Standardisation capability of Falco rule output

[samsson]

Motivation

When writing Falco rules, the output needs to be formatted separately for each rule. This must be copied from other rules of written from scratch that can easily introduce inconsistencies and overhead.
A way to create template(s) for output format would streamline work and ensure consistency.

Feature

A macro based or other template facilitates creating a Falco rule output format that can be used in one or more Falco rules.
The macro would contain the same information as the output contains today while the rule output could contain the macro.
Example:

macro: user_info_format
(username=%user.name loginuid=%user.loginuid)

- rule:....
  output: >
    detection rule triggered: user_info_format

Alternatives
Something else than macro

Additional context

The thought was briefly mentioned here: #577 (comment)
by: @mfdii

[Andreagit97]

Thank you for reporting this! This seems a useful feature, we will consider it!

[WoutResseler]

Plus one, would be very nice!

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[nicolasbrieussel]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale