Mark Stemm 31c87c295a Update fbash rules to use proc.sname. ...

Update fbash rules to use proc.sname instead of proc.aname and to rely
on sessions instead of process ancestors.

I also wanted to add details on the address/port being listened to but
that's blocked on https://github.com/draios/falco/issues/86.

Along with this change, there are new positive trace files
installer-bash-starts-network-server.scap and
installer-bash-starts-session.scap that test these updated rules.

2016-05-31 17:44:41 -07:00

..

CMakeLists.txt

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

falco_rules.yaml

Update fbash rules to use proc.sname.

2016-05-31 17:44:41 -07:00