Updated Falco Formatting for Containers and Orchestration (markdown)

Mark Stemm
2016-10-24 15:55:53 -07:00
parent 21bf6f8093
commit c9fc27ff5a

@@ -42,19 +42,3 @@ $ falco -pk -k <k8s api server url>
$ falco -p "This is Some Extra" -k <k8s api server url>
15:50:18.866559081: Warning File below a known binary directory opened for writing (user=root command=touch /bin/hack file=/bin/hack) This is Some Extra
```
```
output: "Namespace change (setns) by unexpected program (user=%user.name command=%proc.cmdline parent=%proc.pname %container.info)"
$ falco
15:42:35.347416068: Warning Namespace change (setns) by unexpected program (user=root parent=hyperkube k8s-kubelet (id=4a4021c50439))
$ falco -pk -k <k8s api server url>
15:42:35.347416068: Warning Namespace change (setns) by unexpected program (user=root parent=hyperkube XXX)
$ falco -p "This is Some Extra" -k <k8s api server url>
15:42:35.347416068: Warning Namespace change (setns) by unexpected program (user=root parent=hyperkube XXX) This is Some Extra
```