Add Spyderbat output

README.md

@@ -39,6 +39,7 @@ It works as a single endpoint for as many as you want `Falco` instances :
 - [**DogStatsD**](https://docs.datadoghq.com/developers/dogstatsd/?tab=go) (for monitoring of `falcosidekick`)
 - [**Prometheus**](https://prometheus.io/) (for both events and monitoring of `falcosidekick`)
 - [**Wavefront**](https://www.wavefront.com)
+- [**Spyderbat**](https://www.spyderbat.com)
 
 ### Alerting
 
@@ -526,6 +527,14 @@ tekton:
   # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
   # mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
   # checkcert: true # check if ssl certificate of the output is valid (default: true)
+
+spyderbat:
+  # orguid: "" # Organization to send output to, if not empty, Spyderbat output is enabled
+  # apikey: "" # Spyderbat API key with access to the organization
+  # apiurl: "https://api.spyderbat.com" # Spyderbat API url (default: "https://api.spyderbat.com")
+  # source: "falcosidekick" # Spyderbat source ID, max 32 characters (default: "falcosidekick")
+  # sourcedescription: "" # Spyderbat source description and display name if not empty, max 256 characters
+  # minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
 ```
 
 Usage :
@@ -974,6 +983,12 @@ order is
 `emergency|alert|critical|error|warning|notice|informational|debug or "" (default)`
 - **TEKTON_CHECKCERT** : check if ssl certificate of the output is valid (default:
 `true`)
+- **SPYDERBAT_ORGUID**: Organization to send output to, if not empty, Spyderbat output is enabled
+- **SPYDERBAT_APIKEY**: Spyderbat API key with access to the organization
+- **SPYDERBAT_APIURL**: Spyderbat API url (default: "https://api.spyderbat.com")
+- **SPYDERBAT_SOURCE**: Spyderbat source ID, max 32 characters (default: "falcosidekick")
+- **SPYDERBAT_SOURCEDESCRIPTION**: Spyderbat source description and display name if not empty, max 256 characters
+- **SPYDERBAT_MINIMUMPRIORITY**: minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
 
 #### Slack/Rocketchat/Mattermost/Googlechat Message Formatting
 

config.go

@@ -367,6 +367,13 @@ func getConfig() *types.Configuration {
 	v.SetDefault("Tekton.MinimumPriority", "")
 	v.SetDefault("Tekton.CheckCert", true)
 
+	v.SetDefault("Spyderbat.OrgUID", "")
+	v.SetDefault("Spyderbat.APIKey", "")
+	v.SetDefault("Spyderbat.APIUrl", "https://api.spyderbat.com")
+	v.SetDefault("Spyderbat.Source", "falcosidekick")
+	v.SetDefault("Spyderbat.SourceDescription", "")
+	v.SetDefault("Spyderbat.MinimumPriority", "")
+
 	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
 	v.AutomaticEnv()
 	if *configFile != "" {
@@ -537,6 +544,7 @@ func getConfig() *types.Configuration {
 	c.Syslog.MinimumPriority = checkPriority(c.Syslog.MinimumPriority)
 	c.MQTT.MinimumPriority = checkPriority(c.MQTT.MinimumPriority)
 	c.PolicyReport.MinimumPriority = checkPriority(c.PolicyReport.MinimumPriority)
+	c.Spyderbat.MinimumPriority = checkPriority(c.Spyderbat.MinimumPriority)
 
 	c.Slack.MessageFormatTemplate = getMessageFormatTemplate("Slack", c.Slack.MessageFormat)
 	c.Rocketchat.MessageFormatTemplate = getMessageFormatTemplate("Rocketchat", c.Rocketchat.MessageFormat)

config_example.yaml

@@ -355,4 +355,12 @@ gotify:
 tekton:
   # eventListener: "" # EventListener address, if not empty, Tekton output is enabled
   # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
