From c782655a5352cba4dedac45eb9b940fa0cf0a87d Mon Sep 17 00:00:00 2001 From: stephanmiehe Date: Thu, 9 Jun 2022 10:41:57 -0700 Subject: [PATCH] Fix rule linting Signed-off-by: Stephan Miehe --- rules/falco_rules.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index d9a751ea..0ad54eb9 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -3137,8 +3137,8 @@ - macro: user_known_ingress_remote_file_copy_activities condition: (never_true) -- macro: curl_download - condition: proc.name = curl and +- macro: curl_download + condition: proc.name = curl and (proc.cmdline contains " -o " or proc.cmdline contains " --output " or proc.cmdline contains " -O " or