farconverter

type FalcoAuditRule struct {
	APIVersion string             `yaml:"apiVersion"`
	Kind       string             `yaml:"kind"`
	Metadata   Metadata           `yaml:"metadata"`
	Spec       FalcoAuditRuleSpec `yaml:"spec"`
}

type FalcoAuditRuleSpec struct {
	RequiredEngineVersion         int                      `yaml:"requiredEngineVersion,omitempty"`
	RequiredK8sAuditPluginVersion string                   `yaml:"requiredK8sAuditPluginVersion,omitempty"`
	Rules                         []FalcoAuditRuleSpecRule `yaml:"rules"`
}

type FalcoAuditRuleSpecRule struct {
	Rule  Rule  `yaml:"rule,omitempty"`
	Macro Macro `yaml:"macro,omitempty"`
	List  List  `yaml:"list,omitempty"`
}

type List struct {
	Name  string `yaml:"name"`
	Items []any  `yaml:"items"`
}

type Macro struct {
	Name      string `yaml:"name"`
	Condition string `yaml:"condition"`
}

type Metadata struct {
	Name string `yaml:"name"`
}

type RawRule map[string]any

type Rule struct {
	Name      string `yaml:"name"`
	Condition string `yaml:"condition"`
	Desc      string `yaml:"desc"`
	Output    string `yaml:"output"`
	Priority  string `yaml:"priority"`
	Enabled   bool   `yaml:"enabled,omitempty"`
	Tags      []any  `yaml:"tags,omitempty"`
	Source    string `yaml:"source,omitempty"`
}