diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 80fd7c42..17876ee6 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -546,7 +546,8 @@
     init, pluto, mkinitramfs, unattended-upgr, watch, sysdig,
     landscape-sysin, nessusd, PM2, syslog-summary, erl_child_setup,
     npm, cloud-init, toybox, ceph, hhvm, certbot, mysql_install_d,
-    serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini
+    serf, a2enmod, runsv, supervisord, varnishd, authconfig, tini,
+    x2goagent
     ]
 
 - rule: Run shell untrusted
@@ -701,7 +702,7 @@
                            nomachine_binaries,
                            monitoring_binaries, gitlab_binaries, initdb, pg_ctl, awk, falco, cron,
                            erl_child_setup, ceph, PM2, pycompile, py3compile, hhvm, npm, mysql_install_d, serf,
-                           runsv, supervisord, varnishd, crond, logrotate)
+                           runsv, supervisord, varnishd, crond, logrotate, x2goagent)
     and not trusted_containers
     and not shell_spawning_containers
     and not parent_java_running_echo