fix stats for Mattermost and add tests

Signed-off-by: Carlos Panato <[email protected]>
falcosecurity · Nov 15, 2020 · 7fe3518 · 7fe3518
1 parent bdd56c8
commit 7fe3518
Show file tree

Hide file tree

Showing 5 changed files with 83 additions and 13 deletions.
diff --git a/outputs/mattermost.go b/outputs/mattermost.go
@@ -44,6 +44,11 @@ func newMattermostPayload(falcopayload types.FalcoPayload, config *types.Configu
 		field.Short = false
 		field.Value = falcopayload.Time.String()
 		fields = append(fields, field)
+
+		attachment.Footer = "https://github.com/falcosecurity/falcosidekick"
+		if config.Slack.Footer != "" {
+			attachment.Footer = config.Slack.Footer
+		}
 	}
 
 	attachment.Fallback = falcopayload.Output
@@ -93,7 +98,8 @@ func newMattermostPayload(falcopayload types.FalcoPayload, config *types.Configu
 		Text:        messageText,
 		Username:    "Falcosidekick",
 		IconURL:     iconURL,
-		Attachments: attachments}
+		Attachments: attachments,
+	}
 
 	return s
 }
@@ -102,11 +108,11 @@ func newMattermostPayload(falcopayload types.FalcoPayload, config *types.Configu
 func (c *Client) MattermostPost(falcopayload types.FalcoPayload) {
 	err := c.Post(newMattermostPayload(falcopayload, c.Config))
 	if err != nil {
-		c.Stats.Rocketchat.Add("error", 1)
+		c.Stats.Mattermost.Add("error", 1)
 		c.PromStats.Outputs.With(map[string]string{"destination": "mattermost", "status": "error"}).Inc()
 	} else {
-		c.Stats.Rocketchat.Add("ok", 1)
+		c.Stats.Mattermost.Add("ok", 1)
 		c.PromStats.Outputs.With(map[string]string{"destination": "mattermost", "status": "ok"}).Inc()
 	}
-	c.Stats.Rocketchat.Add("total", 1)
+	c.Stats.Mattermost.Add("total", 1)
 }
diff --git a/outputs/mattermost_test.go b/outputs/mattermost_test.go
@@ -0,0 +1,63 @@
+package outputs
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+	"text/template"
+
+	"github.com/falcosecurity/falcosidekick/types"
+)
+
+func TestMattermostPayload(t *testing.T) {
+	expectedOutput := slackPayload{
+		Text:     "Rule: Test rule Priority: Debug",
+		Username: "Falcosidekick",
+		IconURL:  "https://raw.githubusercontent.com/falcosecurity/falcosidekick/master/imgs/falcosidekick.png",
+		Attachments: []slackAttachment{
+			{
+				Fallback: "This is a test from falcosidekick",
+				Color:    "#ccfff2",
+				Text:     "This is a test from falcosidekick",
+				Footer:   "https://github.com/falcosecurity/falcosidekick",
+				Fields: []slackAttachmentField{
+					{
+						Title: "proc.name",
+						Value: "falcosidekick",
+						Short: true,
+					},
+					{
+						Title: "rule",
+						Value: "Test rule",
+						Short: true,
+					},
+					{
+						Title: "priority",
+						Value: "Debug",
+						Short: true,
+					},
+					{
+						Title: "time",
+						Value: "2001-01-01 01:10:00 +0000 UTC",
+						Short: false,
+					},
+				},
+			},
+		},
+	}
+
+	var f types.FalcoPayload
+	json.Unmarshal([]byte(falcoTestInput), &f)
+	config := &types.Configuration{
+		Mattermost: types.MattermostOutputConfig{
+			Username: "Falcosidekick",
+			Icon:     "https://raw.githubusercontent.com/falcosecurity/falcosidekick/master/imgs/falcosidekick.png",
+		},
+	}
+
+	config.Mattermost.MessageFormatTemplate, _ = template.New("").Parse("Rule: {{ .Rule }} Priority: {{ .Priority }}")
+	output := newMattermostPayload(f, config)
+	if !reflect.DeepEqual(output, expectedOutput) {
+		t.Fatalf("\nexpected payload: \n%#v\ngot: \n%#v\n", expectedOutput, output)
+	}
+}
diff --git a/outputs/slack.go b/outputs/slack.go
@@ -15,7 +15,7 @@ type slackAttachmentField struct {
 	Short bool   `json:"short"`
 }
 
-//Attachment
+// Attachment
 type slackAttachment struct {
 	Fallback   string                 `json:"fallback"`
 	Color      string                 `json:"color"`

diff --git a/outputs/slack_test.go b/outputs/slack_test.go
@@ -15,28 +15,28 @@ func TestNewSlackPayload(t *testing.T) {
 		Username: "Falcosidekick",
 		IconURL:  "https://raw.githubusercontent.com/falcosecurity/falcosidekick/master/imgs/falcosidekick.png",
 		Attachments: []slackAttachment{
-			slackAttachment{
+			{
 				Fallback: "This is a test from falcosidekick",
 				Color:    "#ccfff2",
 				Text:     "This is a test from falcosidekick",
 				Footer:   "https://github.com/falcosecurity/falcosidekick",
 				Fields: []slackAttachmentField{
-					slackAttachmentField{
+					{
 						Title: "proc.name",
 						Value: "falcosidekick",
 						Short: true,
 					},
-					slackAttachmentField{
+					{
 						Title: "rule",
 						Value: "Test rule",
 						Short: true,
 					},
-					slackAttachmentField{
+					{
 						Title: "priority",
 						Value: "Debug",
 						Short: true,
 					},
-					slackAttachmentField{
+					{
 						Title: "time",
 						Value: "2001-01-01 01:10:00 +0000 UTC",
 						Short: false,

diff --git a/types/types.go b/types/types.go
@@ -22,7 +22,7 @@ type Configuration struct {
 	ListenPort    int
 	Debug         bool
 	Slack         SlackOutputConfig
-	Mattermost    mattermostOutputConfig
+	Mattermost    MattermostOutputConfig
 	Rocketchat    rocketchatOutputConfig
 	Teams         teamsOutputConfig
 	Datadog       datadogOutputConfig
@@ -67,7 +67,8 @@ type rocketchatOutputConfig struct {
 	MessageFormatTemplate *template.Template
 }
 
-type mattermostOutputConfig struct {
+// MattermostOutputConfig represents parameters for Mattermost
+type MattermostOutputConfig struct {
 	WebhookURL            string
 	Footer                string
 	Icon                  string
@@ -231,7 +232,7 @@ type Statistics struct {
 	Dogstatsd     *expvar.Map
 	Webhook       *expvar.Map
 	AzureEventHub *expvar.Map
-  	GCPPubSub     *expvar.Map
+	GCPPubSub     *expvar.Map
 }
 
 // PromStatistics is a struct to store prometheus metrics