cleanup(rules): adjust output fields wrt new style guide #122

incertum · 2023-07-27T04:51:53Z

https://falco.org/docs/rules/style-guide/

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind feature

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area rules

/area registry

/area build

/area documentation

Proposed rule maturity level

Uncomment one (or more) /area <> lines (only for PRs that add or modify rules):

/area maturity-stable

/area maturity-incubating

/area maturity-sandbox

/area maturity-deprecated

What this PR does / why we need it:

@leogr please review with falcosecurity/falco-website#1094 and let me know if we agree on these fields? Same for the name to the left of the field, e.g. cmdline or command consistently?
That's why I kept this PR to the first ~10 rules only.

In addition, how many rules can I update wrt to output in one PR going forward?

Idea would be to first list the fields more specific to the rule and then append the agreed upon standard fields. The reviewer should double check that no critical unique fields were removed in the process.

The cleanup would also involve removing all proc.pid fields, I am explaining in falcosecurity/falco-website#1094 why those fields are best kept for customization by adopters. This being said we have yet to improve the UX to support adding output fields generically to each rule for example ... as we discussed in several Falco tickets.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

leogr · 2023-07-27T16:27:49Z

See falcosecurity/falco-website#1094 (review)

github-actions · 2023-07-28T03:41:55Z

Rules files suggestions

falco_rules.yaml

Comparing 7f73898196c9c290cb2caeb65bb4ed8e10190ad2 with latest tag falco-rules-1.0.1

Major changes:

Rule Directory traversal monitored file read has less tags than before
Rule Read sensitive file trusted after startup has less tags than before
Rule Read sensitive file untrusted has less tags than before
Rule Launch Privileged Container has less tags than before
Rule Launch Excessively Capable Container has less tags than before
Rule Launch Sensitive Mount Container has less tags than before
Rule System procs network activity has less tags than before
Rule User mgmt binaries has less tags than before
Rule Unexpected K8s NodePort Connection has been disabled at default
Rule Launch Suspicious Network Tool in Container has less tags than before
Rule Launch Suspicious Network Tool on Host has less tags than before
Rule Remove Bulk Data from Disk has less tags than before
Rule Create Symlink Over Sensitive Files has less tags than before
Rule Create Hardlink Over Sensitive Files has less tags than before
Rule Packet socket created in container has less tags than before
Rule Redirect STDOUT/STDIN to Network Connection in Container has less tags than before
Rule Linux Kernel Module Injection Detected has less tags than before
Rule Debugfs Launched in Privileged Container has less tags than before
Rule Detect release_agent File Container Escapes has less tags than before
Rule Read environment variable from /proc files has less tags than before
Rule PTRACE attached to process has less tags than before
Rule Execution from /dev/shm has less tags than before

Patch changes:

Rule Disallowed SSH Connection changed its output fields
Rule Disallowed SSH Connection has more tags than before
Rule Unexpected outbound connection destination changed its output fields
Rule Unexpected outbound connection destination has more tags than before
Rule Unexpected inbound connection source changed its output fields
Rule Unexpected inbound connection source has more tags than before
Rule Modify Shell Configuration File changed its output fields
Rule Modify Shell Configuration File has more tags than before
Rule Read Shell Configuration File changed its output fields
Rule Read Shell Configuration File has more tags than before
Rule Schedule Cron Jobs changed its output fields
Rule Schedule Cron Jobs has more tags than before
Rule Update Package Repository changed its output fields
Rule Update Package Repository has more tags than before
Rule Write below binary dir changed its output fields
Rule Write below binary dir has more tags than before
Rule Write below monitored dir changed its output fields
Rule Write below monitored dir has more tags than before
Rule Directory traversal monitored file read changed its output fields
Rule Directory traversal monitored file read has more tags than before
Rule Read ssh information changed its output fields
Rule Read ssh information has more tags than before
Rule Write below etc changed its output fields
Rule Write below etc has more tags than before
Rule Write below root changed its output fields
Rule Write below root has more tags than before
Rule Read sensitive file trusted after startup changed its output fields
Rule Read sensitive file trusted after startup has more tags than before
Rule Read sensitive file untrusted changed its output fields
Rule Read sensitive file untrusted has more tags than before
Rule Write below rpm database changed its output fields
Rule Write below rpm database has more tags than before
Rule DB program spawned process changed its output fields
Rule DB program spawned process has more tags than before
Rule Modify binary dirs changed its output fields
Rule Modify binary dirs has more tags than before
Rule Mkdir binary dirs changed its output fields
Rule Mkdir binary dirs has more tags than before
Rule Change thread namespace changed its output fields
Rule Change thread namespace has more tags than before
Rule Run shell untrusted changed its output fields
Rule Run shell untrusted has more tags than before
Rule Launch Privileged Container changed its output fields
Rule Launch Privileged Container has more tags than before
Rule Launch Excessively Capable Container changed its output fields
Rule Launch Excessively Capable Container has more tags than before
Rule Launch Sensitive Mount Container changed its output fields
Rule Launch Sensitive Mount Container has more tags than before
Rule Launch Disallowed Container changed its output fields
Rule Launch Disallowed Container has more tags than before
Rule System user interactive changed its output fields
Rule System user interactive has more tags than before
Rule Terminal shell in container has more tags than before
Rule System procs network activity changed its output fields
Rule System procs network activity has more tags than before
Rule Program run with disallowed http proxy env changed its output fields
Rule Program run with disallowed http proxy env has more tags than before
Rule Interpreted procs inbound network activity changed its output fields
Rule Interpreted procs inbound network activity has more tags than before
Rule Interpreted procs outbound network activity changed its output fields
Rule Interpreted procs outbound network activity has more tags than before
Rule Unexpected UDP Traffic changed its output fields
Rule Unexpected UDP Traffic has more tags than before
Rule Non sudo setuid changed its output fields
Rule Non sudo setuid has more tags than before
Rule User mgmt binaries changed its output fields
Rule User mgmt binaries has more tags than before
Rule Create files below dev changed its output fields
Rule Create files below dev has more tags than before
Rule Contact EC2 Instance Metadata Service From Container changed its output fields
Rule Contact EC2 Instance Metadata Service From Container has more tags than before
Rule Contact cloud metadata service from container changed its output fields
Rule Contact cloud metadata service from container has more tags than before
Rule Contact K8S API Server From Container changed its output fields
Rule Contact K8S API Server From Container has more tags than before
Rule Unexpected K8s NodePort Connection changed its output fields
Rule Unexpected K8s NodePort Connection has more tags than before
Rule Launch Package Management Process in Container changed its output fields
Rule Launch Package Management Process in Container has more tags than before
Rule Netcat Remote Code Execution in Container changed its output fields
Rule Netcat Remote Code Execution in Container has more tags than before
Rule Launch Suspicious Network Tool in Container changed its output fields
Rule Launch Suspicious Network Tool in Container has more tags than before
Rule Launch Suspicious Network Tool on Host changed its output fields
Rule Launch Suspicious Network Tool on Host has more tags than before
Rule Search Private Keys or Passwords changed its output fields
Rule Search Private Keys or Passwords has more tags than before
Rule Clear Log Activities changed its output fields
Rule Clear Log Activities has more tags than before
Rule Remove Bulk Data from Disk changed its output fields
Rule Remove Bulk Data from Disk has more tags than before
Rule Delete or rename shell history changed its output fields
Rule Delete or rename shell history has more tags than before
Rule Delete Bash History changed its output fields
Rule Delete Bash History has more tags than before
Rule Set Setuid or Setgid bit changed its output fields
Rule Set Setuid or Setgid bit has more tags than before
Rule Create Hidden Files or Directories changed its output fields
Rule Create Hidden Files or Directories has more tags than before
Rule Launch Remote File Copy Tools in Container changed its output fields
Rule Launch Remote File Copy Tools in Container has more tags than before
Rule Create Symlink Over Sensitive Files changed its output fields
Rule Create Symlink Over Sensitive Files has more tags than before
Rule Create Hardlink Over Sensitive Files changed its output fields
Rule Create Hardlink Over Sensitive Files has more tags than before
Rule Detect outbound connections to common miner pool ports changed its output fields
Rule Detect outbound connections to common miner pool ports has more tags than before
Rule Detect crypto miners using the Stratum protocol changed its output fields
Rule Detect crypto miners using the Stratum protocol has more tags than before
Rule The docker client is executed in a container changed its output fields
Rule The docker client is executed in a container has more tags than before
Rule Packet socket created in container changed its output fields
Rule Packet socket created in container has more tags than before
Rule Network Connection outside Local Subnet changed its output fields
Rule Network Connection outside Local Subnet has more tags than before
Rule Outbound or Inbound Traffic not to Authorized Server Process and Port changed its output fields
Rule Outbound or Inbound Traffic not to Authorized Server Process and Port has more tags than before
Rule Redirect STDOUT/STDIN to Network Connection in Container changed its output fields
Rule Redirect STDOUT/STDIN to Network Connection in Container has more tags than before
Rule Container Drift Detected (chmod) changed its output fields
Rule Container Drift Detected (chmod) has more tags than before
Rule Container Drift Detected (open+create) changed its output fields
Rule Container Drift Detected (open+create) has more tags than before
Rule Outbound Connection to C2 Servers changed its output fields
Rule Outbound Connection to C2 Servers has more tags than before
Rule Linux Kernel Module Injection Detected changed its output fields
Rule Linux Kernel Module Injection Detected has more tags than before
Rule Container Run as Root User changed its output fields
Rule Container Run as Root User has more tags than before
Rule Sudo Potential Privilege Escalation changed its output fields
Rule Sudo Potential Privilege Escalation has more tags than before
Rule Debugfs Launched in Privileged Container changed its output fields
Rule Debugfs Launched in Privileged Container has more tags than before
Rule Mount Launched in Privileged Container changed its output fields
Rule Mount Launched in Privileged Container has more tags than before
Rule Unprivileged Delegation of Page Faults Handling to a Userspace Process changed its output fields
Rule Unprivileged Delegation of Page Faults Handling to a Userspace Process has more tags than before
Rule Launch Ingress Remote File Copy Tools in Container changed its output fields
Rule Launch Ingress Remote File Copy Tools in Container has more tags than before
Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) changed its output fields
Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) has more tags than before
Rule Detect release_agent File Container Escapes changed its output fields
Rule Detect release_agent File Container Escapes has more tags than before
Rule Java Process Class File Download changed its output fields
Rule Java Process Class File Download has more tags than before
Rule Modify Container Entrypoint changed its output fields
Rule Modify Container Entrypoint has more tags than before
Rule Read environment variable from /proc files changed its output fields
Rule Read environment variable from /proc files has more tags than before
Rule PTRACE attached to process changed its output fields
Rule PTRACE attached to process has more tags than before
Rule PTRACE anti-debug attempt changed its output fields
Rule PTRACE anti-debug attempt has more tags than before
Rule Find AWS Credentials changed its output fields
Rule Find AWS Credentials has more tags than before
Rule Execution from /dev/shm changed its output fields
Rule Execution from /dev/shm has more tags than before
Rule Drop and execute new binary in container changed its output fields
Rule Drop and execute new binary in container has more tags than before

leogr · 2023-07-28T08:09:06Z

@leogr please review with falcosecurity/falco-website#1094 and let me know if we agree on these fields? Same for the name to the left of the field, e.g. cmdline or command consistently?

Done

leogr

First pass

rules/falco_rules.yaml

https://falco.org/docs/rules/style-guide/ Signed-off-by: Melissa Kilby <[email protected]>

Co-authored-by: Leonardo Grasso <[email protected]> Signed-off-by: Melissa Kilby <[email protected]>

github-actions · 2023-07-28T15:05:56Z

Rules files suggestions

falco_rules.yaml

Comparing 3eaee566ea60ff3482673961c359c6f6c1bdd801 with latest tag falco-rules-1.0.1

Major changes:

Rule Directory traversal monitored file read has less tags than before
Rule Read sensitive file trusted after startup has less tags than before
Rule Read sensitive file untrusted has less tags than before
Rule Launch Privileged Container has less tags than before
Rule Launch Excessively Capable Container has less tags than before
Rule Launch Sensitive Mount Container has less tags than before
Rule System procs network activity has less tags than before
Rule User mgmt binaries has less tags than before
Rule Unexpected K8s NodePort Connection has been disabled at default
Rule Launch Suspicious Network Tool in Container has less tags than before
Rule Launch Suspicious Network Tool on Host has less tags than before
Rule Remove Bulk Data from Disk has less tags than before
Rule Create Symlink Over Sensitive Files has less tags than before
Rule Create Hardlink Over Sensitive Files has less tags than before
Rule Packet socket created in container has less tags than before
Rule Redirect STDOUT/STDIN to Network Connection in Container has less tags than before
Rule Linux Kernel Module Injection Detected has less tags than before
Rule Debugfs Launched in Privileged Container has less tags than before
Rule Detect release_agent File Container Escapes has less tags than before
Rule Read environment variable from /proc files has less tags than before
Rule PTRACE attached to process has less tags than before
Rule Execution from /dev/shm has less tags than before

Patch changes:

Rule Disallowed SSH Connection changed its output fields
Rule Disallowed SSH Connection has more tags than before
Rule Unexpected outbound connection destination changed its output fields
Rule Unexpected outbound connection destination has more tags than before
Rule Unexpected inbound connection source changed its output fields
Rule Unexpected inbound connection source has more tags than before
Rule Modify Shell Configuration File changed its output fields
Rule Modify Shell Configuration File has more tags than before
Rule Read Shell Configuration File changed its output fields
Rule Read Shell Configuration File has more tags than before
Rule Schedule Cron Jobs changed its output fields
Rule Schedule Cron Jobs has more tags than before
Rule Update Package Repository changed its output fields
Rule Update Package Repository has more tags than before
Rule Write below binary dir changed its output fields
Rule Write below binary dir has more tags than before
Rule Write below monitored dir changed its output fields
Rule Write below monitored dir has more tags than before
Rule Directory traversal monitored file read changed its output fields
Rule Directory traversal monitored file read has more tags than before
Rule Read ssh information changed its output fields
Rule Read ssh information has more tags than before
Rule Write below etc changed its output fields
Rule Write below etc has more tags than before
Rule Write below root changed its output fields
Rule Write below root has more tags than before
Rule Read sensitive file trusted after startup changed its output fields
Rule Read sensitive file trusted after startup has more tags than before
Rule Read sensitive file untrusted changed its output fields
Rule Read sensitive file untrusted has more tags than before
Rule Write below rpm database changed its output fields
Rule Write below rpm database has more tags than before
Rule DB program spawned process changed its output fields
Rule DB program spawned process has more tags than before
Rule Modify binary dirs changed its output fields
Rule Modify binary dirs has more tags than before
Rule Mkdir binary dirs changed its output fields
Rule Mkdir binary dirs has more tags than before
Rule Change thread namespace changed its output fields
Rule Change thread namespace has more tags than before
Rule Run shell untrusted changed its output fields
Rule Run shell untrusted has more tags than before
Rule Launch Privileged Container changed its output fields
Rule Launch Privileged Container has more tags than before
Rule Launch Excessively Capable Container changed its output fields
Rule Launch Excessively Capable Container has more tags than before
Rule Launch Sensitive Mount Container changed its output fields
Rule Launch Sensitive Mount Container has more tags than before
Rule Launch Disallowed Container changed its output fields
Rule Launch Disallowed Container has more tags than before
Rule System user interactive changed its output fields
Rule System user interactive has more tags than before
Rule Terminal shell in container has more tags than before
Rule System procs network activity changed its output fields
Rule System procs network activity has more tags than before
Rule Program run with disallowed http proxy env changed its output fields
Rule Program run with disallowed http proxy env has more tags than before
Rule Interpreted procs inbound network activity changed its output fields
Rule Interpreted procs inbound network activity has more tags than before
Rule Interpreted procs outbound network activity changed its output fields
Rule Interpreted procs outbound network activity has more tags than before
Rule Unexpected UDP Traffic changed its output fields
Rule Unexpected UDP Traffic has more tags than before
Rule Non sudo setuid changed its output fields
Rule Non sudo setuid has more tags than before
Rule User mgmt binaries changed its output fields
Rule User mgmt binaries has more tags than before
Rule Create files below dev changed its output fields
Rule Create files below dev has more tags than before
Rule Contact EC2 Instance Metadata Service From Container changed its output fields
Rule Contact EC2 Instance Metadata Service From Container has more tags than before
Rule Contact cloud metadata service from container changed its output fields
Rule Contact cloud metadata service from container has more tags than before
Rule Contact K8S API Server From Container changed its output fields
Rule Contact K8S API Server From Container has more tags than before
Rule Unexpected K8s NodePort Connection changed its output fields
Rule Unexpected K8s NodePort Connection has more tags than before
Rule Launch Package Management Process in Container changed its output fields
Rule Launch Package Management Process in Container has more tags than before
Rule Netcat Remote Code Execution in Container changed its output fields
Rule Netcat Remote Code Execution in Container has more tags than before
Rule Launch Suspicious Network Tool in Container changed its output fields
Rule Launch Suspicious Network Tool in Container has more tags than before
Rule Launch Suspicious Network Tool on Host changed its output fields
Rule Launch Suspicious Network Tool on Host has more tags than before
Rule Search Private Keys or Passwords changed its output fields
Rule Search Private Keys or Passwords has more tags than before
Rule Clear Log Activities changed its output fields
Rule Clear Log Activities has more tags than before
Rule Remove Bulk Data from Disk changed its output fields
Rule Remove Bulk Data from Disk has more tags than before
Rule Delete or rename shell history changed its output fields
Rule Delete or rename shell history has more tags than before
Rule Delete Bash History changed its output fields
Rule Delete Bash History has more tags than before
Rule Set Setuid or Setgid bit changed its output fields
Rule Set Setuid or Setgid bit has more tags than before
Rule Create Hidden Files or Directories changed its output fields
Rule Create Hidden Files or Directories has more tags than before
Rule Launch Remote File Copy Tools in Container changed its output fields
Rule Launch Remote File Copy Tools in Container has more tags than before
Rule Create Symlink Over Sensitive Files changed its output fields
Rule Create Symlink Over Sensitive Files has more tags than before
Rule Create Hardlink Over Sensitive Files changed its output fields
Rule Create Hardlink Over Sensitive Files has more tags than before
Rule Detect outbound connections to common miner pool ports changed its output fields
Rule Detect outbound connections to common miner pool ports has more tags than before
Rule Detect crypto miners using the Stratum protocol changed its output fields
Rule Detect crypto miners using the Stratum protocol has more tags than before
Rule The docker client is executed in a container changed its output fields
Rule The docker client is executed in a container has more tags than before
Rule Packet socket created in container changed its output fields
Rule Packet socket created in container has more tags than before
Rule Network Connection outside Local Subnet changed its output fields
Rule Network Connection outside Local Subnet has more tags than before
Rule Outbound or Inbound Traffic not to Authorized Server Process and Port changed its output fields
Rule Outbound or Inbound Traffic not to Authorized Server Process and Port has more tags than before
Rule Redirect STDOUT/STDIN to Network Connection in Container changed its output fields
Rule Redirect STDOUT/STDIN to Network Connection in Container has more tags than before
Rule Container Drift Detected (chmod) changed its output fields
Rule Container Drift Detected (chmod) has more tags than before
Rule Container Drift Detected (open+create) changed its output fields
Rule Container Drift Detected (open+create) has more tags than before
Rule Outbound Connection to C2 Servers changed its output fields
Rule Outbound Connection to C2 Servers has more tags than before
Rule Linux Kernel Module Injection Detected changed its output fields
Rule Linux Kernel Module Injection Detected has more tags than before
Rule Container Run as Root User changed its output fields
Rule Container Run as Root User has more tags than before
Rule Sudo Potential Privilege Escalation changed its output fields
Rule Sudo Potential Privilege Escalation has more tags than before
Rule Debugfs Launched in Privileged Container changed its output fields
Rule Debugfs Launched in Privileged Container has more tags than before
Rule Mount Launched in Privileged Container changed its output fields
Rule Mount Launched in Privileged Container has more tags than before
Rule Unprivileged Delegation of Page Faults Handling to a Userspace Process changed its output fields
Rule Unprivileged Delegation of Page Faults Handling to a Userspace Process has more tags than before
Rule Launch Ingress Remote File Copy Tools in Container changed its output fields
Rule Launch Ingress Remote File Copy Tools in Container has more tags than before
Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) changed its output fields
Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) has more tags than before
Rule Detect release_agent File Container Escapes changed its output fields
Rule Detect release_agent File Container Escapes has more tags than before
Rule Java Process Class File Download changed its output fields
Rule Java Process Class File Download has more tags than before
Rule Modify Container Entrypoint changed its output fields
Rule Modify Container Entrypoint has more tags than before
Rule Read environment variable from /proc files changed its output fields
Rule Read environment variable from /proc files has more tags than before
Rule PTRACE attached to process changed its output fields
Rule PTRACE attached to process has more tags than before
Rule PTRACE anti-debug attempt changed its output fields
Rule PTRACE anti-debug attempt has more tags than before
Rule Find AWS Credentials changed its output fields
Rule Find AWS Credentials has more tags than before
Rule Execution from /dev/shm changed its output fields
Rule Execution from /dev/shm has more tags than before
Rule Drop and execute new binary in container changed its output fields
Rule Drop and execute new binary in container has more tags than before

