diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 21d34be2..4fbb97a2 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -3227,7 +3227,6 @@ condition: > container and open_read and (fd.name glob /proc/*/environ) and not proc.name in (known_binaries_to_read_environment_variables_from_proc_files) - enabled: true output: > Environment variables were retrieved from /proc files (user=%user.name user_loginuid=%user.loginuid program=%proc.name command=%proc.cmdline file=%fd.name parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] container_id=%container.id image=%container.image.repository)