Falco Rule Integration Test

[natchaphon-r]

Motivation

The accuracy of anomaly detection with Falco heavily depends on Falco rules. Providing an integration test framework or example to validate a Falco alert given an event generated by this project would enable automated Falco rule testing and give users higher confidence when updating new Falco version, deploying new rules, reusing rules in a different OS/kernel.

Feature

User can use the framework to write an integration test that utilizes event-generator to trigger Falco rule alerts, captures these alerts using Falco client-go, and validates alert strings (ex. containerName should not be empty, alert text should contain a certain string, etc.)

Alternatives

Manual testing with event-generator

[leogr]

I was already thinking about something similar, and I really like your proposal.
Using the gRPC connection could be useful to perform a test in a live Falco installation.

Thank you!
👍

[krisctl]

/assign

[leogr]

Hey @Krishan-Sharma and @natchaphon-r

After thinking a little on this topic, I would like to create a simple interface that allows other components to hooks into the runner workflow, that would allow implementing the "tester" in its package (ie. pkg/tester) and keep the two things decoupled.
As soon as I can I will push my experiments in a separate branch.

Moreover, be also aware that we're changing the way gRPC is communicating, that was needed to solve some issues we encountered the current gRPC implementation. This improvement should be released on the next Falco version.

That being said, please don't stop your contribution. We can cooperate on this, feel free to contact me on Slack, open PRs and so on. I'm happy to help :)

Thanks.

[leogr]

Update:

I experimented a bit in this branch and I have found some issues that should be solved shortly.

If someone is working on this pls contact me on Slack.

[natchaphon-r]

Hey @leogr , I'll sync up with you on Slack.