[crowdsec] Add notification filter to profiles

cmd/crowdsec-cli/notifications.go

@@ -306,14 +306,18 @@ cscli notifications reinject <alert_id> -a '{"remediation": true,"scenario":"not
 			}
 
 			for id, profile := range profiles {
-				_, matched, err := profile.EvaluateProfile(alert)
+				_, matched, notification, err := profile.EvaluateProfile(alert)
 				if err != nil {
 					return fmt.Errorf("can't evaluate profile %s: %w", profile.Cfg.Name, err)
 				}
 				if !matched {
 					log.Infof("The profile %s didn't match", profile.Cfg.Name)
 					continue
 				}
+				if !notification {
+					log.Infof("The profile %s matched, but it doesn't pass notification filters", profile.Cfg.Name)
+					continue
+				}
 				log.Infof("The profile %s matched, sending to its configured notification plugins", profile.Cfg.Name)
 			loop:
 				for {

pkg/apiserver/controllers/v1/alerts.go

@@ -171,15 +171,17 @@ func (c *Controller) CreateAlert(gctx *gin.Context) {
 				decision.UUID = uuid.NewString()
 			}
 			for pIdx, profile := range c.Profiles {
-				_, matched, err := profile.EvaluateProfile(alert)
+				_, matched, notification, err := profile.EvaluateProfile(alert)
 				if err != nil {
 					profile.Logger.Warningf("error while evaluating profile %s : %v", profile.Cfg.Name, err)
 					continue
 				}
 				if !matched {
 					continue
 				}
-				c.sendAlertToPluginChannel(alert, uint(pIdx))
+				if notification {
+					c.sendAlertToPluginChannel(alert, uint(pIdx))
+				}
 				if profile.Cfg.OnSuccess == "break" {
 					break
 				}
@@ -192,7 +194,7 @@ func (c *Controller) CreateAlert(gctx *gin.Context) {
 		}
 
 		for pIdx, profile := range c.Profiles {
-			profileDecisions, matched, err := profile.EvaluateProfile(alert)
+			profileDecisions, matched, notification, err := profile.EvaluateProfile(alert)
 			forceBreak := false
 			if err != nil {
 				switch profile.Cfg.OnError {
@@ -220,8 +222,10 @@ func (c *Controller) CreateAlert(gctx *gin.Context) {
 			if len(alert.Decisions) == 0 { // non manual decision
 				alert.Decisions = append(alert.Decisions, profileDecisions...)
 			}
-			profileAlert := *alert
-			c.sendAlertToPluginChannel(&profileAlert, uint(pIdx))
+			if notification {
+				profileAlert := *alert
+				c.sendAlertToPluginChannel(&profileAlert, uint(pIdx))
+			}
 			if profile.Cfg.OnSuccess == "break" || forceBreak {
 				break
 			}

pkg/csconfig/profiles.go

@@ -20,15 +20,16 @@ import (
 
 // Profile structure(s) are used by the local API to "decide" what kind of decision should be applied when a scenario with an active remediation has been triggered
 type ProfileCfg struct {
-	Name          string            `yaml:"name,omitempty"`
-	Debug         *bool             `yaml:"debug,omitempty"`
-	Filters       []string          `yaml:"filters,omitempty"` //A list of OR'ed expressions. the models.Alert object
-	Decisions     []models.Decision `yaml:"decisions,omitempty"`
-	DurationExpr  string            `yaml:"duration_expr,omitempty"`
-	OnSuccess     string            `yaml:"on_success,omitempty"` //continue or break
-	OnFailure     string            `yaml:"on_failure,omitempty"` //continue or break
-	OnError       string            `yaml:"on_error,omitempty"`   //continue, break, error, report, apply, ignore
-	Notifications []string          `yaml:"notifications,omitempty"`
+	Name                string            `yaml:"name,omitempty"`
+	Debug               *bool             `yaml:"debug,omitempty"`
+	Filters             []string          `yaml:"filters,omitempty"` //A list of OR'ed expressions. the models.Alert object
+	Decisions           []models.Decision `yaml:"decisions,omitempty"`
+	DurationExpr        string            `yaml:"duration_expr,omitempty"`
+	OnSuccess           string            `yaml:"on_success,omitempty"` //continue or break
+	OnFailure           string            `yaml:"on_failure,omitempty"` //continue or break
+	OnError             string            `yaml:"on_error,omitempty"`   //continue, break, error, report, apply, ignore
+	Notifications       []string          `yaml:"notifications,omitempty"`
+	NotificationFilters []string          `yaml:"notification_filters,omitempty"`
 }
 
