c543ed36edbb69f6a64bd4ae6312d54770666
|
I know there should be other planned changes to this plugin, so we can bump up in a later PR. Btw, the PR SGTM, too. I will do a second look soon and then approve. Thanks! |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Issif, leogr, uhei The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Add more fields as defined at
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area plugins
What this PR does / why we need it:
The current CloudTrail plugin is missing fields. This PR adds all currently defined fields according to https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html.
The fields
ct.addendum.*andct.edgedevicedetailsare untested due to missing events with these fields.Special notes for your reviewer:
The plugin has only been tested with falcodump, Logray and CloudTrail access via S3.