Mark Stemm 6be4830342 Improve compatibility with falco 0.9.0 (#357) ...

* Improve compatibility with falco 0.9.0

Temporarily remove some rules features that are not compatible with
falco 0.9.0. We'll release a new falco soon, after which we'll add these
rules features back.

* Disable the unexpected udp traffic rule by default

Some applications will connect a udp socket to an address only to
test connectivity. Assuming the udp connect works, they will follow
up with a tcp connect that actually sends/receives data.

This occurs often enough that we don't want to update the Unexpected UDP
Traffic rule by default, so add a macro do_unexpected_udp_check which is
set to never_true. To opt-in, override the macro to use the condition
always_true.

2018-04-24 11:23:16 -07:00

..

application_rules.yaml

Rule updates vnov (#300)

2017-11-16 12:12:31 -08:00

CMakeLists.txt

Add ability to read rules files from directories (#348)

2018-04-05 17:03:37 -07:00

falco_rules.local.yaml

Rework config file handling

2017-10-05 18:35:39 -07:00

falco_rules.yaml

Improve compatibility with falco 0.9.0 (#357)

2018-04-24 11:23:16 -07:00