Compare commits
7 Commits
falco-rule
...
main
| Author | SHA1 | Date |
|---|---|---|
Leonardo Di Giovanna
|
be3800132f | |
dependabot[bot]
|
120881647a | |
Leonardo Di Giovanna
|
d0be92e53e | |
Federico Di Pierro
|
488e6f8f0c | |
Melissa Kilby
|
4d51b1813f | |
|
dependabot[bot]
|
b4437c492f | |
Dirk Marwinski
|
cb17833316 |
|
|
@ -1 +1,4 @@
|
||||||
master
|
master
|
||||||
|
0.41.2
|
||||||
|
0.41.1
|
||||||
|
0.41.0
|
||||||
|
|
|
||||||
|
|
@ -22,7 +22,7 @@ jobs:
|
||||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||||
|
|
||||||
- name: Install uv
|
- name: Install uv
|
||||||
uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
|
uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v5
|
||||||
|
|
||||||
- name: Generate updated inventory
|
- name: Generate updated inventory
|
||||||
run: |
|
run: |
|
||||||
|
|
|
||||||
|
|
@ -58,7 +58,7 @@ jobs:
|
||||||
|
|
||||||
# Create a signature of the rules artifact as OCI artifact
|
# Create a signature of the rules artifact as OCI artifact
|
||||||
- name: Install Cosign
|
- name: Install Cosign
|
||||||
uses: sigstore/cosign-installer@v3.8.2
|
uses: sigstore/cosign-installer@v3.9.0
|
||||||
|
|
||||||
- name: Login with cosign
|
- name: Login with cosign
|
||||||
run: cosign login $OCI_REGISTRY --username ${{ github.repository_owner }} --password ${{ secrets.GITHUB_TOKEN }}
|
run: cosign login $OCI_REGISTRY --username ${{ github.repository_owner }} --password ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
|
|
||||||
3
OWNERS
3
OWNERS
|
|
@ -5,7 +5,7 @@ approvers:
|
||||||
- fededp
|
- fededp
|
||||||
- andreagit97
|
- andreagit97
|
||||||
- lucaguerra
|
- lucaguerra
|
||||||
- incertum
|
- ekoops
|
||||||
reviewers:
|
reviewers:
|
||||||
- leodido
|
- leodido
|
||||||
- kaizhe
|
- kaizhe
|
||||||
|
|
@ -13,3 +13,4 @@ reviewers:
|
||||||
- loresuso
|
- loresuso
|
||||||
emeritus_approvers:
|
emeritus_approvers:
|
||||||
- kaizhe
|
- kaizhe
|
||||||
|
- incertum
|
||||||
|
|
|
||||||
|
|
@ -296,9 +296,7 @@
|
||||||
|
|
||||||
- macro: container_started
|
- macro: container_started
|
||||||
condition: >
|
condition: >
|
||||||
((evt.type = container or
|
(spawned_process and proc.vpid=1 and container)
|
||||||
(spawned_process and proc.vpid=1)) and
|
|
||||||
container.image.repository != incomplete)
|
|
||||||
|
|
||||||
- list: cron_binaries
|
- list: cron_binaries
|
||||||
items: [anacron, cron, crond, crontab]
|
items: [anacron, cron, crond, crontab]
|
||||||
|
|
@ -610,7 +608,6 @@
|
||||||
seen as more suspicious, prompting a closer inspection.
|
seen as more suspicious, prompting a closer inspection.
|
||||||
condition: >
|
condition: >
|
||||||
container_started
|
container_started
|
||||||
and container
|
|
||||||
and container.privileged=true
|
and container.privileged=true
|
||||||
and not falco_privileged_containers
|
and not falco_privileged_containers
|
||||||
and not user_privileged_containers
|
and not user_privileged_containers
|
||||||
|
|
@ -640,7 +637,6 @@
|
||||||
raise suspicion, prompting closer scrutiny.
|
raise suspicion, prompting closer scrutiny.
|
||||||
condition: >
|
condition: >
|
||||||
container_started
|
container_started
|
||||||
and container
|
|
||||||
and excessively_capable_container
|
and excessively_capable_container
|
||||||
and not falco_privileged_containers
|
and not falco_privileged_containers
|
||||||
and not user_privileged_containers
|
and not user_privileged_containers
|
||||||
|
|
|
||||||
|
|
@ -327,9 +327,7 @@
|
||||||
|
|
||||||
- macro: container_started
|
- macro: container_started
|
||||||
condition: >
|
condition: >
|
||||||
((evt.type = container or
|
(spawned_process and proc.vpid=1 and container)
|
||||||
(spawned_process and proc.vpid=1)) and
|
|
||||||
container.image.repository != incomplete)
|
|
||||||
|
|
||||||
# Possible scripts run by sshkit
|
# Possible scripts run by sshkit
|
||||||
- list: sshkit_script_binaries
|
- list: sshkit_script_binaries
|
||||||
|
|
@ -1265,7 +1263,6 @@
|
||||||
varies based on your environment.
|
varies based on your environment.
|
||||||
condition: >
|
condition: >
|
||||||
container_started
|
container_started
|
||||||
and container
|
|
||||||
and sensitive_mount
|
and sensitive_mount
|
||||||
and not falco_sensitive_mount_containers
|
and not falco_sensitive_mount_containers
|
||||||
and not user_sensitive_mount_containers
|
and not user_sensitive_mount_containers
|
||||||
|
|
@ -1292,7 +1289,6 @@
|
||||||
this can be challenging to manage.
|
this can be challenging to manage.
|
||||||
condition: >
|
condition: >
|
||||||
container_started
|
container_started
|
||||||
and container
|
|
||||||
and not allowed_containers
|
and not allowed_containers
|
||||||
output: Container started and not in allowed list | evt_type=%evt.type user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
|
output: Container started and not in allowed list | evt_type=%evt.type user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
|
||||||
priority: WARNING
|
priority: WARNING
|
||||||
|
|
|
||||||
|
|
@ -363,7 +363,8 @@
|
||||||
iptables, ps, lsb_release, check-new-relea, dumpe2fs, accounts-daemon, sshd,
|
iptables, ps, lsb_release, check-new-relea, dumpe2fs, accounts-daemon, sshd,
|
||||||
vsftpd, systemd, mysql_install_d, psql, screen, debconf-show, sa-update,
|
vsftpd, systemd, mysql_install_d, psql, screen, debconf-show, sa-update,
|
||||||
pam-auth-update, pam-config, /usr/sbin/spamd, polkit-agent-he, lsattr, file, sosreport,
|
pam-auth-update, pam-config, /usr/sbin/spamd, polkit-agent-he, lsattr, file, sosreport,
|
||||||
scxcimservera, adclient, rtvscand, cockpit-session, userhelper, ossec-syscheckd
|
scxcimservera, adclient, rtvscand, cockpit-session, userhelper, ossec-syscheckd,
|
||||||
|
sshd-session
|
||||||
]
|
]
|
||||||
|
|
||||||
# Add conditions to this macro (probably in a separate file,
|
# Add conditions to this macro (probably in a separate file,
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue