New transformer: join(<list>, <sep>)

[leogr]

Motivation

Please take a look at this comment for context.

The join(<list>, <sep>) transformer concatenates the items of a list with a given separator. Its output can be utilized in two primary ways:

1. In conditions for filtering.
2. In the output: field of Falco's rule.

One significant use case is generating a string representation of the process lineage, such as join(proc.lineage, "->").

Feature

Implement the join(<list>, <sep>) function with the following specifications:

• <list>: A list (i.e., a field with EPF_IS_LIST).
• <sep>: A string used as a separator.

The transformer should return a concatenated string.

For example, join(proc.env, ";") would return something like SHELL=/bin/bash;SHELL_NEW=/bin/sh;PWD=/home/user HOME=/home/user.

Note: Implementing this transformer requires extending the current syntax to allow more than one argument.

Alternatives

An alternative is not to implement this transformer if all potential use cases can be achieved through other methods. However, implementing this general-purpose transformer could provide greater flexibility in both filtering and output. Therefore, there is no compelling reason not to implement this transformer.

[leogr]

As discussed here, we are considering to place the <sep> as the first arg. i.e join(<sep>, <list>)

[incertum]

/milestone 0.19.0

[FedeDP]

Perhaps we could also support join(string, sep) to fix #1981?

[FedeDP]

/milestone 0.20.0

[therealbobo]

/assign

[leogr]

Perhaps we could also support join(string, sep) to fix #1981?

@FedeDP we should use concat instead, for that use case, see #2025