github-actions · 2023-07-28T15:12:59Z

Rules files suggestions

falco_rules.yaml

Comparing ff1b307d755c320f5a73c83260bd46d76d0b4ebc with latest tag falco-rules-1.0.1

Major changes:

Rule Directory traversal monitored file read has less tags than before
Rule Read sensitive file trusted after startup has less tags than before
Rule Read sensitive file untrusted has less tags than before
Rule Launch Privileged Container has less tags than before
Rule Launch Excessively Capable Container has less tags than before
Rule Launch Sensitive Mount Container has less tags than before
Rule System procs network activity has less tags than before
Rule User mgmt binaries has less tags than before
Rule Unexpected K8s NodePort Connection has been disabled at default
Rule Launch Suspicious Network Tool in Container has less tags than before
Rule Launch Suspicious Network Tool on Host has less tags than before
Rule Remove Bulk Data from Disk has less tags than before
Rule Create Symlink Over Sensitive Files has less tags than before
Rule Create Hardlink Over Sensitive Files has less tags than before
Rule Packet socket created in container has less tags than before
Rule Redirect STDOUT/STDIN to Network Connection in Container has less tags than before
Rule Linux Kernel Module Injection Detected has less tags than before
Rule Debugfs Launched in Privileged Container has less tags than before
Rule Detect release_agent File Container Escapes has less tags than before
Rule Read environment variable from /proc files has less tags than before
Rule PTRACE attached to process has less tags than before
Rule Execution from /dev/shm has less tags than before

Patch changes:

