Commit 9c859945 authored by qiuqunfeng's avatar qiuqunfeng
Browse files

Add RuleKeys to WAF detection event in LogConsumerService

This update enhances the genWafDetectionEvent function by including RuleKeys with version, name, and category details for improved event context. Additionally, an informational log statement has been added to track WAF events during processing.
parent 40dc9fd0
......@@ -152,7 +152,13 @@ func (s *LogConsumerService) genWafDetectionEvent(wafDetectionMessage model.WafD
ID: id.Str(),
Type: "waf_detection",
Description: "waf detection",
RuleKeys: []model.RuleKey{},
RuleKeys: []model.RuleKey{
{
Version1: 0,
Name: attackedLog.RuleName,
Category: "WAF",
},
},
Scopes: map[string][]model.Scope{
"cluster": {
{
......@@ -257,6 +263,7 @@ func (s *LogConsumerService) Handle(ctx context.Context, message []byte) error {
log.Err(err).Str("message.Value", string(message)).Msg("gen waf detection event fails")
continue
}
log.Info().Msgf("waf event: %+v", event)
bulkIndexEvent := es.NewBulkIndexRequest().Index(ESIndexEvents)
bulkableRequests = append(bulkableRequests, bulkIndexEvent.Id(event.ID).Doc(event))
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment