{"action":"created","issue":{"url":"https://api.github.com/repos/falcosecurity/falco/issues/483","repository_url":"https://api.github.com/repos/falcosecurity/falco","labels_url":"https://api.github.com/repos/falcosecurity/falco/issues/483/labels{/name}","comments_url":"https://api.github.com/repos/falcosecurity/falco/issues/483/comments","events_url":"https://api.github.com/repos/falcosecurity/falco/issues/483/events","html_url":"https://github.com/falcosecurity/falco/issues/483","id":390615050,"node_id":"MDU6SXNzdWUzOTA2MTUwNTA=","number":483,"title":"Add hostname to slack notification","user":{"login":"ashishxooa","id":39762529,"node_id":"MDQ6VXNlcjM5NzYyNTI5","avatar_url":"https://avatars2.githubusercontent.com/u/39762529?v=4","gravatar_id":"","url":"https://api.github.com/users/ashishxooa","html_url":"https://github.com/ashishxooa","followers_url":"https://api.github.com/users/ashishxooa/followers","following_url":"https://api.github.com/users/ashishxooa/following{/other_user}","gists_url":"https://api.github.com/users/ashishxooa/gists{/gist_id}","starred_url":"https://api.github.com/users/ashishxooa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ashishxooa/subscriptions","organizations_url":"https://api.github.com/users/ashishxooa/orgs","repos_url":"https://api.github.com/users/ashishxooa/repos","events_url":"https://api.github.com/users/ashishxooa/events{/privacy}","received_events_url":"https://api.github.com/users/ashishxooa/received_events","type":"User","site_admin":false},"labels":[{"id":1401866080,"node_id":"MDU6TGFiZWwxNDAxODY2MDgw","url":"https://api.github.com/repos/falcosecurity/falco/labels/triage/support","name":"triage/support","color":"ed97c6","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-12-13T10:32:52Z","updated_at":"2019-06-21T17:44:17Z","closed_at":null,"author_association":"NONE","body":"Hi, \r\n\r\nIs there a way where I can append the hostname to the messages I 'm getting on slack? \r\n\r\nEg. I 've received the below alert. Which gives me the container id, now this container ID could be anywhere on my servers running docker. \r\n\r\n\r\n`10:19:08.010189604: Informational Container with sensitive mount started (user=root command=runc:[1:CHILD] init docker123321-mysql (id=c2feddeb9679) image=alpine:latest mounts=/etc:/mnt/etc::true:rprivate)\r\n`\r\n\r\nHow do I know quickly the host from this alert? It could be variable like $Hostname or even hard-coded value but it's needed. Thanks. \r\n"},"comment":{"url":"https://api.github.com/repos/falcosecurity/falco/issues/comments/504511838","html_url":"https://github.com/falcosecurity/falco/issues/483#issuecomment-504511838","issue_url":"https://api.github.com/repos/falcosecurity/falco/issues/483","id":504511838,"node_id":"MDEyOklzc3VlQ29tbWVudDUwNDUxMTgzOA==","user":{"login":"mstemm","id":13422831,"node_id":"MDQ6VXNlcjEzNDIyODMx","avatar_url":"https://avatars2.githubusercontent.com/u/13422831?v=4","gravatar_id":"","url":"https://api.github.com/users/mstemm","html_url":"https://github.com/mstemm","followers_url":"https://api.github.com/users/mstemm/followers","following_url":"https://api.github.com/users/mstemm/following{/other_user}","gists_url":"https://api.github.com/users/mstemm/gists{/gist_id}","starred_url":"https://api.github.com/users/mstemm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mstemm/subscriptions","organizations_url":"https://api.github.com/users/mstemm/orgs","repos_url":"https://api.github.com/users/mstemm/repos","events_url":"https://api.github.com/users/mstemm/events{/privacy}","received_events_url":"https://api.github.com/users/mstemm/received_events","type":"User","site_admin":false},"created_at":"2019-06-21T17:44:17Z","updated_at":"2019-06-21T17:44:17Z","author_association":"CONTRIBUTOR","body":"What the fix for this would look like would be to add filtercheck fields something like %host.name to sysdig, and then using them in falco. Then the text of the falco alert would have the hostname.\r\n\r\nWhat I meant by \"add the hostname when creating the json\" was that you could change the json however you wished before sending it to the slack webhook, including adding a hostname."}}
{"actor":{"display_login":"mstemm"}}