From 8bcd0e8f0543683ce63204b02c47602e4cdc730a Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Thu, 9 Nov 2017 14:09:36 -0800
Subject: [PATCH] Add additional cron binaries.

---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 2f7b5fe9..63871eb9 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -324,7 +324,7 @@
   condition: fd.name in (/dev/log, /run/systemd/journal/syslog)
 
 - list: cron_binaries
-  items: [anacron, cron, crond]
+  items: [anacron, cron, crond, crontab]
 
 # https://github.com/liske/needrestart
 - list: needrestart_binaries