Adds a SumoLogic Output

README.md

@@ -107,6 +107,7 @@ Follow the links to get the configuration of each output.
 - [**Syslog**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/syslog.md)
 - [**Zincsearch**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs//zincsearch.md)
 - [**OpenObserve**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/openobserve.md)
+- [**SumoLogic**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/sumologic.md)
 
 ### Object Storage
 

config.go

@@ -153,6 +153,13 @@ func getConfig() *types.Configuration {
 	v.SetDefault("Loki.Endpoint", "/loki/api/v1/push")
 	v.SetDefault("Loki.ExtraLabels", "")
 
+	v.SetDefault("SumoLogic.MinimumPriority", "")
+	v.SetDefault("SumoLogic.ReceiverURL", "")
+	v.SetDefault("SumoLogic.SourceCategory", "")
+	v.SetDefault("SumoLogic.SourceHost", "")
+	v.SetDefault("SumoLogic.Name", "")
+	v.SetDefault("SumoLogic.CheckCert", true)
+
 	v.SetDefault("AWS.AccessKeyID", "")
 	v.SetDefault("AWS.SecretAccessKey", "")
 	v.SetDefault("AWS.Region", "")
@@ -691,6 +698,7 @@ func getConfig() *types.Configuration {
 	c.Elasticsearch.MinimumPriority = checkPriority(c.Elasticsearch.MinimumPriority)
 	c.Influxdb.MinimumPriority = checkPriority(c.Influxdb.MinimumPriority)
 	c.Loki.MinimumPriority = checkPriority(c.Loki.MinimumPriority)
+	c.SumoLogic.MinimumPriority = checkPriority(c.SumoLogic.MinimumPriority)
 	c.Nats.MinimumPriority = checkPriority(c.Nats.MinimumPriority)
 	c.Stan.MinimumPriority = checkPriority(c.Stan.MinimumPriority)
 	c.AWS.Lambda.MinimumPriority = checkPriority(c.AWS.Lambda.MinimumPriority)

config_example.yaml

@@ -425,7 +425,7 @@ tekton:
   # eventListener: "" # EventListener address, if not empty, Tekton output is enabled
   # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
   # checkcert: true # check if ssl certificate of the output is valid (default: true)
-  
+
 spyderbat:
   # orguid: "" # Organization to send output to, if not empty, Spyderbat output is enabled
   # apikey: "" # Spyderbat API key with access to the organization
@@ -483,3 +483,11 @@ dynatrace:
   apiurl: "" # Dynatrace API url, use https://ENVIRONMENTID.live.dynatrace.com/api for Dynatrace SaaS and https://YOURDOMAIN/e/ENVIRONMENTID/api for Dynatrace Managed, more info : https://dt-url.net/ej43qge
   # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
   # checkcert: true # check if ssl certificate of the output is valid (default: true)
+
+sumologic:
+  ReceiverURL: "" # Sumologic HTTP Source URL, if not empty, Sumologic output is enabled
+  # SourceCategory: "" # Override the default Sumologic Source Category
+  # SourceHost: "" # Override the default Sumologic Source Host
+  # Name: "" # Override the default Sumologic Source Name
+  # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
+  # checkcert: true # check if ssl certificate of the output is valid (default: true)

docs/outputs/sumologic.md

@@ -0,0 +1,46 @@
+# SumoLogic
+
+
+- **Category**: Logs
+- **Website**: https://www.sumologic.com/
+
+## Table of content
+
+- [SumoLogic](#sumologic)
+  - [Table of content](#table-of-content)
+  - [Configuration](#configuration)
+  - [Example of config.yaml](#example-of-configyaml)
+  - [Screenshots](#screenshots)
+
+## Configuration
+
+| Setting                | Env var                | Default value     | Description                                                                                                                         |
+| ---------------------- | ---------------------- | ----------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| `sumologic.receiverurl`        | `SUMOLOGIC_RECEIVERURL`        |                   | https://[SumoEndpoint]/receiver/v1/http/[UniqueHTTPCollectorCode], if not empty, SumoLogic output is **enabled**                                                              |
+| `sumologic.sourcecategory`            | `SUMOLOGIC_SOURCECATEGORY`            |                   | Override the default Source Category for the collector                                                                                                               |
+| `sumologic.sourcehost`          | `SUMOLOGIC_SOURCEHOST`          |                   | Override the default Source Host for the collector                                                                                                            |
+| `sumologic.name`          | `SUMOLOGIC_NAME`          |                   | Override the default Name for the collector                                                                                                     |
+| `sumologic.checkcert`       | `SUMOLOGIC_CHECKCERT`       |   | Check if ssl certificate of the output is valid                                                                                     |
+| `sumologic.minimumpriority` | `SUMOLOGIC_MINIMUMPRIORITY` | `""` (= `debug`)  | Minimum priority of event for using this output, order is `emergency,alert,critical,error,warning,notice,informational,debug or ""` |
+
+
+> **Note**
+The Env var values override the settings from yaml file.
+
+## Example of config.yaml
+
+```yaml
+sumologic:
+  ReceiverURL: "" # Sumologic HTTP Source URL, if not empty, Sumologic output is enabled
+  # SourceCategory: "" # Override the default Sumologic Source Category
+  # SourceHost: "" # Override the default Sumologic Source Host
+  # Name: "" # Override the default Sumologic Source Name
+  # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
+  # checkcert: true # check if ssl certificate of the output is valid (default: true)
+```
+
+## Screenshots
+
+With SumoLogic
+
+![sumologic example](images/sumologic.png)

handlers.go

@@ -222,6 +222,10 @@ func forwardEvent(falcopayload types.FalcoPayload) {
 		go lokiClient.LokiPost(falcopayload)
 	}
 
