update(engine): modify append_output format

[LucaGuerra]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area engine

What this PR does / why we need it:

Having discussed this feature with @leogr and @Issif we came to the conclusion that it could be better to modify the format of append_output to something like this example:

append_output:
  - match:
      source: syscall
      tags: 
        - bar
        - foo
      rule: rule A
    extra_output: "gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]"
    extra_fields:
      - ka.verb
      - home_directory: "${HOME}"
      - my_field: "this is event number %evt.num"

tags, source, rule are ANDed together and also when multiple tags are specified those are all ANDed together as well.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[github-actions]

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

[poiana]

LGTM label has been added.

Git tree hash: b99934e0070d45b144746852aa90bea53118a345

[FedeDP]

/milestone 0.39.0

[FedeDP]

Exctract an helper method since the same check is also used below?

[LucaGuerra]

fixed by using a single function instead.

[FedeDP]

I think we need to update configuration.cpp json schema too!
/hold

[LucaGuerra]

@FedeDP damn I forgot 🤣 , will fix. thanks

[leogr]

I think we need to update configuration.cpp json schema too! /hold

Good catch!

side topic: it would be nice to introduce some automatic check

[FedeDP]

side topic: it would be nice to introduce some automatic check

There is an automatic check that loads the falco.yaml from the CMAKE_CURRENT_SOURCE_DIR; but in this case, the new option is not present by default in the Falco yaml thus the test passes fine.

[poiana]

LGTM label has been added.

Git tree hash: bbfa0e0fffbcc70350dbb99b7dd9aa25d4774125

[FedeDP]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [FedeDP,LucaGuerra]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[FedeDP]

/unhold