crowdsecurity
Improvement - Pass evt.Parsed to the postoverflow event
What would you like to be added?
Pass the evt.Passed variable to the postoverflow event.
Why is this needed?
I think it can be very useful if the evt.Parsed variable is passed to the postoverflow event. This would make it possible to e.g. whitelist individual scenarios based on conditions of evt.Parsed. Currently I don't see any other way to whitelist for example http-crawl-non_statics only on a certain traefik route.
Hello,
currently, only the Meta dicts of events make it to the overflow object (see https://pkg.go.dev/github.com/crowdsecurity/[email protected]/pkg/models#Alert).
Short term, the simplest way is to ensure relevant info is in the Meta dict, but this change could sense in the future.
Hey 👋🏻
We have evaluated this and decided that we would not do this. If you would like to do this then you can create a s02-enrich parser to add the parsed variables to the meta key.
