beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

if 'include capi' is false, only exclude capi alerts instead of assuming they necessarily have attached decisions (#2435)

Browse source
This commit is contained in:
Thibault "bui" Koechlin 2023-09-12 11:19:36 +02:00 committed by GitHub
parent 6b9e065764
commit 0040569fa9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
pkg/database/alerts.go
View file

@ -862,11 +862,7 @@ func AlertPredicatesFromFilter(filter map[string][]string) ([]predicate.Alert, e
predicates = append(predicates, alert.HasDecisionsWith(decision.OriginEQ(value[0])))
case "include_capi": //allows to exclude one or more specific origins
if value[0] == "false" {
predicates = append(predicates, alert.HasDecisionsWith(
decision.Or(decision.OriginEQ(types.CrowdSecOrigin),
decision.OriginEQ(types.CscliOrigin),
decision.OriginEQ(types.ConsoleOrigin),
decision.OriginEQ(types.CscliImportOrigin))))
predicates = append(predicates, alert.Not(alert.HasDecisionsWith(decision.OriginEQ(types.CAPIOrigin))))
} else if value[0] != "true" {
log.Errorf("Invalid bool '%s' for include_capi", value[0])
}