Merge 46a4ff2779 into 120881647a

Ignore common UDP ports
443 (http3) and 88 (kerberos) are expected to see UDP traffic Signed-off-by: jackmtpt <115712715+jackmtpt@users.noreply.github.com>
2025-06-23 10:35:29 +01:00 · 2024-08-15 10:36:14 +01:00
1 changed files with 1 additions and 1 deletions
--- a/rules/falco-incubating_rules.yaml
+++ b/rules/falco-incubating_rules.yaml
@ -727,7 +727,7 @@
  items: [0, 9, 80, 3306]

 - list: expected_udp_ports
-  items: [53, openvpn_udp_ports, l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports]
+  items: [53, 443, 88, openvpn_udp_ports, l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports]

 - macro: expected_udp_traffic
  condition: fd.port in (expected_udp_ports)
Author	SHA1	Message	Date
jackmtpt	19211c3244	Merge `46a4ff2779` into `120881647a`	2025-06-23 10:35:29 +01:00
jackmtpt	46a4ff2779	Ignore common UDP ports 443 (http3) and 88 (kerberos) are expected to see UDP traffic Signed-off-by: jackmtpt <115712715+jackmtpt@users.noreply.github.com>	2024-08-15 10:36:14 +01:00