Enhancement(Feeder) Change TAGS from string to string array (#961)

[vishnusomank]

Purpose of PR?:

To show/send an array of Tags to output, making it easy to handle in different SIEM integration and other representation.

Updates in:

• feeder/feeder.go to include new tags field ATags
• protobuf to inlcude ATags array
• feeder/policyMatcher.go to write tags array to new field ATags
• types/types.go to include ATags array in the Alert structure

Fixes #961

Does this PR introduce a breaking change? NO

Checklist:

• Bug fix. Fixes #961
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• PR Title follows the convention of <type>(<scope>): <subject>
• Commit has unit tests
• Commit has integration tests

Signed-off-by: vishnusomank vishnu@accuknox.com

Telemetry data:

➜  ~ cat /tmp/kubearmor.log | grep wordpress | grep -i "permission denied" | jq .
{
  "timestamp": 1667542698,
  "updatedTime": "2022-11-04T06:18:18.230978Z",
  "hostName": "zero-knox",
  "namespaceName": "wordpress-mysql",
  "podName": "wordpress-765f89bf9f-mglrn",
  "labels": "app=wordpress",
  "containerID": "a2eaef4651d1917ee9be3e54b1d3c2639ae4582ce344df46c811d970696675f6",
  "containerName": "wordpress",
  "containerImage": "wordpress:4.8-apache@sha256:6216f64ab88fc51d311e38c7f69ca3f9aaba621492b4f1fa93ddf63093768845",
  "hostPPid": 83228,
  "hostPid": 83469,
  "ppid": 201,
  "pid": 208,
  "uid": 0,
  "parentProcessName": "/bin/bash",
  "processName": "/usr/bin/apt",
  "enforcer": "AppArmor",
  "policyName": "wordpress-wordpress-4-8-apache-least-functionality-execute-package-management-process-in-container",
  "severity": "5",
  "tags": "SI-4,NIST,NIST_800-53_CM-7(4),NIST_800-53_SI-4,process",
  "atags": [
    "SI-4",
    "NIST",
    "NIST_800-53_CM-7(4)",
    "NIST_800-53_SI-4",
    "process"
  ],
  "message": "Alert! Execution of package management process inside container is denied",
  "type": "MatchedPolicy",
  "source": "/bin/bash",
  "operation": "Process",
  "resource": "/usr/bin/apt",
  "data": "syscall=SYS_EXECVE",
  "action": "Block",
  "result": "Permission denied"
}

Screenshots:

[codecov-commenter]

Codecov Report

Merging #965 (6d25bd4) into main (7fdfe6d) will decrease coverage by 0.26%.
The diff coverage is 27.27%.

@@            Coverage Diff             @@
##             main     #965      +/-   ##
==========================================
- Coverage   39.35%   39.09%   -0.27%     
==========================================
  Files          31       31              
  Lines        9843     9854      +11     
==========================================
- Hits         3874     3852      -22     
- Misses       5461     5494      +33     
  Partials      508      508              

Impacted Files	Coverage Δ
KubeArmor/feeder/feeder.go	52.37% <0.00%> (-0.12%)	⬇️
KubeArmor/feeder/policyMatcher.go	41.50% <30.00%> (-0.10%)	⬇️
KubeArmor/core/containerdHandler.go	57.67% <0.00%> (-11.24%)	⬇️
KubeArmor/monitor/logUpdate.go	68.80% <0.00%> (-0.84%)	⬇️
KubeArmor/core/dockerHandler.go	47.47% <0.00%> (+2.69%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[nyrahul]

LGTM 👍