Mark Stemm 5740186280 Support container event to denote container starts (#550) ...

* Add support for container metaevent to detect container spawning

Create a new macro "container_started" to check both the old and
the new check.
Also, only look for execve exit events with vpid=1.

* Use TBB_INCLUDE_DIR for consistency w sysdig,agent

Previously it was a mix of TBB_INCLUDE and TBB_INCLUDE_DIR.

* Build using matching sysdig branch, if exists

2019-03-08 13:23:10 -08:00

..

lua

Add support bundle (#517)

2019-02-06 16:36:33 -08:00

CMakeLists.txt

Support container event to denote container starts (#550)

2019-03-08 13:23:10 -08:00

config_falco_engine.h.in

K8s audit evts (#450)

2018-11-09 10:15:39 -08:00

falco_common.cpp

K8s audit evts (#450)

2018-11-09 10:15:39 -08:00

falco_common.h

K8s audit evts (#450)

2018-11-09 10:15:39 -08:00

falco_engine_version.h

Rules versioning (#492)

2019-01-29 12:43:15 -08:00

falco_engine.cpp

Add support bundle (#517)

2019-02-06 16:36:33 -08:00

falco_engine.h

Add support bundle (#517)

2019-02-06 16:36:33 -08:00

formats.cpp

Fix missing arguments (#485)

2019-01-16 17:42:58 -08:00

formats.h

K8s audit evts (#450)

2018-11-09 10:15:39 -08:00

json_evt.cpp

K8s audit evts (#450)

2018-11-09 10:15:39 -08:00

json_evt.h

Implementing required gen_event virtual methods

2018-12-05 13:05:08 -08:00

lpeg.h

Better copyright notices (#426)

2018-09-26 19:49:19 -07:00

lyaml.h

Better copyright notices (#426)

2018-09-26 19:49:19 -07:00

rules.cpp

Add support bundle (#517)

2019-02-06 16:36:33 -08:00

rules.h

Add support bundle (#517)

2019-02-06 16:36:33 -08:00

ruleset.cpp

Avoid going past end of ruleset/etag arrays (#468)

2018-11-15 16:42:14 -08:00

ruleset.h

K8s audit evts (#450)

2018-11-09 10:15:39 -08:00

token_bucket.cpp

Better copyright notices (#426)

2018-09-26 19:49:19 -07:00

token_bucket.h

Better copyright notices (#426)

2018-09-26 19:49:19 -07:00