Mark Stemm ddedf595ba Rule updates related to event-specific filters ...

- Move evt.type checks to the front of rules. This is necessary to avoid
  warnings now that event types are automatically extracted during rule
  parsing and used to bind each rule with a specific set of events.

- Explicitly specify open for O_CREAT. With the change to event-specific
  filters, it's necessary to associate a search for O_CREAT with
  evt.type=open.

2016-07-18 11:24:49 -07:00

..

CMakeLists.txt

Convert rules file to yaml format

2016-05-06 03:36:59 +00:00

falco_rules.yaml

Rule updates related to event-specific filters

2016-07-18 11:24:49 -07:00