diff --git a/outputs/mattermost.go b/outputs/mattermost.go index fd7a5fd87e..c082031f64 100644 --- a/outputs/mattermost.go +++ b/outputs/mattermost.go @@ -44,6 +44,11 @@ func newMattermostPayload(falcopayload types.FalcoPayload, config *types.Configu field.Short = false field.Value = falcopayload.Time.String() fields = append(fields, field) + + attachment.Footer = "https://github.com/falcosecurity/falcosidekick" + if config.Slack.Footer != "" { + attachment.Footer = config.Slack.Footer + } } attachment.Fallback = falcopayload.Output @@ -93,7 +98,8 @@ func newMattermostPayload(falcopayload types.FalcoPayload, config *types.Configu Text: messageText, Username: "Falcosidekick", IconURL: iconURL, - Attachments: attachments} + Attachments: attachments, + } return s } @@ -102,11 +108,11 @@ func newMattermostPayload(falcopayload types.FalcoPayload, config *types.Configu func (c *Client) MattermostPost(falcopayload types.FalcoPayload) { err := c.Post(newMattermostPayload(falcopayload, c.Config)) if err != nil { - c.Stats.Rocketchat.Add("error", 1) + c.Stats.Mattermost.Add("error", 1) c.PromStats.Outputs.With(map[string]string{"destination": "mattermost", "status": "error"}).Inc() } else { - c.Stats.Rocketchat.Add("ok", 1) + c.Stats.Mattermost.Add("ok", 1) c.PromStats.Outputs.With(map[string]string{"destination": "mattermost", "status": "ok"}).Inc() } - c.Stats.Rocketchat.Add("total", 1) + c.Stats.Mattermost.Add("total", 1) } diff --git a/outputs/mattermost_test.go b/outputs/mattermost_test.go new file mode 100644 index 0000000000..f6b30bc7f4 --- /dev/null +++ b/outputs/mattermost_test.go @@ -0,0 +1,63 @@ +package outputs + +import ( + "encoding/json" + "reflect" + "testing" + "text/template" + + "github.com/falcosecurity/falcosidekick/types" +) + +func TestMattermostPayload(t *testing.T) { + expectedOutput := slackPayload{ + Text: "Rule: Test rule Priority: Debug", + Username: "Falcosidekick", + IconURL: "https://raw.githubusercontent.com/falcosecurity/falcosidekick/master/imgs/falcosidekick.png", + Attachments: []slackAttachment{ + { + Fallback: "This is a test from falcosidekick", + Color: "#ccfff2", + Text: "This is a test from falcosidekick", + Footer: "https://github.com/falcosecurity/falcosidekick", + Fields: []slackAttachmentField{ + { + Title: "proc.name", + Value: "falcosidekick", + Short: true, + }, + { + Title: "rule", + Value: "Test rule", + Short: true, + }, + { + Title: "priority", + Value: "Debug", + Short: true, + }, + { + Title: "time", + Value: "2001-01-01 01:10:00 +0000 UTC", + Short: false, + }, + }, + }, + }, + } + + var f types.FalcoPayload + json.Unmarshal([]byte(falcoTestInput), &f) + config := &types.Configuration{ + Mattermost: types.MattermostOutputConfig{ + Username: "Falcosidekick", + Icon: "https://raw.githubusercontent.com/falcosecurity/falcosidekick/master/imgs/falcosidekick.png", + }, + } + + config.Mattermost.MessageFormatTemplate, _ = template.New("").Parse("Rule: {{ .Rule }} Priority: {{ .Priority }}") + output := newMattermostPayload(f, config) + if !reflect.DeepEqual(output, expectedOutput) { + t.Fatalf("\nexpected payload: \n%#v\ngot: \n%#v\n", expectedOutput, output) + } +} diff --git a/outputs/slack.go b/outputs/slack.go index 5cdb4aa6e2..9e6c1632fc 100644 --- a/outputs/slack.go +++ b/outputs/slack.go @@ -15,7 +15,7 @@ type slackAttachmentField struct { Short bool `json:"short"` } -//Attachment +// Attachment type slackAttachment struct { Fallback string `json:"fallback"` Color string `json:"color"` diff --git a/outputs/slack_test.go b/outputs/slack_test.go index ae6324ec95..00e4882f72 100644 --- a/outputs/slack_test.go +++ b/outputs/slack_test.go @@ -15,28 +15,28 @@ func TestNewSlackPayload(t *testing.T) { Username: "Falcosidekick", IconURL: "https://raw.githubusercontent.com/falcosecurity/falcosidekick/master/imgs/falcosidekick.png", Attachments: []slackAttachment{ - slackAttachment{ + { Fallback: "This is a test from falcosidekick", Color: "#ccfff2", Text: "This is a test from falcosidekick", Footer: "https://github.com/falcosecurity/falcosidekick", Fields: []slackAttachmentField{ - slackAttachmentField{ + { Title: "proc.name", Value: "falcosidekick", Short: true, }, - slackAttachmentField{ + { Title: "rule", Value: "Test rule", Short: true, }, - slackAttachmentField{ + { Title: "priority", Value: "Debug", Short: true, }, - slackAttachmentField{ + { Title: "time", Value: "2001-01-01 01:10:00 +0000 UTC", Short: false, diff --git a/types/types.go b/types/types.go index 99b294cd90..4a5c8bd724 100644 --- a/types/types.go +++ b/types/types.go @@ -22,7 +22,7 @@ type Configuration struct { ListenPort int Debug bool Slack SlackOutputConfig - Mattermost mattermostOutputConfig + Mattermost MattermostOutputConfig Rocketchat rocketchatOutputConfig Teams teamsOutputConfig Datadog datadogOutputConfig @@ -67,7 +67,8 @@ type rocketchatOutputConfig struct { MessageFormatTemplate *template.Template } -type mattermostOutputConfig struct { +// MattermostOutputConfig represents parameters for Mattermost +type MattermostOutputConfig struct { WebhookURL string Footer string Icon string @@ -231,7 +232,7 @@ type Statistics struct { Dogstatsd *expvar.Map Webhook *expvar.Map AzureEventHub *expvar.Map - GCPPubSub *expvar.Map + GCPPubSub *expvar.Map } // PromStatistics is a struct to store prometheus metrics