-  # checkcert: true # check if ssl certificate of the output is valid (default: true)
+  # checkcert: true # check if ssl certificate of the output is valid (default: true)
+
+spyderbat:
+  # orguid: "" # Organization to send output to, if not empty, Spyderbat output is enabled
+  # apikey: "" # Spyderbat API key with access to the organization
+  # apiurl: "https://api.spyderbat.com" # Spyderbat API url (default: "https://api.spyderbat.com")
+  # source: "falcosidekick" # Spyderbat source ID, max 32 characters (default: "falcosidekick")
+  # sourcedescription: "" # Spyderbat source description and display name if not empty, max 256 characters
+  # minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)

handlers.go

@@ -348,4 +348,8 @@ func forwardEvent(falcopayload types.FalcoPayload) {
 	if config.Gotify.HostPort != "" && (falcopayload.Priority >= types.Priority(config.Gotify.MinimumPriority) || falcopayload.Rule == testRule) {
 		go gotifyClient.GotifyPost(falcopayload)
 	}
+
+	if config.Spyderbat.OrgUID != "" && (falcopayload.Priority >= types.Priority(config.Spyderbat.MinimumPriority) || falcopayload.Rule == testRule) {
+		go spyderbatClient.SpyderbatPost(falcopayload)
+	}
 }

main.go

@@ -59,6 +59,7 @@ var (
 	mqttClient          *outputs.Client
 	zincsearchClient    *outputs.Client
 	gotifyClient        *outputs.Client
+	spyderbatClient     *outputs.Client
 
 	statsdClient, dogstatsdClient *statsd.Client
 	config                        *types.Configuration
@@ -605,6 +606,17 @@ func init() {
 		}
 	}
 
+	if config.Spyderbat.OrgUID != "" {
+		var err error
+		spyderbatClient, err = outputs.NewSpyderbatClient(config, stats, promStats, statsdClient, dogstatsdClient)
+		if err != nil {
+			config.Spyderbat.OrgUID = ""
+			log.Printf("[ERROR] : Spyderbat - %v\n", err)
+		} else {
+			outputs.EnabledOutputs = append(outputs.EnabledOutputs, "Spyderbat")
+		}
+	}
+
 	log.Printf("[INFO]  : Falco Sidekick version: %s\n", GetVersionInfo().GitVersion)
 	log.Printf("[INFO]  : Enabled Outputs : %s\n", outputs.EnabledOutputs)
 

outputs/client.go

@@ -2,6 +2,7 @@ package outputs
 
 import (
 	"bytes"
+	"compress/gzip"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
@@ -145,14 +146,28 @@ func (c *Client) Post(payload interface{}) error {
 	switch payload.(type) {
 	case influxdbPayload:
 		fmt.Fprintf(body, "%v", payload)
+		if c.Config.Debug {
+			log.Printf("[DEBUG] : %v payload : %v\n", c.OutputType, body)
+		}
+	case spyderbatPayload:
+		zipper := gzip.NewWriter(body)
+		if err := json.NewEncoder(zipper).Encode(payload); err != nil {
+			log.Printf("[ERROR] : %v - %s", c.OutputType, err)
+		}
+		zipper.Close()
+		if c.Config.Debug {
+			debugBody := new(bytes.Buffer)
+			if err := json.NewEncoder(debugBody).Encode(payload); err == nil {
+				log.Printf("[DEBUG] : %v payload : %v\n", c.OutputType, debugBody)
+			}
+		}
 	default:
 		if err := json.NewEncoder(body).Encode(payload); err != nil {
 			log.Printf("[ERROR] : %v - %s", c.OutputType, err)
 		}
-	}
-
-	if c.Config.Debug {
-		log.Printf("[DEBUG] : %v payload : %v\n", c.OutputType, body)
+		if c.Config.Debug {
+			log.Printf("[DEBUG] : %v payload : %v\n", c.OutputType, body)
+		}
 	}
 
 	customTransport := http.DefaultTransport.(*http.Transport).Clone()

outputs/spyderbat.go

@@ -0,0 +1,220 @@
+package outputs
