Mark Stemm 3283ca1e5d Add some detail back to outputs. ...

For rules where evt.args had useful information but too much
information, add back specific values that have just the useful argument
from the event:

 - spawned shells contain the commandline--it's the exit half of the
   exec event so the current commandline is what was exec()d to.

 - setuid contains the uid being switched to.

While I was testing these, I had a couple of other fixes:

 - In the spawn shells rule, only track execve events so you don't catch
   clone() events that precede an exec.
 - in spawn_process only consider the exit half of the exec event.

2016-05-16 11:39:39 -07:00

..

CMakeLists.txt

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

example-1-simple.yaml

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

example-2-macros.yaml

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

falco_rules.yaml

Add some detail back to outputs.

2016-05-16 11:39:39 -07:00