From 36a08aee131c9a96305857d1757c7d42786f9b2a Mon Sep 17 00:00:00 2001
From: Hi120ki <12624257+hi120ki@users.noreply.github.com>
Date: Fri, 9 Sep 2022 16:52:30 +0900
Subject: [PATCH] Update rules/falco_rules.yaml to delete enabled field

Co-authored-by: schie <77834235+darryk10@users.noreply.github.com>
Signed-off-by: Hi120ki <12624257+hi120ki@users.noreply.github.com>
---
 rules/falco_rules.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 21d34be2..4fbb97a2 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -3227,7 +3227,6 @@
   condition: >
     container and open_read and (fd.name glob /proc/*/environ)
     and not proc.name in (known_binaries_to_read_environment_variables_from_proc_files)
-  enabled: true
   output: >
     Environment variables were retrieved from /proc files (user=%user.name user_loginuid=%user.loginuid program=%proc.name
     command=%proc.cmdline file=%fd.name parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] container_id=%container.id image=%container.image.repository)