diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index cab79700..6b07290f 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2991,7 +2991,7 @@ condition: dup and container and evt.rawres in (0, 1, 2) and fd.type in ("ipv4", "ipv6") and not user_known_stand_streams_redirect_activities output: > Redirect stdout/stdin to network connection (user=%user.name user_loginuid=%user.loginuid %container.info process=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository fd.name=%fd.name fd.num=%fd.num fd.type=%fd.type fd.sip=%fd.sip) - priority: WARNING + priority: NOTICE # The two Container Drift rules below will fire when a new executable is created in a container. # There are two ways to create executables - file is created with execution permissions or permissions change of existing file.