I tried to deploy Falco via Helm. And I set program_output for sending messages to slack channel but the problem is falco image doesnt have curl and jq packages.
How can I fix this problem?
My program output block:
program: |
jq 'if .priority == "Emergency" or .priority == "Critical" or .priority == "Error" then
{ attachments: [{ text: .output, color: "danger" }]}
elif .priority == "Warning" or .priority == "Notice" then
{ attachments: [{ text: .output, color: "warning" }]}
elif .priority == "Informational" then
{ attachments: [{ text: .output, color: "good" }]}
else
{ attachments: [{ text: .output }]}
end' | curl -d @- -X POST https://hooks.slack.com/services/
Falco Logs:
Thanks in advance.
I expected not error message
