diff --git a/pkg/acquisition/modules/appsec/appsec_runner.go b/pkg/acquisition/modules/appsec/appsec_runner.go index 0887c725f..c778eb9b9 100644 --- a/pkg/acquisition/modules/appsec/appsec_runner.go +++ b/pkg/acquisition/modules/appsec/appsec_runner.go @@ -23,6 +23,7 @@ type AppsecRunner struct { AppsecRuntime *appsec.AppsecRuntimeConfig //this holds the actual appsec runtime config, rules, remediations, hooks etc. AppsecInbandEngine coraza.WAF AppsecOutbandEngine coraza.WAF + Labels map[string]string logger *log.Entry } @@ -205,7 +206,7 @@ func (r *AppsecRunner) ProcessOutOfBandRules(request *appsec.ParsedRequest) erro func (r *AppsecRunner) handleInBandInterrupt(request *appsec.ParsedRequest) { //create the associated event for crowdsec itself - evt, err := EventFromRequest(request) + evt, err := EventFromRequest(request, r.Labels) if err != nil { //let's not interrupt the pipeline for this r.logger.Errorf("unable to create event from request : %s", err) @@ -253,7 +254,7 @@ func (r *AppsecRunner) handleInBandInterrupt(request *appsec.ParsedRequest) { } func (r *AppsecRunner) handleOutBandInterrupt(request *appsec.ParsedRequest) { - evt, err := EventFromRequest(request) + evt, err := EventFromRequest(request, r.Labels) if err != nil { //let's not interrupt the pipeline for this r.logger.Errorf("unable to create event from request : %s", err) diff --git a/pkg/acquisition/modules/appsec/utils.go b/pkg/acquisition/modules/appsec/utils.go index 377626539..2dcddc8b7 100644 --- a/pkg/acquisition/modules/appsec/utils.go +++ b/pkg/acquisition/modules/appsec/utils.go @@ -68,7 +68,7 @@ func AppsecEventGeneration(inEvt types.Event) (*types.Event, error) { return &evt, nil } -func EventFromRequest(r *appsec.ParsedRequest) (types.Event, error) { +func EventFromRequest(r *appsec.ParsedRequest, labels map[string]string) (types.Event, error) { evt := types.Event{} //we might want to change this based on in-band vs out-of-band ? evt.Type = types.LOG @@ -91,7 +91,7 @@ func EventFromRequest(r *appsec.ParsedRequest) (types.Event, error) { evt.Line = types.Line{ Time: time.Now(), //should we add some info like listen addr/port/path ? - Labels: map[string]string{"type": "crowdsec-appsec"}, //FIXME: use the labels from the acquis + Labels: labels, Process: true, Module: "appsec", Src: "appsec",