mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 03:27:36 +00:00
23d5e5a968
* rules update: add rules for mitre framework * rules update: add mitre persistence rules * minor changes * add exclude hidden directories list * limit hidden files creation in container * minor fix * minor fix * tune rules to have only_check_container macro * rules update: add rules for remove data from disk and clear log * minor changes * minor fix rule name * add check_container_only macro * addresses comments * add rule for updating package repos * Don't consider dd a bulk writer Threre are enough legitimate cases to exclude it. * Make cron/chmod policies opt-in They have enough legitimate uses that we shouldn't run by default. * minor fix