mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-12 13:07:49 +00:00
Let endeca spawn shells in containers also
This commit is contained in:
@@ -1180,6 +1180,7 @@
|
||||
and not parent_python_running_localstack
|
||||
and not parent_python_running_zookeeper
|
||||
and not parent_docker_start_script
|
||||
and not parent_java_running_endeca
|
||||
output: >
|
||||
Shell spawned in a container other than entrypoint (user=%user.name %container.info image=%container.image
|
||||
shell=%proc.name pcmdline=%proc.pcmdline cmdline=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3])
|
||||
|
Reference in New Issue
Block a user