Commit 9c859945 authored by qiuqunfeng's avatar qiuqunfeng
Browse files

Add RuleKeys to WAF detection event in LogConsumerService

This update enhances the genWafDetectionEvent function by including RuleKeys with version, name, and category details for improved event context. Additionally, an informational log statement has been added to track WAF events during processing.
parent 40dc9fd0
...@@ -152,7 +152,13 @@ func (s *LogConsumerService) genWafDetectionEvent(wafDetectionMessage model.WafD ...@@ -152,7 +152,13 @@ func (s *LogConsumerService) genWafDetectionEvent(wafDetectionMessage model.WafD
ID: id.Str(), ID: id.Str(),
Type: "waf_detection", Type: "waf_detection",
Description: "waf detection", Description: "waf detection",
RuleKeys: []model.RuleKey{}, RuleKeys: []model.RuleKey{
{
Version1: 0,
Name: attackedLog.RuleName,
Category: "WAF",
},
},
Scopes: map[string][]model.Scope{ Scopes: map[string][]model.Scope{
"cluster": { "cluster": {
{ {
...@@ -257,6 +263,7 @@ func (s *LogConsumerService) Handle(ctx context.Context, message []byte) error { ...@@ -257,6 +263,7 @@ func (s *LogConsumerService) Handle(ctx context.Context, message []byte) error {
log.Err(err).Str("message.Value", string(message)).Msg("gen waf detection event fails") log.Err(err).Str("message.Value", string(message)).Msg("gen waf detection event fails")
continue continue
} }
log.Info().Msgf("waf event: %+v", event)
bulkIndexEvent := es.NewBulkIndexRequest().Index(ESIndexEvents) bulkIndexEvent := es.NewBulkIndexRequest().Index(ESIndexEvents)
bulkableRequests = append(bulkableRequests, bulkIndexEvent.Id(event.ID).Doc(event)) bulkableRequests = append(bulkableRequests, bulkIndexEvent.Id(event.ID).Doc(event))
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment