diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 33f4bb4e..63bef23b 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -338,7 +338,10 @@ condition: container.id != host - macro: container_started - condition: (evt.type = container or (evt.type=execve and evt.dir=< and proc.vpid=1)) + condition: > + ((evt.type = container or + (evt.type=execve and evt.dir=< and proc.vpid=1)) and + container.image.repository != incomplete) - macro: interactive condition: > diff --git a/test/falco_traces.yaml.in b/test/falco_traces.yaml.in index a16d627c..ef949bf4 100644 --- a/test/falco_traces.yaml.in +++ b/test/falco_traces.yaml.in @@ -34,14 +34,14 @@ traces: !mux detect: True detect_level: INFO detect_counts: - - "Launch Privileged Container": 1 + - "Launch Privileged Container": 2 container-sensitive-mount: trace_file: traces-positive/container-sensitive-mount.scap detect: True detect_level: INFO detect_counts: - - "Launch Sensitive Mount Container": 1 + - "Launch Sensitive Mount Container": 2 create-files-below-dev: trace_file: traces-positive/create-files-below-dev.scap