mirror of
https://github.com/falcosecurity/falco.git
synced 2025-07-31 06:01:52 +00:00
Decrease terminal shell in container to debug
From notice. That way the two main shell-related policies are both at debug.
This commit is contained in:
parent
d0650688d5
commit
7c8a85158a
@ -766,7 +766,7 @@
|
||||
output: >
|
||||
Shell spawned in a container other than entrypoint (user=%user.name %container.info image=%container.image
|
||||
shell=%proc.name pcmdline=%proc.pcmdline cmdline=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3])
|
||||
priority: NOTICE
|
||||
priority: DEBUG
|
||||
tags: [container, shell]
|
||||
|
||||
# sockfamily ip is to exclude certain processes (like 'groups') that communicate on unix-domain sockets
|
||||
|
Loading…
Reference in New Issue
Block a user