Mark Stemm 1564e87177 Rule updates 2018.01.v1 (#319) ...

* Remove remaining fbash references.

No longer relevant after all the installer rules were removed.

* Detect contacting EC2 metadata svc from containers

Add a rule that detects attempts to contact the ec2 metadata service
from containers. By default, the rule does not trigger unless a list of
explicitly allowed containers is provided.

* Detect contacting K8S API Server from container

New rule "Contact K8S API Server From Container" looks for connections
to the K8s API Server. The ip/port for the K8s API Server is in the
macro k8s_api_server and contains an ip/port that's not likely to occur
in practice, so the rule is effectively disabled by default.

2018-01-25 16:06:15 -08:00

..

application_rules.yaml

Rule updates vnov (#300)

2017-11-16 12:12:31 -08:00

CMakeLists.txt

Rule updates vnov (#300)

2017-11-16 12:12:31 -08:00

falco_rules.local.yaml

Rework config file handling

2017-10-05 18:35:39 -07:00

falco_rules.yaml

Rule updates 2018.01.v1 (#319)

2018-01-25 16:06:15 -08:00