FalcoSecurity.Plugin.Sdk

Falcosecurity.plugin.sdk

Plugin Falco tidak resmi SDK untuk .NET, ditenagai oleh ekspor asli Dnne dan manajemen memori asli Net6+.

Wiki

Untuk contoh lengkap dan informasi tambahan tentang cara kerjanya, lihat wiki!

Paket Nuget

		desc	Changelog
Falcosecurity.plugin.sdk		Jenis SDK Plugin Inti	Changelog.md
Falcosecurity.plugin.sdk.generators		Sumber Generator untuk Ekspor Asli	Changelog.md
Falcosecurity.plugin.sdk.template		Template Proyek dotnet new falcoplugin

Plugin boneka menyelinap-seas

 [ FalcoPlugin (
    Id = 999 ,
    Name = "dummy_plugin" ,
    Description = "A dummy plugin" ,
    Contacts = "mvenditto" ,
    RequiredApiVersion = "2.0.0" ,
    Version = "1.0.0" ) ]
public class Plugin : PluginBase , IEventSource , IFieldExtractor {
    public string EventSourceName => "dummy_source" ;

    public IEnumerable < string > EventSourcesToExtract 
        => Enumerable . Empty < string > ( ) ; // only consume ourselves event-source

    public IEnumerable < OpenParam > OpenParameters => 
        => Enumerable . Empty < string > ( ) ; // no specific open-params

    public IEnumerable < ExtractionField > Fields => new List < ExtractionField > {
        new ( type : "uint64" ,
            name : "dummy.counter" ,
            display : "Counter value" ,
            desc : "Current value of the internal counter" )
    } ;

    public IEventSourceInstance Open ( IEnumerable < OpenParam > ? openParams ) {
        return new CounterInstance ( ) ;
    }
    
    public void Close ( IEventSourceInstance instance ) {
        instance . Dispose ( ) ;
    }

    public void Extract ( IExtractionRequest extraction , IEventReader evt ) {
        var counter = BitConverter . ToInt32 ( evt . Data ) ;
        extraction . SetValue ( ( ulong ) counter ) ;
    }
}

public class CounterInstance : PullEventSourceInstance {
    public int Counter { get ; set ; }

    public CounterInstance ( ) : base ( batchSize : 10 , eventSize : 8 ) {
        Counter = 1 ;
    }

    protected override void PullEvent ( EventSourceInstanceContext ctx , IEventWriter evt ) {
        var unixNano = ( ulong ) DateTimeOffset . Now . ToUnixTimeSeconds ( ) * 1000000000 ;

        evt . Write ( BitConverter . GetBytes ( Counter ) ) ;

        evt . SetTimestamp ( unixNano ) ;

        if ( Counter >= 50 ) {
            ctx . IsEof = true ;
        }

        Counter += 1 ;
    }
} 

- rule : Dummy counter rule
  desc : Dummy counter equals 42
  condition : (dummy.counter=42)
  output : dummy.counter is 42 value=%dummy.counter
  priority : DEBUG
  source : dummy_source
  tags : [dummy]

 admin@someplace: ~ $ tree/usr/share/falco
/usr/share/falco/
└── plugin
    ├── libjson.so
    ├── libk8saudit.so
    └── Dummy_plugin
        ├── plugin_native.so
        ├── falcosecurity.plugin.sdk.dll
        ├── falcosecurity.plugin.sdk.dummyplugin.dll
        ├── microsoft.Extensions.ObjectPool.dll
        └── falcosecurity.plugin.sdk.dummyplugin.runtimeconfig.json
        
admin@someplace: ~ $ falco-Dummy-source dummy_source
Sab 5 Nov 18:08:52 2022: Falco Versi: 0.33.0 (x86_64)
[... terpotong ...]
SAT 5 Nov 18:08:52 2022: Sumber Acara yang Diaktifkan: Dummy_source
Sab 5 Nov 18:08:52 2022: Sumber acara membuka 'Dummy_source'
Sab 5 Nov 18:08:52 2022: Pembukaan penangkapan dengan plugin 'Dummy_plugin'
Sab 5 Nov 18:08:52 2022: Sumber acara penutupan 'Dummy_source'
18: 08: 52.000000000: debug dummy.counter adalah 42 nilai = 42
Peristiwa terdeteksi: 1
Aturan diperhitungkan dengan tingkat keparahan:
   Debug: 1
Aturan yang dipicu dengan nama aturan:
   Aturan Counter Dummy: 1

admin@someplace: ~ $ █

Catatan

SDK ini tidak resmi dan tidak terkait atau didukung oleh Sysdig dan Falcosecurity/Falco