diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 75d39d57..1b78a3b4 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -395,7 +395,7 @@ qualys-cloud-ag) and not proc.pname in (sysdigcloud_binaries, sendmail_config_binaries) and not fd.name pmatch (safe_etc_dirs) - and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json) + and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json, /etc/local.gen) and not ansible_running_python and not python_running_denyhosts