 func (c *LocalApiServerCfg) LoadProfiles() error {

pkg/csprofiles/csprofiles.go

@@ -16,12 +16,14 @@ import (
 )
 
 type Runtime struct {
-	RuntimeFilters      []*vm.Program               `json:"-" yaml:"-"`
-	DebugFilters        []*exprhelpers.ExprDebugger `json:"-" yaml:"-"`
-	RuntimeDurationExpr *vm.Program                 `json:"-" yaml:"-"`
-	DebugDurationExpr   *exprhelpers.ExprDebugger   `json:"-" yaml:"-"`
-	Cfg                 *csconfig.ProfileCfg        `json:"-" yaml:"-"`
-	Logger              *log.Entry                  `json:"-" yaml:"-"`
+	RuntimeFilters             []*vm.Program               `json:"-" yaml:"-"`
+	DebugFilters               []*exprhelpers.ExprDebugger `json:"-" yaml:"-"`
+	RuntimeDurationExpr        *vm.Program                 `json:"-" yaml:"-"`
+	RuntimeNotificationFilters []*vm.Program               `json:"-" yaml:"-"`
+	DebugDurationExpr          *exprhelpers.ExprDebugger   `json:"-" yaml:"-"`
+	DebugNotificationFilters   []*exprhelpers.ExprDebugger `json:"-" yaml:"-"`
+	Cfg                        *csconfig.ProfileCfg        `json:"-" yaml:"-"`
+	Logger                     *log.Entry                  `json:"-" yaml:"-"`
 }
 
 var defaultDuration = "4h"
@@ -31,8 +33,8 @@ func NewProfile(profilesCfg []*csconfig.ProfileCfg) ([]*Runtime, error) {
 	profilesRuntime := make([]*Runtime, 0)
 
 	for _, profile := range profilesCfg {
-		var runtimeFilter, runtimeDurationExpr *vm.Program
-		var debugFilter, debugDurationExpr *exprhelpers.ExprDebugger
+		var runtimeFilter, runtimeDurationExpr, notificationFilter *vm.Program
+		var debugFilter, debugDurationExpr, debugNotificationExpr *exprhelpers.ExprDebugger
 		runtime := &Runtime{}
 		xlog := log.New()
 		if err := types.ConfigureLogger(xlog); err != nil {
@@ -45,7 +47,9 @@ func NewProfile(profilesCfg []*csconfig.ProfileCfg) ([]*Runtime, error) {
 		})
 
 		runtime.RuntimeFilters = make([]*vm.Program, len(profile.Filters))
+		runtime.RuntimeNotificationFilters = make([]*vm.Program, len(profile.NotificationFilters))
 		runtime.DebugFilters = make([]*exprhelpers.ExprDebugger, len(profile.Filters))
+		runtime.DebugNotificationFilters = make([]*exprhelpers.ExprDebugger, len(profile.NotificationFilters))
 		runtime.Cfg = profile
 		if runtime.Cfg.OnSuccess != "" && runtime.Cfg.OnSuccess != "continue" && runtime.Cfg.OnSuccess != "break" {
 			return []*Runtime{}, fmt.Errorf("invalid 'on_success' for '%s': %s", profile.Name, runtime.Cfg.OnSuccess)
@@ -70,6 +74,18 @@ func NewProfile(profilesCfg []*csconfig.ProfileCfg) ([]*Runtime, error) {
 			}
 		}
 
+		for nIdx, expression := range profile.NotificationFilters {
+			if notificationFilter, err = expr.Compile(expression, exprhelpers.GetExprOptions(map[string]interface{}{"Alert": &models.Alert{}})...); err != nil {
+				return []*Runtime{}, errors.Wrapf(err, "error compiling notification_filter of '%s'", profile.Name)
+			}
+			runtime.RuntimeNotificationFilters[nIdx] = notificationFilter
+			if profile.Debug != nil && *profile.Debug {
+				if debugNotificationExpr, err = exprhelpers.NewDebugger(expression, exprhelpers.GetExprOptions(map[string]interface{}{"Alert": &models.Alert{}})...); err != nil {
+					log.Debugf("Error compiling debug filter of %s : %s", profile.Name, err)
+				}
+				runtime.DebugNotificationFilters[nIdx] = debugNotificationExpr
+			}
+		}
 		if profile.DurationExpr != "" {
 			if runtimeDurationExpr, err = expr.Compile(profile.DurationExpr, exprhelpers.GetExprOptions(map[string]interface{}{"Alert": &models.Alert{}})...); err != nil {
 				return []*Runtime{}, errors.Wrapf(err, "error compiling duration_expr of %s", profile.Name)
@@ -161,15 +177,16 @@ func (Profile *Runtime) GenerateDecisionFromProfile(Alert *models.Alert) ([]*mod
 }
 
