From cdb5d71eb6558cfebded5134cc01d1f3561044a5 Mon Sep 17 00:00:00 2001 From: kaizhe Date: Mon, 30 Sep 2019 13:49:51 -0700 Subject: [PATCH] rule update: add more comments Signed-off-by: kaizhe --- rules/falco_rules.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 37a7f020..1c9e6b0a 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2416,6 +2416,7 @@ tag: [process, mitre_defense_evation] # This rule is deprecated and will/should never be triggered. Keep it here for backport compatibility. +# Rule Delete or rename shell history is the preferred rule to use now. - rule: Delete Bash History desc: Detect bash history deletion condition: >