mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-19 06:37:15 +00:00
typoes
This commit is contained in:
parent
208930fd55
commit
c63657acad
@ -1,15 +1,13 @@
|
|||||||
--[[
|
--[[
|
||||||
Sysdig grammar and parser.
|
Sysdig grammar and parser.
|
||||||
|
|
||||||
Much of the scaffolding and helpers was deriverd Andre Murbach Maidl's Lua parser (https://github.com/andremm/lua-parser).
|
Much of the scaffolding and helpers was derived from Andre Murbach Maidl's Lua parser (https://github.com/andremm/lua-parser).
|
||||||
|
|
||||||
Parses regular filters following the existing sysdig filter syntax (*), as well as "macro" definitions. Macro definitions are written like:
|
Parses regular filters following the existing sysdig filter syntax (*), as well as "macro" definitions. Macro definitions are written like:
|
||||||
|
|
||||||
inbound: (syscall.type=listen and evt.dir='>') or (syscall.type=accept and evt.dir='<')
|
inbound: (syscall.type=listen and evt.dir='>') or (syscall.type=accept and evt.dir='<')
|
||||||
|
|
||||||
(*) There currently one known difference with the syntax implemented in libsinsp:
|
(*) There is currently one known difference with the syntax implemented in libsinsp: In libsinsp, field names cannot start with 'a', 'o', or 'n'. With this parser they can.
|
||||||
|
|
||||||
- In libsinsp, field names cannot start with 'a', 'o', or 'n'. With this parser they can
|
|
||||||
|
|
||||||
--]]
|
--]]
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user