 // EvaluateProfile is going to evaluate an Alert against a profile to generate Decisions
-func (Profile *Runtime) EvaluateProfile(Alert *models.Alert) ([]*models.Decision, bool, error) {
+func (Profile *Runtime) EvaluateProfile(Alert *models.Alert) ([]*models.Decision, bool, bool, error) {
 	var decisions []*models.Decision
 
 	matched := false
+	notification := true
 	for eIdx, expression := range Profile.RuntimeFilters {
 		output, err := expr.Run(expression, map[string]interface{}{"Alert": Alert})
 		if err != nil {
 			Profile.Logger.Warningf("failed to run whitelist expr : %v", err)
-			return nil, matched, errors.Wrapf(err, "while running expression %s", Profile.Cfg.Filters[eIdx])
+			return nil, matched, notification, errors.Wrapf(err, "while running expression %s", Profile.Cfg.Filters[eIdx])
 		}
 		switch out := output.(type) {
 		case bool:
@@ -181,9 +198,27 @@ func (Profile *Runtime) EvaluateProfile(Alert *models.Alert) ([]*models.Decision
 				/*the expression matched, create the associated decision*/
 				subdecisions, err := Profile.GenerateDecisionFromProfile(Alert)
 				if err != nil {
-					return nil, matched, errors.Wrapf(err, "while generating decision from profile %s", Profile.Cfg.Name)
+					return nil, matched, notification, errors.Wrapf(err, "while generating decision from profile %s", Profile.Cfg.Name)
+				}
+				for nfIdx, notification_expression := range Profile.RuntimeNotificationFilters {
+					if !notification {
+						break
+					}
+					notification_output, err := expr.Run(notification_expression, map[string]interface{}{"Alert": Alert})
+					if err != nil {
+						Profile.Logger.Warningf("failed to run notification expr : %v", err)
+						return nil, matched, notification, errors.Wrapf(err, "while running expression %s", Profile.Cfg.NotificationFilters[nfIdx])
+					}
+					switch notification_out := notification_output.(type) {
+					case bool:
+						if Profile.Cfg.Debug != nil && *Profile.Cfg.Debug {
+							Profile.DebugNotificationFilters[nfIdx].Run(Profile.Logger, notification_out, map[string]interface{}{"Alert": Alert})
+						}
+						notification = notification_out
+					default:
+						return nil, matched, notification, fmt.Errorf("unexpected type %t (%v) while running '%s'", notification_output, notification_output, Profile.Cfg.NotificationFilters[nfIdx])
+					}
 				}
-
 				decisions = append(decisions, subdecisions...)
 			} else {
 				Profile.Logger.Debugf("Profile %s filter is unsuccessful", Profile.Cfg.Name)
@@ -193,11 +228,11 @@ func (Profile *Runtime) EvaluateProfile(Alert *models.Alert) ([]*models.Decision
 			}
 
 		default:
-			return nil, matched, fmt.Errorf("unexpected type %t (%v) while running '%s'", output, output, Profile.Cfg.Filters[eIdx])
+			return nil, matched, notification, fmt.Errorf("unexpected type %t (%v) while running '%s'", output, output, Profile.Cfg.Filters[eIdx])
 
 		}
 
 	}
 
-	return decisions, matched, nil
+	return decisions, matched, notification, nil
 }

pkg/csprofiles/csprofiles_test.go

@@ -192,7 +192,7 @@ func TestEvaluateProfile(t *testing.T) {
 			if err != nil {
 				t.Errorf("failed to get newProfile : %+v", err)
 			}
-			got, got1, _ := profile[0].EvaluateProfile(tt.args.Alert)
+			got, got1, _, _ := profile[0].EvaluateProfile(tt.args.Alert)
 			if !reflect.DeepEqual(len(got), tt.expectedDecisionCount) {
 				t.Errorf("EvaluateProfile() got = %+v, want %+v", got, tt.expectedDecisionCount)
 			}