mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 12:27:10 +00:00
typoes
This commit is contained in:
@@ -1,15 +1,13 @@
|
|||||||
--[[
|
--[[
|
||||||
Sysdig grammar and parser.
|
Sysdig grammar and parser.
|
||||||
|
|
||||||
Much of the scaffolding and helpers was deriverd Andre Murbach Maidl's Lua parser (https://github.com/andremm/lua-parser).
|
Much of the scaffolding and helpers was derived from Andre Murbach Maidl's Lua parser (https://github.com/andremm/lua-parser).
|
||||||
|
|
||||||
Parses regular filters following the existing sysdig filter syntax (*), as well as "macro" definitions. Macro definitions are written like:
|
Parses regular filters following the existing sysdig filter syntax (*), as well as "macro" definitions. Macro definitions are written like:
|
||||||
|
|
||||||
inbound: (syscall.type=listen and evt.dir='>') or (syscall.type=accept and evt.dir='<')
|
inbound: (syscall.type=listen and evt.dir='>') or (syscall.type=accept and evt.dir='<')
|
||||||
|
|
||||||
(*) There currently one known difference with the syntax implemented in libsinsp:
|
(*) There is currently one known difference with the syntax implemented in libsinsp: In libsinsp, field names cannot start with 'a', 'o', or 'n'. With this parser they can.
|
||||||
|
|
||||||
- In libsinsp, field names cannot start with 'a', 'o', or 'n'. With this parser they can
|
|
||||||
|
|
||||||
--]]
|
--]]
|
||||||
|
|
||||||
|
Reference in New Issue
Block a user