Mark Stemm 357da40fc4 Only use metadata in k8s audit event for secrets ...

Instead of using the request object to identify service account tokens,
exclude any secrets activity by system users (e.g. users starting with
"system:"). This allows the rules to work on k8s audit events at
Metadata level instead of RequestResponse level.

Also change the example objects for automated tests to ones collected at
Metadata level.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

2020-04-22 21:00:38 +02:00

..

application_rules.yaml

update: license headers

2019-10-08 16:02:26 +02:00

CMakeLists.txt

build: include GNUInstallDirs module

2020-01-17 19:09:31 +01:00

falco_rules.local.yaml

update: license headers

2019-10-08 16:02:26 +02:00

falco_rules.yaml

rename rule

2020-04-21 19:04:14 +02:00

k8s_audit_rules.yaml

Only use metadata in k8s audit event for secrets

2020-04-22 21:00:38 +02:00

OWNERS

docs: specify labels that apply to each area

2019-09-16 10:11:25 +02:00