Falco webhook

[juanmatias]

Description
A new webhook to receive notifications from Falco is created.

Fixes # N/A

Changes
Include a brief summary of changes...

• Added a webhook to receive Falco notifications
• README.md modified to add the new webhook
• Tests added for the new webhook

Screenshots
N/A

Checklist

• Pull request is limited to a single purpose
• Code style/formatting is consistent
• All existing tests are passing
• Added new tests related to change
• No unnecessary whitespace changes

Collaboration
When a user creates a pull request from a fork that they own, the user
generally has the authority to decide if other users can commit to the
pull request's compare branch. If the pull request author wants greater
collaboration, they can grant maintainers of the upstream repository
(that is, anyone with push access to the upstream repository) permission
to commit to the pull request's compare branch

See https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork

[juanmatias]

Hey @hyberdk , thanks for your approval

Pipelines failed saying the pre-commit has to be run.

I did so and isort.cfg file was modified.

Now pushing this file to the branch so the pipelines are green.

[satterly]

Good work on the Falco integration! A few issues to fix:

1. Bug: list.extend() returns None — tags = additional_tags.extend(payload['tags']) will always set tags to None. Fix: call additional_tags.extend(payload['tags']) separately, then assign tags = additional_tags.

2. Dead code around DEFAULT_ENVIRONMENT — environment is listed as a required field in expected_fields_in_outputfields, so the DEFAULT_ENVIRONMENT fallback on line 64 can never be reached. Either make environment optional or remove the fallback.

3. Coarse severity mapping — Falco has 8 priority levels but they're collapsed to just critical or warning. Consider mapping to more Alerta severity levels (e.g., informational, warning, major, critical).

4. Tests only check status codes — No assertions on actual alert content (severity, resource, event, tags). The data variable is assigned but never inspected.