github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-19 17:16:53 +00:00
Code Issues Projects Releases Wiki Activity

Update rules/falco_rules.yaml to add argoexec into allowlist

Browse Source 
Co-authored-by: schie <77834235+darryk10@users.noreply.github.com>
Signed-off-by: Hi120ki <12624257+hi120ki@users.noreply.github.com>
This commit is contained in:
Hi120ki 2022-09-09 16:52:10 +09:00 committed by poiana
parent a83d38c6d7
commit 39de011751
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/falco_rules.yaml
View File

@ -3220,7 +3220,7 @@
# falco_rules.local.yaml.
- list: known_binaries_to_read_environment_variables_from_proc_files
items: [scsi_id]
items: [scsi_id, argoexec]
- rule: Read environment variable from /proc files
desc: An attempt to read process environment variables from /proc files