mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 19:44:57 +00:00
a38f7f181b
Add the ability to append to rules/macros, like we already do with lists. For rules/macros, if the object has an append: true key, the condition value is appended to the condition of an existing rule/macro with the same name. Like lists, it's an error to specify append: true without there being an existing rule/macro. Also add tests that test the same kind of things we did for lists: - That append: true really does append - That append: false overwrites the rule/macro - That it's an error to append with a prior rule/macro existing.
10 lines
264 B
YAML
10 lines
264 B
YAML
- rule: my_rule
|
|
desc: A process named cat does an open
|
|
condition: evt.type=open and fd.name=not-a-real-file
|
|
output: "An open of /dev/null was seen (command=%proc.cmdline)"
|
|
priority: WARNING
|
|
|
|
- rule: my_rule
|
|
append: true
|
|
condition: or fd.name=/dev/null
|