+	if config.SumoLogic.ReceiverURL != "" && (falcopayload.Priority >= types.Priority(config.SumoLogic.MinimumPriority) || falcopayload.Rule == testRule) {
+		go sumologicClient.SumoLogicPost(falcopayload)
+	}
+
 	if config.Nats.HostPort != "" && (falcopayload.Priority >= types.Priority(config.Nats.MinimumPriority) || falcopayload.Rule == testRule) {
 		go natsClient.NatsPublish(falcopayload)
 	}

main.go

@@ -35,6 +35,7 @@ var (
 	elasticsearchClient *outputs.Client
 	influxdbClient      *outputs.Client
 	lokiClient          *outputs.Client
+	sumologicClient     *outputs.Client
 	natsClient          *outputs.Client
 	stanClient          *outputs.Client
 	awsClient           *outputs.Client
@@ -227,6 +228,16 @@ func init() {
 		}
 	}
 
+	if config.SumoLogic.ReceiverURL != "" {
+		var err error
+		sumologicClient, err = outputs.NewClient("SumoLogic", config.SumoLogic.ReceiverURL, false, config.SumoLogic.CheckCert, config, stats, promStats, statsdClient, dogstatsdClient)
+		if err != nil {
+			config.SumoLogic.ReceiverURL = ""
+		} else {
+			outputs.EnabledOutputs = append(outputs.EnabledOutputs, "SumoLogic")
+		}
+	}
+
 	if config.Nats.HostPort != "" {
 		var err error
 		natsClient, err = outputs.NewClient("NATS", config.Nats.HostPort, config.Nats.MutualTLS, config.Nats.CheckCert, config, stats, promStats, statsdClient, dogstatsdClient)

outputs/sumologic.go

@@ -0,0 +1,53 @@
+package outputs
+
+import (
+	"log"
+	"net/url"
+
+	"github.com/falcosecurity/falcosidekick/types"
+)
+
+// SumoLogicPost posts event to SumoLogic
+func (c *Client) SumoLogicPost(falcopayload types.FalcoPayload) {
+	c.Stats.SumoLogic.Add(Total, 1)
+
+	endpointURL, err := url.Parse(c.Config.SumoLogic.ReceiverURL)
+	if err != nil {
+		c.setSumoLogicErrorMetrics()
+		log.Printf("[ERROR] : %v - %v\n", c.OutputType, err.Error())
+		return
+	}
+
+	c.EndpointURL = endpointURL
+
+	if c.Config.SumoLogic.SourceCategory != "" {
+		c.AddHeader("X-Sumo-Category", c.Config.SumoLogic.SourceCategory)
+	}
+
+	if c.Config.SumoLogic.SourceHost != "" {
+		c.AddHeader("X-Sumo-Host", c.Config.SumoLogic.SourceHost)
+	}
+
+	if c.Config.SumoLogic.Name != "" {
+		c.AddHeader("X-Sumo-Name", c.Config.SumoLogic.Name)
+	}
+
+	err = c.Post(falcopayload)
+	if err != nil {
+		c.setSumoLogicErrorMetrics()
+		log.Printf("[ERROR] : SumoLogic - %v\n", err)
+		return
+	}
+
+	// Setting the success status
+	go c.CountMetric(Outputs, 1, []string{"output:sumologic", "status:ok"})
+	c.Stats.SumoLogic.Add(OK, 1)
+	c.PromStats.Outputs.With(map[string]string{"destination": "sumologic", "status": OK}).Inc()
+}
+
+// setSumoLogicErrorMetrics set the error stats
+func (c *Client) setSumoLogicErrorMetrics() {
+	go c.CountMetric(Outputs, 1, []string{"output:sumologic", "status:error"})
+	c.Stats.SumoLogic.Add(Error, 1)
+	c.PromStats.Outputs.With(map[string]string{"destination": "sumologic", "status": Error}).Inc()
+}

stats.go

@@ -32,6 +32,7 @@ func getInitStats() *types.Statistics {
 		Alertmanager:      getOutputNewMap("alertmanager"),
 		Elasticsearch:     getOutputNewMap("elasticsearch"),
 		Loki:              getOutputNewMap("loki"),
+		SumoLogic:         getOutputNewMap("sumologic"),
 		Nats:              getOutputNewMap("nats"),
 		Stan:              getOutputNewMap("stan"),
 		Influxdb:          getOutputNewMap("influxdb"),

types/types.go

@@ -69,6 +69,7 @@ type Configuration struct {
 	Elasticsearch      ElasticsearchOutputConfig
 	Influxdb           influxdbOutputConfig
 	Loki               LokiOutputConfig
+	SumoLogic          SumoLogicOutputConfig
 	Nats               natsOutputConfig
 	Stan               stanOutputConfig
 	AWS                awsOutputConfig
@@ -286,6 +287,16 @@ type LokiOutputConfig struct {
 	CustomHeaders   map[string]string
 }
 
+type SumoLogicOutputConfig struct {
+	MinimumPriority string
+	ReceiverURL     string
+	SourceCategory  string
+	SourceHost      string
+	Name            string
+	CheckCert       bool
+	MutualTLS       bool
+}
+
 type prometheusOutputConfig struct {
 	ExtraLabels     string
 	ExtraLabelsList []string
@@ -750,6 +761,7 @@ type Statistics struct {
 	Alertmanager      *expvar.Map
 	Elasticsearch     *expvar.Map
 	Loki              *expvar.Map
+	SumoLogic         *expvar.Map
 	Nats              *expvar.Map
 	Stan              *expvar.Map
 	Influxdb          *expvar.Map