falco-gpt

falco-gpt is an OpenAI powered tool to generate remediation actions for Falco audit events. It is a simple HTTP server that listens for Falco audit events and pushes them to an internal NATS server acting like a queue. The queue is then processed by a goroutine that sends the audit events to OpenAI API by applying rate limiting and retries. The generated remediation actions are then sent to Slack via a BOT in a thread.

Screenshots

Features

• OpenAI powered
• Async processing
• Resiliency with retries
• Rate limiting (queries per hour)
• Custom prompt template
• Limitation: Only Slack support for demo purposes

High Level Overview

+------------------------------------------------------+
                              |                                                      |
                              |                                        +----------+  |
                              |                             +--------->|          |  |
                              |                             |          |  OpenAI  |  |
+-------------+               | +-------------+       +-----+-------+  |    API   |  |
|             |               | |             |       |  Retryable  |<-+          |  |
|    falco    |  Send audits  | |  falco-gpt  |Push To| Rate-Limited|  +----------+  |
|  instances  +-------------->| | HTTP Server +------>|    Async    |                |
|(http_output)|    [POST]     | |   (:8080)   |Buffer |    Queue    |  +----------+  |
|             |               | |             |       |  Processor  |  |          |  |
+-------------+               | +-------------+       +------+------+  |  Slack   |  |
                              |                              |         |   BOT    |  |
                              |                              +-------->|          |  |
                              |                                        +----------+  |
                              |                                                      |
                              +------------------------------------------------------+

Installation

Prerequisites

• Export the following environment variables:

• OPENAITOKEN
• SLACKTOKEN

• Falco with httpoutput enabled:

helm upgrade --install falco falcosecurity/falco --namespace falco --create-namespace \
  --set falco.json_output=true \
  --set falco.http_output.enabled=true \
  --set falco.http_output.url=http://falco-gpt:8080

Build

Build with go

go build .

Build with ko

KODOCKERREPO=<REGISTRY> LDFLAGS="-s -w" ko publish -B --platform=linux/amd64 --tags latest --push=true .

Deployment

Container Image:

furkanturkal/falco-gpt:latest

Kubernetes

envsubst < deployment.yaml | kubectl apply -n falco -f -

Usage

$ go run . <FLAGS>
-channel string         Slack channel   -ignore-older int         Ignore events in queue older than X hour(s) (default 1)   -min-priority string         minimum priority to analyse (default "warning")   -model string         Backend AI model (default "gpt-3.5-turbo")   -port int         port to listen on (default 8080)   -qph int         max queries per HOUR to OpenAI (default 10)   -template-file string         path custom template file to use for the ChatGPT

Disclaimer

Your audit log payloads will be sent to OpenAI to generate remediation actions. This project currently does not anonymize the audit log payloads. Please be aware of this when using this tool if you are concerned about your sensitive data. Use at your own risk. By using this tool, you agree that you are solely responsible for any and all consequences; and that the author(s) of this tool are not liable for any damages or losses of any kind.

License

falco-gpt was created by Furkan 'Dentrax' Türkal

The base project code is licensed under MIT unless otherwise specified. Please see the LICENSE file for more information.

Best Regards