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io/ioutil"
+	"log"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/DataDog/datadog-go/statsd"
+	"github.com/falcosecurity/falcosidekick/types"
+	"github.com/google/uuid"
+)
+
+func isSourcePresent(config *types.Configuration) (bool, error) {
+
+	client := &http.Client{}
+
+	source_url := path.Join(config.Spyderbat.APIUrl, "api/v1/org/"+config.Spyderbat.OrgUID+"/source/")
+	req, err := http.NewRequest("GET", source_url, new(bytes.Buffer))
+	if err != nil {
+		return false, err
+	}
+	req.Header.Add("Authorization", "Bearer "+config.Spyderbat.APIKey)
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return false, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return false, errors.New("HTTP error: " + resp.Status)
+	}
+	defer resp.Body.Close()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return false, err
+	}
+	var sources []map[string]interface{}
+	if err := json.Unmarshal(body, &sources); err != nil {
+		return false, err
+	}
+	uid := "falcosidekick_" + config.Spyderbat.OrgUID
+	for _, source := range sources {
+		if id, ok := source["uid"]; ok && id.(string) == uid {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+type SourceBody struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	UID         string `json:"uid"`
+}
+
+func makeSource(config *types.Configuration) error {
+
+	data := SourceBody{
+		Name:        config.Spyderbat.Source,
+		Description: config.Spyderbat.SourceDescription,
+		UID:         "falcosidekick_" + config.Spyderbat.OrgUID,
+	}
+	body := new(bytes.Buffer)
+	if err := json.NewEncoder(body).Encode(data); err != nil {
+		return err
+	}
+
+	client := &http.Client{}
+
+	source_url := path.Join(config.Spyderbat.APIUrl, "api/v1/org/"+config.Spyderbat.OrgUID+"/source/")
+	req, err := http.NewRequest("POST", source_url, body)
+	if err != nil {
+		return err
+	}
+	req.Header.Add("Authorization", "Bearer "+config.Spyderbat.APIKey)
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode != http.StatusOK {
+		if resp.StatusCode == http.StatusBadRequest {
+			if b, err := ioutil.ReadAll(resp.Body); err == nil {
+				return errors.New("Bad request: " + string(b))
+			}
+		}
+		return errors.New("HTTP error: " + resp.Status)
+	}
+	defer resp.Body.Close()
+
+	return nil
+}
+
+const Schema = "falco_alert::1.0.0"
+
+var PriorityMap = map[types.PriorityType]string{
+	types.Emergency:     "critical",
+	types.Alert:         "high",
+	types.Critical:      "critical",
+	types.Error:         "high",
+	types.Warning:       "medium",
+	types.Notice:        "low",
+	types.Informational: "info",
+	types.Debug:         "info",
+}
+
+type spyderbatPayload struct {
+	Schema        string   `json:"schema"`
+	ID            string   `json:"id"`
+	MonotonicTime int      `json:"monotonic_time"`
+	OrcTime       float64  `json:"orc_time"`
+	Time          float64  `json:"time"`
+	PID           int32    `json:"pid"`
+	Level         string   `json:"level"`
+	Message       []string `json:"msg"`
+	Arguments     string   `json:"args"`
+	Container     string   `json:"container"`
+}
+
+func newSpyderbatPayload(falcopayload types.FalcoPayload) (spyderbatPayload, error) {
+	nowTime := float64(time.Now().UnixNano()) / 1000000000
+	jsonTime, err := falcopayload.OutputFields["evt.time"].(json.Number).Int64()
+	if err != nil {
+		return spyderbatPayload{}, err
