mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 11:29:26 +00:00
df219b5e1d
Add new test cases for a rule with an unknown source *and* an exception, and a macro with an unknown source. The first results in a rule warning (and no error), and the second prints an error and skips. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
10 lines
369 B
YAML
10 lines
369 B
YAML
- rule: Cloudtrail Create Instance
|
|
desc: Detect Creating an EC2 Instance
|
|
condition: evt.num > 0 and ct.name="StartInstances"
|
|
output: EC2 Instance Created (evtnum=%evt.num info=%evt.plugininfo id=%ct.id user name=%json.value[/userIdentity/userName])
|
|
exceptions:
|
|
- name: user_secreid
|
|
fields: [aws.user, aws.region]
|
|
priority: INFO
|
|
source: aws_cloudtrail
|