Falco安全与鹰伴在码头构图中的应用

Question

我正在试图运行falco和falcosikick容器中的码头组合。

version: "3.9"
services:
  falco:
    image: falcosecurity/falco:latest
    privileged: true
    volumes:
      - /var/run/docker.sock:/host/var/run/docker.sock
      - /dev:/host/dev
      - /proc:/host/proc:ro
      - /boot:/host/boot:ro
      - /lib/modules:/host/lib/modules:ro
      - /usr:/host/usr:ro
      - /etc:/host/etc:ro
      - /var/log/falco_events.log:/var/log/falco_events.log
      - /home/ubuntu/falco.yaml:/etc/falco/falco.yaml
      - /home/ubuntu/falco_rules.yaml:/etc/falco/falco_rules.yaml
      - /home/ubuntu/falco_rules.local.yaml:/etc/falco/rules.d/custom-rules.yaml
  falcosidekick:
    image: falcosecurity/falcosidekick
    ports:
      - 2801:2801

我将falco.yaml配置为将http_output发送到falcosidekick容器：

http_output:
  enabled: true
  url: "http://falcosidekick:2801"

然后，我在falco.yaml中添加了松弛配置

debug: false 
customfields: # custom fields are added to falco events
  Akey: "AValue"
  Bkey: "BValue"
  Ckey: "CValue"
mutualtlsfilespath: "/etc/certs" # folder which will used to store client.crt, client.key and ca.crt files for mutual tls (default: "/etc/certs")

slack:
  webhookurl: "https://hooks.slack.com/services/XXX/XXXX/XXXXX"
  #footer: "" # Slack footer
  #icon: "" # Slack icon (avatar)
  #username: "" # Slack username (default: Falcosidekick)
  outputformat: "all" # all (default), text, fields
  minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
  messageformat: 'Alert : rule *{{ .Rule }}* triggered by user *{{ index .OutputFields "user.name" }}*' # a Go template to format Slack Text above Attachment, displayed in addition to the output from `SLACK_OUTPUTFORMAT`, see [Slack Message Formatting](#slack-message-formatting) in the README for details. If empty, no Text is displayed before Attachment.

通过这种配置，我从来没有在我的空闲通道上发出警报。怎么了？

谢谢

Answer 1

法尔科和猎鹰助手的配置必须在两个不同的文件中，这意味着你也需要挂载一个卷在猎鹰的容器中。如果您愿意，也可以使用环境变量(但这意味着您的空闲web钩子url将以明文形式出现在您的docker-组合文件中)。

version: "3.9"
services:
  falco:
    image: falcosecurity/falco:latest
    privileged: true
    volumes:
      - /var/run/docker.sock:/host/var/run/docker.sock
      - /dev:/host/dev
      - /proc:/host/proc:ro
      - /boot:/host/boot:ro
      - /lib/modules:/host/lib/modules:ro
      - /usr:/host/usr:ro
      - /etc:/host/etc:ro
      - /var/log/falco_events.log:/var/log/falco_events.log
      - /home/ubuntu/falco.yaml:/etc/falco/falco.yaml
      - /home/ubuntu/falco_rules.yaml:/etc/falco/falco_rules.yaml
      - /home/ubuntu/falco_rules.local.yaml:/etc/falco/rules.d/custom-rules.yaml
  falcosidekick:
    image: falcosecurity/falcosidekick
    ports:
      - 2801:2801
    volumes:
      - /home/ubuntu/falcosidekick.yaml:/etc/falco/falcosidekick.yaml
    command: "-c /etc/falco/falcosidekick.yaml"