Falcosidekick-ui

Description

A simple WebUI for displaying latest events from Falco. It works as output for Falcosidekick.

Requirements

Events are stored in a Redis server with Redisearch module (> v2).

Usage

Options

  -a string
        Listen Address (default "0.0.0.0")
  -d    Enable dark mode as default
  -p int
        Listen Port (default 2802)
  -r string
        Redis server address (default "localhost:6379")
  -x    Allow CORS for development

Run with docker

docker run -d -p 2802:2802 falcosecurity/falcosidekick-ui

Run

git clone https://github.com/falcosecurity/falcosidekick-ui.git
cd falcosidekick-ui

go run .
#or
make falcosidekick-ui && ./falcosidekick-ui

Endpoints

UI

The UI is reachable by default at http://localhost:2802/.

API

The base URL for the API is http://localhost/api/v1/.

Route	Method	Query Parameters	Usage
/docs	GET	none	Get Swagger Docs
/	GET	none	Display WebUI
/	POST	none	Add event
/healthz	GET	none	Healthcheck
/configuration	GET	none	Get Configuration
/outputs	GET	none	Get list of Outputs of Falcosidekick
/event/count	GET	pretty, priority, rule, filter, tags, since, limit, page	Count all events
/event/count/priority	GET	pretty, priority, rule, filter, tags, since, limit, page	Count events by priority
/event/count/rule	GET	pretty, priority, rule, filter, tags, since, limit, page	Count events by rule
/event/count/source	GET	pretty, priority, rule, filter, tags, since, limit, page	Count events by source
/event/count/tags	GET	pretty, priority, rule, filter, tags, since, limit, page	Count events by tags
/event/search	GET	pretty, priority, rule, filter, tags, since, limit, page	Search events
/ws (not yet implemented)	GET	none	Create Websocket

All responses are in JSON format.

Argument list:

• pretty: return well formated JSON
• priority: filter by priority
• rule: filter by rule
• filter: filter by term
• source: filter by source
• tags: filter by tags
• since: filter by since (in 'second', 'min', 'day', 'week', 'month', 'year')
• limit: limit number of results (default: 100)
• page: page of results

Development

Start local redis server

docker run -d -p 6379:6379 redislabs/redisearch:2.2.4

Build

Requirements:

• go >= 1.18
• nodejs >= v14
• yarn >= 1.22

make falcosidekick-ui

Lint

make lint

Full lint

make lint-full

Update Docs

Requirement:

• swag

make docs

Screenshots

Authors

• Thomas Labarussias (https://github.com/Issif)
• Frank Jogeleit (https://github.com/fjogeleit)