mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 03:49:36 +00:00
88327abb41
Tests fix for https://github.com/draios/falco/issues/339. Depends on https://github.com/draios/sysdig/pull/1091.
7 lines
303 B
YAML
7 lines
303 B
YAML
- rule: Localhost connect
|
|
desc: Detect any connect to the localhost network, using fd.net and the in operator
|
|
condition: evt.type=connect and fd.net in ("127.0.0.1/24")
|
|
output: Program connected to localhost network
|
|
(user=%user.name command=%proc.cmdline connection=%fd.name)
|
|
priority: INFO
|