mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 19:44:57 +00:00
9ecdf30314
New tests that test every possible override: - Overriding a rule with one that doesn't match - Overriding a macro to one that doesn't match - Overriding a top level list to a binary that doesn't match - Overriding an embedded list to one that doesn't match In each case, the override results in no longer matching an open by the program "cat".
14 lines
330 B
YAML
14 lines
330 B
YAML
- list: cat_binaries
|
|
items: [cat]
|
|
|
|
- list: cat_capable_binaries
|
|
items: [cat_binaries]
|
|
|
|
- macro: is_cat
|
|
condition: proc.name in (cat_capable_binaries)
|
|
|
|
- rule: open_from_cat
|
|
desc: A process named cat does an open
|
|
condition: evt.type=open and is_cat
|
|
output: "An open was seen (command=%proc.cmdline)"
|
|
priority: WARNING |