Enhancement request for Falco policy report to include detailed metadata for policy reporter

[gsingh737]

Motivation

Enhance Falco Policy Report Based on Trivy Adapter's Report

I have been reviewing policy reports generated by Trivy and Falco and noticed that the user interface for Trivy's policy reports provides a more detailed and informative view compared to Falco's policy report in policy reporter UI. I would like to suggest an enhancement to the Falco policy report to include additional metadata for each policy result.

Feature

Current Trivy Policy Report:

The Trivy policy report UI presents policy results in a row-wise view that includes the following information for each failing policy check:

• Namespace: The Kubernetes namespace where the resource is located.
• Kind: The kind of the Kubernetes resource (e.g., ReplicaSet, Pod).
• Name: The name of the resource.
• Policy: The policy that has been applied.
• Severity: The severity level of the policy finding.
• Status: The current status of the policy check (e.g., fail).
  This presentation format is highly beneficial as it allows users to quickly identify where a particular policy violation has occurred and understand the context of the failure.

Current Falco Policy Report:

In contrast, the Falco policy report UI currently displays the following information:

Policy: The policy that has been applied.
Severity: The severity level of the policy finding.
Status: The current status of the policy check (e.g., fail).

While the Falco UI does highlight the severity and status, it lacks the contextual metadata such as Namespace, Kind, and Name, making it less informative at a glance compared to Trivy's Report.

Suggested Enhancements:

To improve the Falco policy report, I recommend making metadata available for PolicyReporter to show columns for Namespace, Kind, and Name to the report view. This would align Falco's policy report with Trivy's in terms of the level of detail provided and improve the overall user experience when reviewing policy findings.

Providing this additional context would be especially useful in environments with numerous resources, as it would significantly ease the process of pinpointing and addressing policy violations.

Alternatives
N/A

Additional context

• Screenshots attached

[Issif]

I know this output requires some updates, it has been created a while ago and the policy report api were not really stable. I'll take a look asap.

Which tool are you using to have the overview?

[jemag]

The tool for overview is https://kyverno.github.io/policy-reporter/

[gsingh737]

I know this output requires some updates, it has been created a while ago and the policy report api were not really stable. I'll take a look asap.

Which tool are you using to have the overview?

@Issif @jemag as mentioned above.

[Issif]

Ok, FYI, the creator of the policy reporter, @fjogeleit, is also a maintainer of falcosidekick and falcosidekick-ui. We had in mind to create a plugin for falco in the reporter, cleaning up the creation of the reports is the first step.

[fjogeleit]

Let me know if I can support.

[Issif]

Let me know if I can support.

I'll work on that part asap, I'll need your for the review please

[Issif]

Will be fixed in the upcoming 2.29