Mark Stemm 343e694ca4 Add back detection for mysql and sensitive files. ...

Add back detection for mysql and sensitive files that was removed in the
previous commit. A new macro proc_is_new adds a condition on how long a
process has been running.

A new rule triggers if the process is not new and tries to open a
sensitive file. This handles cases like mysql, where it *does* read
/etc/passwd on startup but shouldn't really open it afterward.

2016-05-11 15:36:48 -07:00

..

CMakeLists.txt

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

example-1-simple.yaml

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

example-2-macros.yaml

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

falco_rules.yaml

Add back detection for mysql and sensitive files.

2016-05-11 15:36:48 -07:00