Method processActions

pkg/rules/engine.go:273–308

processActions executes rule actions on behalf of rule matches. Actions are categorized into implicit and explicit actions. Sending an alert is an implicit action carried out each time there is a rule match. Other actions are executed if declared in the rule definition.

()

// match. Other actions are executed if
// declared in the rule definition.
func (e *Engine) processActions() error {
	defer e.clearMatches()
	e.mmu.Lock()
	defer e.mmu.Unlock()
	for _, m := range e.matches {
		f, evts := m.ctx.Filter, m.ctx.Events
		filterMatches.Add(f.Name, 1)
		log.Debugf("[%s] rule matched", f.Name)
		err := action.Alert(m.ctx, f.Name, filter.InterpolateFields(f.Output, evts), f.Severity, f.Tags)
		if err != nil {
			return ErrRuleAction(f.Name, err)
		}

		actions, err := f.DecodeActions()
		if err != nil {
			return err
		}

		for _, act := range actions {
			switch t := act.(type) {
			case config.KillAction:
				log.Infof("executing kill action: pids=%v rule=%s", m.ctx.UniquePids(), f.Name)
				if err := action.Kill(m.ctx.UniquePids()); err != nil {
					return ErrRuleAction(f.Name, err)
				}
			case config.IsolateAction:
				log.Infof("executing isolate action: rule=%s", f.Name)
				if err := action.Isolate(t.Whitelist); err != nil {
					return ErrRuleAction(f.Name, err)
				}
			}
		}
	}

	return nil
}

func (e *Engine) appendMatch(f *config.FilterConfig, evts ...*event.Event) {
	for _, evt := range evts {