+	}
+	eventTime := float64(jsonTime / 1000000000.0)
+	pid, err := falcopayload.OutputFields["proc.pid"].(json.Number).Int64()
+	if err != nil {
+		return spyderbatPayload{}, err
+	}
+	level := PriorityMap[falcopayload.Priority]
+	args := strings.Split(falcopayload.Output, " ")
+	var message []string
+	if len(args) > 2 {
+		message = args[2:]
+	}
+	arguments := falcopayload.OutputFields["proc.cmdline"].(string)
+	container := falcopayload.OutputFields["container.id"].(string)
+
+	return spyderbatPayload{
+		Schema:        Schema,
+		ID:            uuid.NewString(),
+		MonotonicTime: time.Now().Nanosecond(),
+		OrcTime:       nowTime,
+		Time:          eventTime,
+		PID:           int32(pid),
+		Level:         level,
+		Message:       message,
+		Arguments:     arguments,
+		Container:     container,
+	}, nil
+}
+
+func NewSpyderbatClient(config *types.Configuration, stats *types.Statistics, promStats *types.PromStatistics,
+	statsdClient, dogstatsdClient *statsd.Client) (*Client, error) {
+
+	hasSource, err := isSourcePresent(config)
+	if err != nil {
+		log.Printf("[ERROR] : Spyderbat - %v\n", err.Error())
+		return nil, ErrClientCreation
+	}
+	if !hasSource {
+		if err := makeSource(config); err != nil {
+			if hasSource, err2 := isSourcePresent(config); err2 != nil || !hasSource {
+				log.Printf("[ERROR] : Spyderbat - %v\n", err.Error())
+				return nil, ErrClientCreation
+			}
+		}
+	}
+
+	source := "falcosidekick_" + config.Spyderbat.OrgUID
+	data_url := path.Join(config.Spyderbat.APIUrl, "api/v1/org/"+config.Spyderbat.OrgUID+"/source/"+source+"/data/sb-agent")
+	endpointURL, err := url.Parse(data_url)
+	if err != nil {
+		log.Printf("[ERROR] : Spyderbat - %v\n", err.Error())
+		return nil, ErrClientCreation
+	}
+	return &Client{
+		OutputType:       "Spyderbat",
+		EndpointURL:      endpointURL,
+		MutualTLSEnabled: false,
+		CheckCert:        true,
+		ContentType:      "application/ndjson",
+		Config:           config,
+		Stats:            stats,
+		PromStats:        promStats,
+		StatsdClient:     statsdClient,
+		DogstatsdClient:  dogstatsdClient,
+	}, nil
+}
+
+func (c *Client) SpyderbatPost(falcopayload types.FalcoPayload) {
+	c.Stats.Spyderbat.Add(Total, 1)
+
+	c.AddHeader("Authorization", "Bearer "+c.Config.Spyderbat.APIKey)
+	c.AddHeader("Content-Encoding", "gzip")
+
+	payload, err := newSpyderbatPayload(falcopayload)
+	if err == nil {
+		err = c.Post(payload)
+	}
+	if err != nil {
+		go c.CountMetric(Outputs, 1, []string{"output:spyderbat", "status:error"})
+		c.Stats.Spyderbat.Add(Error, 1)
+		c.PromStats.Outputs.With(map[string]string{"destination": "spyderbat", "status": Error}).Inc()
+		log.Printf("[ERROR] : Spyderbat - %v\n", err.Error())
+		return
+	}
+
+	go c.CountMetric(Outputs, 1, []string{"output:spyderbat", "status:ok"})
+	c.Stats.Spyderbat.Add(OK, 1)
+	c.PromStats.Outputs.With(map[string]string{"destination": "spyderbat", "status": OK}).Inc()
+}

stats.go

@@ -68,6 +68,7 @@ func getInitStats() *types.Statistics {
 		YandexDataStreams: getOutputNewMap("yandexdatastreams"),
 		Syslog:            getOutputNewMap("syslog"),
 		MQTT:              getOutputNewMap("mqtt"),
+		Spyderbat:         getOutputNewMap("spyderbat"),
 		PolicyReport:      getOutputNewMap("policyreport"),
 		NodeRed:           getOutputNewMap("nodered"),
 		Zincsearch:        getOutputNewMap("zincsearch"),