Missing "Priority" in alertmanager notifications

[mac-chaffee]

Motivation

When Falco sends alertmanager an alert, it looks like it doesn't include the "priority" field:

That makes it difficult to route alerts to the right "receivers". For example, I'd like to send "warning" alerts to one notification system and "emergency|alert|critical|error" alerts to a different notification system that is more closely monitored.

Feature

Include the "priority" field in the alertmanager payload as a "label".

Alternatives

Other alerts like the ones that ship with kube-prometheus-stack use a label called "severity" instead of "priority". That could be an option, but "priority" is probably better for consistency with the rest of falco.

[Issif]

Hello, you're right, I missed that, sorry. See alertmanager.go#L77.

It's not a big deal to add this, feel free to propose a PR for fixing it if you feel confident enough. Anyway, I'm planning to work soon on all outputs for adding tags (which are now included in events since falco 0.30.0), I may fix that too.

Thanks for the issue, it will help everybody.

[mac-chaffee]

Thanks @Issif ! I can try my hand at contributing. Fingers crossed my laptop's go toolchain is still working correctly!