Motivation
As of now the plugin reads the given filepath (file or files in directory), parses it to create the alerts and stops there.
To have this more aligned with the functionality of Falco and make the filepath option of the plugin more viable I would like to request the k8saudit plugin to watch given file(s) and parse newly written k8saudit lines to generate alerts.
This would allow us to use both Falco's syscall parsing, k8saudit parsing, without the need to change API-server configuration/add another webhook in the cluster.
Feature
- Let k8saudit plugin tail/watch a given file for new entries and parse those new lines when k8saudit logs events.
- Let plugin check if current watched/tailed file is rotated (example: close file and reopen file with the name given in filepath if no new event has been generated for X-amount of time)
Additional context
This feature should probably be built in at the source.go file of the k8sauditplugin
Motivation
As of now the plugin reads the given filepath (file or files in directory), parses it to create the alerts and stops there.
To have this more aligned with the functionality of Falco and make the filepath option of the plugin more viable I would like to request the k8saudit plugin to watch given file(s) and parse newly written k8saudit lines to generate alerts.
This would allow us to use both Falco's syscall parsing, k8saudit parsing, without the need to change API-server configuration/add another webhook in the cluster.
Feature
Additional context
This feature should probably be built in at the source.go file of the k8sauditplugin