Appsec: properly populate event

[blotus]

The alert will now contains the individual rules that matched, to allow better analysis.

[github-actions]

@blotus: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

• /kind feature
• /kind enhancement
• /kind fix
• /kind chore
• /kind dependencies

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[github-actions]

@blotus: There are no area labels on this PR. You can add as many areas as you see fit.

• /area agent
• /area local-api
• /area cscli
• /area appsec
• /area security
• /area configuration

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[buixor]

/area appsec
/kind enhancement

[LaurenceJJones]

private ip:

root@bookworm:/opt/crowdsec# cscli alerts inspect 2 -d

################################################################################################

- ID           : 2
- Date         : 2024-05-14T10:02:38Z
- Machine      : c90cca144e044e6297dded898a0e76da
- Simulation   : false
- Reason       : crowdsecurity/vpatch-env-access
- Events Count : 0
- Scope:Value  : Ip:192.168.121.1
- Country      :
- AS           :
- Begin        : 2024-05-14 10:02:38 +0000 UTC
- End          : 2024-05-14 10:02:38 +0000 UTC
- UUID         : a31a4bd3-233c-42a1-93bb-d14143718a97


- Context  :
╭───────────────┬──────────────────╮
│      Key      │      Value       │
├───────────────┼──────────────────┤
│ matched_zones │ REQUEST_FILENAME │
│ method        │ GET              │
│ target_uri    │ /.env            │
╰───────────────┴──────────────────╯

- Events  :

- Date: 2024-05-14 10:02:38 +0000 UTC
╭───────────────┬─────────────────────────────────╮
│      Key      │              Value              │
├───────────────┼─────────────────────────────────┤
│ id            │ 3256131465                      │
├───────────────┼─────────────────────────────────┤
│ matched_zones │ REQUEST_FILENAME                │
├───────────────┼─────────────────────────────────┤
│ method        │ GET                             │
├───────────────┼─────────────────────────────────┤
│ msg           │ crowdsecurity/vpatch-env-access │
├───────────────┼─────────────────────────────────┤
│ name          │ crowdsecurity/vpatch-env-access │
╰───────────────┴─────────────────────────────────╯

fake public test:

################################################################################################

- ID           : 3
- Date         : 2024-05-14T10:10:52Z
- Machine      : c90cca144e044e6297dded898a0e76da
- Simulation   : false
- Reason       : crowdsecurity/vpatch-env-access
- Events Count : 0
- Scope:Value  : Ip:1.2.3.4
- Country      : AU
- AS           :
- Begin        : 2024-05-14 10:10:52 +0000 UTC
- End          : 2024-05-14 10:10:52 +0000 UTC
- UUID         : 07a8cd55-b9d3-46f4-a5ad-217ae9ad9d5b


- Context  :
╭───────────────┬──────────────────╮
│      Key      │      Value       │
├───────────────┼──────────────────┤
│ matched_zones │ REQUEST_FILENAME │
│ method        │ GET              │
│ target_uri    │ /.env            │
╰───────────────┴──────────────────╯

- Events  :

- Date: 2024-05-14 10:10:52 +0000 UTC
╭───────────────┬─────────────────────────────────╮
│      Key      │              Value              │
├───────────────┼─────────────────────────────────┤
│ id            │ 3256131465                      │
├───────────────┼─────────────────────────────────┤
│ matched_zones │ REQUEST_FILENAME                │
├───────────────┼─────────────────────────────────┤
│ method        │ GET                             │
├───────────────┼─────────────────────────────────┤
│ msg           │ crowdsecurity/vpatch-env-access │
├───────────────┼─────────────────────────────────┤
│ name          │ crowdsecurity/vpatch-env-access │
╰───────────────┴─────────────────────────────────╯

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 55.21739% with 103 lines in your changes are missing coverage. Please review.

Project coverage is 34.13%. Comparing base (9088f31) to head (6feb9c7).

Files	Patch %	Lines
pkg/acquisition/modules/appsec/utils.go	58.82%	32 Missing and 10 partials ⚠️
pkg/exprhelpers/helpers.go	20.68%	20 Missing and 3 partials ⚠️
pkg/exprhelpers/geoip.go	53.33%	18 Missing and 3 partials ⚠️
cmd/crowdsec/crowdsec.go	0.00%	6 Missing ⚠️
cmd/crowdsec/serve.go	0.00%	3 Missing ⚠️
pkg/alertcontext/alertcontext.go	57.14%	2 Missing and 1 partial ⚠️
pkg/parser/enrich_geoip.go	88.88%	3 Missing ⚠️
cmd/crowdsec-cli/alerts.go	0.00%	1 Missing ⚠️
pkg/parser/unix_parser.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #2943       +/-   ##
===========================================
- Coverage   52.38%   34.13%   -18.26%     
===========================================
  Files         279      279               
  Lines       35312    35425      +113     
===========================================
- Hits        18497    12091     -6406     
- Misses      14986    22030     +7044     
+ Partials     1829     1304      -525     

Flag	Coverage Δ
bats	?
unit-linux	34.87% <60.11%> (+0.02%)	⬆️
unit-windows	30.98% <41.30%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[buixor]

we should ensure that meta are stripped if too long (otherwise they will cause endess retry loop), otherwise lgtm.