Nicolas Marier 81e29c55ec rule(macro user_known_set_setuid_or_setgid_bit_conditions): create macro ...

This macro will be useful because it will make it possible to filter out
events with a higher degree of granularity than is currently possible
for the `Set Setuid or Setgid bit` rule.

For example, if some application is expected to set the setuid or the
setgid bit under a specific condition, like if it's started with a
specific command, then the `user_known_chmod_applications` list is not
enough because we don't want to filter out _all_ events by this
application, only specific ones. This macro allows that.

Signed-off-by: Nicolas Marier <nmarier@coveo.com>

2020-05-26 10:23:31 +02:00

..

application_rules.yaml

update: license headers

2019-10-08 16:02:26 +02:00

CMakeLists.txt

build: include GNUInstallDirs module

2020-01-17 19:09:31 +01:00

falco_rules.local.yaml

update: license headers

2019-10-08 16:02:26 +02:00

falco_rules.yaml

rule(macro user_known_set_setuid_or_setgid_bit_conditions): create macro

2020-05-26 10:23:31 +02:00

k8s_audit_rules.yaml

rule(list allowed_k8s_users): Add vertical pod autoscaler as known k8s users

2020-05-21 10:57:42 +02:00

OWNERS

docs: specify labels that apply to each area

2019-09-16 10:11:25 +02:00