Skip to content

Commit

Permalink
Add a Readme and Owners
Browse files Browse the repository at this point in the history
Signed-off-by: Hunter Madison <[email protected]>
  • Loading branch information
hmadison authored and poiana committed May 10, 2024
1 parent e08db5a commit d486cb0
Show file tree
Hide file tree
Showing 2 changed files with 59 additions and 0 deletions.
2 changes: 2 additions & 0 deletions plugins/kafka/OWNERS
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
reviewers:
- hmadison
57 changes: 57 additions & 0 deletions plugins/kafka/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
# Kafka Events Plugin

This repository contains the `kafka` plugin for `Falco`.

# Event Source

The event source for `kafka` events is `kafka`.

# Supported Fields

This plugin does not provide field extraction.

# Development
## Requirements

You need:
* `Go` >= 1.22.2

## Build

```shell
make
```

# Settings

Only `init` accepts settings:

* `brokers`: The list of Kafka brokers to consume messages from.
* `groupId`: The consumer group identifier.
* `topics`: The topics to consume from.
* `tlsConfig`: Configuration for TLS encryption.

# Configurations

* `falco.yaml`

```yaml
plugins:
- name: kafka
library_path: /usr/share/falco/plugins/libkafka.so
init_config:
init_config: |
{
"brokers": ["host.docker.internal:9094"],
"topics": ["example2"],
"groupId": "example1",
"tlsConfig": {
"caCertPath": "/mnt/certs/ca.pem",
"userCertPath": "/mnt/certs/user.pem",
"userKeyPath": "/mnt/certs/key.pem"
}
}
open_params: ''

load_plugins: [kafka]
```

0 comments on commit d486cb0

Please sign in to comment.