From 79a10ad90e7c21dea9162b2f5c835536300522e2 Mon Sep 17 00:00:00 2001 From: kaizhe Date: Mon, 23 Sep 2019 14:59:30 -0700 Subject: [PATCH] rules update: add fluent/fluentd-kubernetes-daemonset to clear log trusted images Signed-off-by: kaizhe --- rules/falco_rules.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 19bef292..a2953cd7 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2356,7 +2356,8 @@ condition: (never_true) - macro: trusted_logging_images - condition: (container.image.repository endswith "splunk/fluentd-hec") + condition: (container.image.repository endswith "splunk/fluentd-hec" or + container.image.repository endswith "fluent/fluentd-kubernetes-daemonset") - rule: Clear Log Activities desc: Detect clearing of critical log files