From df7a356e1d64c2fa12d584dae2e6b9958b3b86e3 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lachance Date: Tue, 3 Dec 2019 16:27:23 -0500 Subject: [PATCH] Apply Kaizhe's code review Signed-off-by: Jean-Philippe Lachance --- rules/falco_rules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 2c73c972..55e1853b 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -447,7 +447,7 @@ and not proc.name in (shell_binaries) and not exe_running_docker_save output: > - a shell configuration file has been modified (user=%user.name command=%proc.cmdline parent=%proc.pname pcmdline=%proc.pcmdline file=%fd.name container_id=%container.id image=%container.image.repository) + a shell configuration file has been modified (user=%user.name command=%proc.cmdline pcmdline=%proc.pcmdline file=%fd.name container_id=%container.id image=%container.image.repository) priority: WARNING tag: [file, mitre_persistence]