github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-10-21 19:44:57 +00:00
Code Issues Projects Releases Wiki Activity

Unit test for fd.net + in operator fixes (#343)

Browse Source 
Tests fix for https://github.com/draios/falco/issues/339. Depends on
https://github.com/draios/sysdig/pull/1091.
This commit is contained in:
Mark Stemm
2018-04-04 14:23:21 -07:00
committed by GitHub
parent 1516fe4eac
commit 88327abb41
3 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
test/rules/detect_connect_using_in.yaml Normal file
View File

@@ -0,0 +1,6 @@
- rule: Localhost connect
desc: Detect any connect to the localhost network, using fd.net and the in operator
condition: evt.type=connect and fd.net in ("127.0.0.1/24")
output: Program connected to localhost network
(user=%user.name command=%proc.cmdline connection=%fd.name)
priority: INFO