From d1707bef63240f2a796c8fa40f93c2f5c448c7da Mon Sep 17 00:00:00 2001 From: Gianmatteo Palmieri Date: Wed, 6 Mar 2024 17:45:37 +0100 Subject: [PATCH] fix(engine): apply output substitutions for all sources Signed-off-by: Gianmatteo Palmieri --- userspace/engine/rule_loader_compiler.cpp | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/userspace/engine/rule_loader_compiler.cpp b/userspace/engine/rule_loader_compiler.cpp index 772ae0ef..b3c285fc 100644 --- a/userspace/engine/rule_loader_compiler.cpp +++ b/userspace/engine/rule_loader_compiler.cpp @@ -501,10 +501,7 @@ void rule_loader::compiler::compile_rule_infos( // build rule output message rule.output = r.output; - if (r.source == falco_common::syscall_source) - { - apply_output_substitutions(cfg, rule.output); - } + apply_output_substitutions(cfg, rule.output); // validate the rule's output if(!is_format_valid(*cfg.sources.at(r.source), rule.output, err))