mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-09 18:49:22 +00:00
Prefix outputs with * within the engine.
Prefix output strings with * so they are always permissive in the engine. In falco outputs, which adds its own prefix, remove any leading * before adding the custom prefix.
This commit is contained in:
@@ -436,7 +436,10 @@ function on_event(evt_, rule_id)
|
||||
rule_output_counts.by_name[rule.rule] = rule_output_counts.by_name[rule.rule] + 1
|
||||
end
|
||||
|
||||
return rule.rule, rule.priority, rule.output
|
||||
-- Prefix output with '*' so formatting is permissive
|
||||
output = "*"..rule.output
|
||||
|
||||
return rule.rule, rule.priority, output
|
||||
end
|
||||
|
||||
function print_stats()
|
||||
|
Reference in New Issue
Block a user