Hari 48: Intelligent Alert Routing — Falco CRITICAL Alerts ke Slack

Day 42 setup Python webhook receiver sebagai pengganti n8n (Docker image pull timeout). Hari ini implementasi IF node logic — CRITICAL alert dari Falco otomatis terkirim ke Slack #security-alerts via webhook.

Sebelum vs Sesudah

Before (Day 42):

# Hanya log, belum kirim ke Slack
if priority.lower() == "critical":
    logger.info("Slack payload prepared — NOT YET SENT")

After (Day 48):

# Beneran POST ke Slack webhook
if priority.lower() == "critical":
    post_to_slack(alert)  # HTTP POST via urllib → Slack

Komponen

1. .env file: SLACK_WEBHOOK_URL disimpan di security/n8n-webhook/.env, gitignored
2. webhook_receiver.py: Parse .env manual, fungsi post_to_slack() pakai urllib.request
3. Falcosidekick: Forward alert dari Falco ke webhook receiver via host.docker.internal:5678
4. Slack Webhook: Incoming webhook URL — POST payload format 🚨 *Falco CRITICAL Alert*

Falco DNS Fix

Problem: host.k3d.internal tidak resolve di Docker Desktop → NXDOMAIN

# Before
address: "http://host.k3d.internal:5678/webhook/falco-alert"
# → dial tcp: lookup host.k3d.internal: no such host

# After
address: "http://host.docker.internal:5678/webhook/falco-alert"
# → HTTP 200: alert delivered

Root cause: k3d di Docker Desktop pakai host.docker.internal, bukan host.k3d.internal. Fix 1 baris di falco-values.yaml + Helm upgrade.

End-to-End Test Results

Attack	Priority	Route	Slack?
Shell spawned (bash)	WARNING	Log only	—
Sensitive file read (/etc/passwd)	CRITICAL	Slack #security-alerts	✅ HTTP 200
Sensitive file read (/etc/shadow)	WARNING	Log only	—
Network tool (curl)	NOTICE	Log only	—

CRITICAL → Slack: 2/2 (100%)
Non-CRITICAL → Log: 4/4 (100%)

Payload Structure

slack_payload = {
    "text": f"🚨 *Falco CRITICAL Alert*\n*Rule:* {rule}\n*Pod:* {pod} (ns: {ns})\n*Process:* {proc}\n*Output:* `{output[:200]}`",
}

Pelajaran Hari Ini

Alert routing chain complete. Falco → Falcosidekick → Python webhook → Slack. 4 hop. 100% delivery untuk CRITICAL.

host.k3d.internal vs host.docker.internal. k3d di Docker Desktop tidak support host.k3d.internal. Gunakan host.docker.internal untuk kompatibilitas. Discovery penting (Day 39-42 dokumentasi perlu update).

No pip install needed. urllib.request (stdlib) cukup untuk Slack POST. Avoid dependency hell.

requests library not required. Python built-in urllib works perfectly for simple webhook POSTs. No pip install needed.

Repo

Semua code dan dokumentasi ada di: https://github.com/stayrelevantid/chalange-devsecops

Kesimpulan

Day 48 complete. CRITICAL alerts dari Falco otomatis terkirim ke Slack #security-alerts. IF node logic: CRITICAL → Slack, non-CRITICAL → log only. DNS fix applied (host.docker.internal). End-to-end verified: attack → Falco → webhook → Slack = ✅. Besok Day 49 — AI Remediation Node: auto-ringkas SAST finding via LLM.