beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

make Event viabl

Browse source
This commit is contained in:
bui 2023-10-27 11:09:38 +02:00
parent 31a3b8a4ef
commit bb59d9852a
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
pkg/acquisition/modules/waap/utils.go
View file

@ -88,11 +88,11 @@ func EventFromRequest(r waf.ParsedRequest) (types.Event, error) {
evt.Line = types.Line{ evt.Line = types.Line{
Time: time.Now(), Time: time.Now(),
//should we add some info like listen addr/port/path ? //should we add some info like listen addr/port/path ?
Labels: map[string]string{"type": "coraza-waf"}, Labels: map[string]string{"type": "coraza-waap"},
Process: true, Process: true,
Module: "waf", Module: "waap",
Src: "waf", Src: "waap",
Raw: "dummy-waf-data", //we discard empty Line.Raw items :) Raw: "dummy-waap-data", //we discard empty Line.Raw items :)
} }
evt.Waap = types.WaapEvent{} evt.Waap = types.WaapEvent{}
@ -144,6 +144,9 @@ func (r *WaapRunner) AccumulateTxToEvent(evt *types.Event, req waf.ParsedRequest
if evt.Meta == nil { if evt.Meta == nil {
evt.Meta = map[string]string{} evt.Meta = map[string]string{}
} }
if evt.Parsed == nil {
evt.Parsed = map[string]string{}
}
if req.IsInBand { if req.IsInBand {
evt.Meta["waap_interrupted"] = "true" evt.Meta["waap_interrupted"] = "true"
evt.Meta["waap_action"] = req.Tx.Interruption().Action evt.Meta["waap_action"] = req.Tx.Interruption().Action