github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-04 08:04:49 +00:00
Code Issues Projects Releases Wiki Activity

fix rule naming following naming convention

Browse Source 
Signed-off-by: kaizhe <derek0405@gmail.com>
This commit is contained in:
kaizhe
2020-04-27 11:38:01 -07:00
committed by poiana
parent ca7398dbe1
commit f27056c394
1 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
rules/falco_rules.yaml
View File

@@ -2749,13 +2749,11 @@
output: >
Network connection outside local subnet
(command=%proc.cmdline connection=%fd.name user=%user.name container_id=%container.id
image=%container.image.repository namespace=%k8s.ns.name
fd.rip.name=%fd.rip.name fd.lip.name=%fd.lip.name fd.cip.name=%fd.cip.name fd.sip.name=%fd.sip.name)
image=%container.image.repository namespace=%k8s.ns.name
fd.rip.name=%fd.rip.name fd.lip.name=%fd.lip.name fd.cip.name=%fd.cip.name fd.sip.name=%fd.sip.name)
priority: WARNING
tags: [network]
- macro: allowed_port
condition: (never_true)
@@ -2795,7 +2793,7 @@
priority: WARNING
tags: [network]
- rule: Redirect stdout/stdin to network connection in container
- rule: Redirect STDOUT/STDIN to Network Connection in Container
desc: Detect redirecting stdout/stdin to network connection in container (potential reverse shell).
condition: evt.type=dup and evt.dir=> and container and fd.num in (0, 1, 2) and fd.type in ("ipv4", "ipv6")
output: >