From 15e2d0bf7ee228ac29d0f5d4e4400f47e87e670e Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Tue, 7 Nov 2017 09:52:14 -0800
Subject: [PATCH] Add addl bitnami conditions.

---
 rules/falco_rules.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 4a2d1f26..11749ab9 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -464,7 +464,9 @@
      proc.aname[4]=assemble))
 
 - macro: node_running_bitnami
-  condition: proc.pname=node and proc.cmdline startswith "sh -c /opt/bitnami"
+  condition: (proc.pname=node and
+                (proc.cmdline startswith "sh -c /opt/bitnami" or
+                 proc.cmdline startswith "sh -c bin/redis-server /opt/bitnami"))
 
 - macro: node_running_threatstack
   condition: proc.pcmdline startswith "node /opt/threatstack/node_modules"