Compare commits
5 Commits
falco-rule
...
main
| Author | SHA1 | Date |
|---|---|---|
Leonardo Di Giovanna
|
be3800132f | |
dependabot[bot]
|
120881647a | |
Leonardo Di Giovanna
|
d0be92e53e | |
Federico Di Pierro
|
488e6f8f0c | |
Melissa Kilby
|
4d51b1813f |
|
|
@ -1 +1,4 @@
|
||||||
master
|
master
|
||||||
|
0.41.2
|
||||||
|
0.41.1
|
||||||
|
0.41.0
|
||||||
|
|
|
||||||
|
|
@ -58,7 +58,7 @@ jobs:
|
||||||
|
|
||||||
# Create a signature of the rules artifact as OCI artifact
|
# Create a signature of the rules artifact as OCI artifact
|
||||||
- name: Install Cosign
|
- name: Install Cosign
|
||||||
uses: sigstore/cosign-installer@v3.8.2
|
uses: sigstore/cosign-installer@v3.9.0
|
||||||
|
|
||||||
- name: Login with cosign
|
- name: Login with cosign
|
||||||
run: cosign login $OCI_REGISTRY --username ${{ github.repository_owner }} --password ${{ secrets.GITHUB_TOKEN }}
|
run: cosign login $OCI_REGISTRY --username ${{ github.repository_owner }} --password ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
|
|
||||||
3
OWNERS
3
OWNERS
|
|
@ -5,7 +5,7 @@ approvers:
|
||||||
- fededp
|
- fededp
|
||||||
- andreagit97
|
- andreagit97
|
||||||
- lucaguerra
|
- lucaguerra
|
||||||
- incertum
|
- ekoops
|
||||||
reviewers:
|
reviewers:
|
||||||
- leodido
|
- leodido
|
||||||
- kaizhe
|
- kaizhe
|
||||||
|
|
@ -13,3 +13,4 @@ reviewers:
|
||||||
- loresuso
|
- loresuso
|
||||||
emeritus_approvers:
|
emeritus_approvers:
|
||||||
- kaizhe
|
- kaizhe
|
||||||
|
- incertum
|
||||||
|
|
|
||||||
|
|
@ -296,9 +296,7 @@
|
||||||
|
|
||||||
- macro: container_started
|
- macro: container_started
|
||||||
condition: >
|
condition: >
|
||||||
((evt.type = container or
|
(spawned_process and proc.vpid=1 and container)
|
||||||
(spawned_process and proc.vpid=1)) and
|
|
||||||
container.image.repository != incomplete)
|
|
||||||
|
|
||||||
- list: cron_binaries
|
- list: cron_binaries
|
||||||
items: [anacron, cron, crond, crontab]
|
items: [anacron, cron, crond, crontab]
|
||||||
|
|
@ -610,7 +608,6 @@
|
||||||
seen as more suspicious, prompting a closer inspection.
|
seen as more suspicious, prompting a closer inspection.
|
||||||
condition: >
|
condition: >
|
||||||
container_started
|
container_started
|
||||||
and container
|
|
||||||
and container.privileged=true
|
and container.privileged=true
|
||||||
and not falco_privileged_containers
|
and not falco_privileged_containers
|
||||||
and not user_privileged_containers
|
and not user_privileged_containers
|
||||||
|
|
@ -640,7 +637,6 @@
|
||||||
raise suspicion, prompting closer scrutiny.
|
raise suspicion, prompting closer scrutiny.
|
||||||
condition: >
|
condition: >
|
||||||
container_started
|
container_started
|
||||||
and container
|
|
||||||
and excessively_capable_container
|
and excessively_capable_container
|
||||||
and not falco_privileged_containers
|
and not falco_privileged_containers
|
||||||
and not user_privileged_containers
|
and not user_privileged_containers
|
||||||
|
|
|
||||||
|
|
@ -327,9 +327,7 @@
|
||||||
|
|
||||||
- macro: container_started
|
- macro: container_started
|
||||||
condition: >
|
condition: >
|
||||||
((evt.type = container or
|
(spawned_process and proc.vpid=1 and container)
|
||||||
(spawned_process and proc.vpid=1)) and
|
|
||||||
container.image.repository != incomplete)
|
|
||||||
|
|
||||||
# Possible scripts run by sshkit
|
# Possible scripts run by sshkit
|
||||||
- list: sshkit_script_binaries
|
- list: sshkit_script_binaries
|
||||||
|
|
@ -1265,7 +1263,6 @@
|
||||||
varies based on your environment.
|
varies based on your environment.
|
||||||
condition: >
|
condition: >
|
||||||
container_started
|
container_started
|
||||||
and container
|
|
||||||
and sensitive_mount
|
and sensitive_mount
|
||||||
and not falco_sensitive_mount_containers
|
and not falco_sensitive_mount_containers
|
||||||
and not user_sensitive_mount_containers
|
and not user_sensitive_mount_containers
|
||||||
|
|
@ -1292,7 +1289,6 @@
|
||||||
this can be challenging to manage.
|
this can be challenging to manage.
|
||||||
condition: >
|
condition: >
|
||||||
container_started
|
container_started
|
||||||
and container
|
|
||||||
and not allowed_containers
|
and not allowed_containers
|
||||||
output: Container started and not in allowed list | evt_type=%evt.type user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
|
output: Container started and not in allowed list | evt_type=%evt.type user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
|
||||||
priority: WARNING
|
priority: WARNING
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue