Mark Stemm 64a231b962 Add exceptions fields/comps/values to rules files ...

Take advantage of the changes to support exceptions and refactor rules
to use them whenever feasible:

- Define exceptions for every rule. In cases where no practical
  exception exists e.g. "K8s <obj> Created/Deleted", define an empty
  exception property just to avoid warnings when loading rules.
- Go through all rules and convert macros-used-as-exceptions that
  matched against 2-3 filter fields into exceptions. In most cases,
  switching from equality (e.g proc.name=nginx) to in (e.g. proc.name
  in (nginx)) allowed for better groupings into a smaller set of
  exception items.
- In cases where the exception had complex combinations of fields, keep
  the macro as is.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

2021-01-19 10:37:55 +01:00

..

application_rules.yaml

update: license headers

2019-10-08 16:02:26 +02:00

CMakeLists.txt

build(rules): fix rules etc dir

2020-09-10 15:01:07 +02:00

falco_rules.local.yaml

update: license headers

2019-10-08 16:02:26 +02:00

falco_rules.yaml

Add exceptions fields/comps/values to rules files

2021-01-19 10:37:55 +01:00

k8s_audit_rules.yaml

Add exceptions fields/comps/values to rules files

2021-01-19 10:37:55 +01:00

OWNERS

docs: specify labels that apply to each area

2019-09-16 10:11:25 +02:00