Rule Disallowed SSH Connection changed its output fields
Rule Disallowed SSH Connection has more tags than before
Rule Unexpected outbound connection destination changed its output fields
Rule Unexpected outbound connection destination has more tags than before
Rule Unexpected inbound connection source changed its output fields
Rule Unexpected inbound connection source has more tags than before
Rule Modify Shell Configuration File changed its output fields
Rule Modify Shell Configuration File has more tags than before
Rule Read Shell Configuration File changed its output fields
Rule Read Shell Configuration File has more tags than before
Rule Schedule Cron Jobs changed its output fields
Rule Schedule Cron Jobs has more tags than before
Rule Update Package Repository changed its output fields
Rule Update Package Repository has more tags than before
Rule Write below binary dir changed its output fields
Rule Write below binary dir has more tags than before
Rule Write below monitored dir changed its output fields
Rule Write below monitored dir has more tags than before
Rule Directory traversal monitored file read changed its output fields
Rule Directory traversal monitored file read has more tags than before
Rule Read ssh information changed its output fields
Rule Read ssh information has more tags than before
Rule Write below etc changed its output fields
Rule Write below etc has more tags than before
Rule Write below root changed its output fields
Rule Write below root has more tags than before
Rule Read sensitive file trusted after startup changed its output fields
Rule Read sensitive file trusted after startup has more tags than before
Rule Read sensitive file untrusted changed its output fields
Rule Read sensitive file untrusted has more tags than before
Rule Write below rpm database changed its output fields
Rule Write below rpm database has more tags than before
Rule DB program spawned process changed its output fields
Rule DB program spawned process has more tags than before
Rule Modify binary dirs changed its output fields
Rule Modify binary dirs has more tags than before
Rule Mkdir binary dirs changed its output fields
Rule Mkdir binary dirs has more tags than before
Rule Change thread namespace changed its output fields
Rule Change thread namespace has more tags than before
Rule Run shell untrusted changed its output fields
Rule Run shell untrusted has more tags than before
Rule Launch Privileged Container changed its output fields
Rule Launch Privileged Container has more tags than before
Rule Launch Excessively Capable Container changed its output fields
Rule Launch Excessively Capable Container has more tags than before
Rule Launch Sensitive Mount Container changed its output fields
Rule Launch Sensitive Mount Container has more tags than before
Rule Launch Disallowed Container changed its output fields
Rule Launch Disallowed Container has more tags than before
Rule System user interactive changed its output fields
Rule System user interactive has more tags than before
Rule Terminal shell in container has more tags than before
Rule System procs network activity changed its output fields
Rule System procs network activity has more tags than before
Rule Program run with disallowed http proxy env changed its output fields
Rule Program run with disallowed http proxy env has more tags than before
Rule Interpreted procs inbound network activity changed its output fields
Rule Interpreted procs inbound network activity has more tags than before
Rule Interpreted procs outbound network activity changed its output fields
Rule Interpreted procs outbound network activity has more tags than before
Rule Unexpected UDP Traffic changed its output fields
Rule Unexpected UDP Traffic has more tags than before
Rule Non sudo setuid changed its output fields
Rule Non sudo setuid has more tags than before
Rule User mgmt binaries changed its output fields
Rule User mgmt binaries has more tags than before
Rule Create files below dev changed its output fields
Rule Create files below dev has more tags than before
Rule Contact EC2 Instance Metadata Service From Container changed its output fields
Rule Contact EC2 Instance Metadata Service From Container has more tags than before
Rule Contact cloud metadata service from container changed its output fields
Rule Contact cloud metadata service from container has more tags than before
Rule Contact K8S API Server From Container changed its output fields
Rule Contact K8S API Server From Container has more tags than before
Rule Unexpected K8s NodePort Connection changed its output fields
Rule Unexpected K8s NodePort Connection has more tags than before
Rule Launch Package Management Process in Container changed its output fields
Rule Launch Package Management Process in Container has more tags than before
Rule Netcat Remote Code Execution in Container changed its output fields
Rule Netcat Remote Code Execution in Container has more tags than before
Rule Launch Suspicious Network Tool in Container changed its output fields
Rule Launch Suspicious Network Tool in Container has more tags than before
Rule Launch Suspicious Network Tool on Host changed its output fields
Rule Launch Suspicious Network Tool on Host has more tags than before
Rule Search Private Keys or Passwords changed its output fields
Rule Search Private Keys or Passwords has more tags than before
Rule Clear Log Activities changed its output fields
Rule Clear Log Activities has more tags than before
Rule Remove Bulk Data from Disk changed its output fields
Rule Remove Bulk Data from Disk has more tags than before
Rule Delete or rename shell history changed its output fields
Rule Delete or rename shell history has more tags than before
Rule Delete Bash History changed its output fields
Rule Delete Bash History has more tags than before
Rule Set Setuid or Setgid bit changed its output fields
Rule Set Setuid or Setgid bit has more tags than before
Rule Create Hidden Files or Directories changed its output fields
Rule Create Hidden Files or Directories has more tags than before
Rule Launch Remote File Copy Tools in Container changed its output fields
Rule Launch Remote File Copy Tools in Container has more tags than before
Rule Create Symlink Over Sensitive Files changed its output fields
Rule Create Symlink Over Sensitive Files has more tags than before
Rule Create Hardlink Over Sensitive Files changed its output fields
Rule Create Hardlink Over Sensitive Files has more tags than before
Rule Detect outbound connections to common miner pool ports changed its output fields
Rule Detect outbound connections to common miner pool ports has more tags than before
Rule Detect crypto miners using the Stratum protocol changed its output fields
Rule Detect crypto miners using the Stratum protocol has more tags than before
Rule The docker client is executed in a container changed its output fields
Rule The docker client is executed in a container has more tags than before
Rule Packet socket created in container changed its output fields
Rule Packet socket created in container has more tags than before
Rule Network Connection outside Local Subnet changed its output fields
Rule Network Connection outside Local Subnet has more tags than before
Rule Outbound or Inbound Traffic not to Authorized Server Process and Port changed its output fields
Rule Outbound or Inbound Traffic not to Authorized Server Process and Port has more tags than before
Rule Redirect STDOUT/STDIN to Network Connection in Container changed its output fields
Rule Redirect STDOUT/STDIN to Network Connection in Container has more tags than before
Rule Container Drift Detected (chmod) changed its output fields
Rule Container Drift Detected (chmod) has more tags than before
Rule Container Drift Detected (open+create) changed its output fields
Rule Container Drift Detected (open+create) has more tags than before
Rule Outbound Connection to C2 Servers changed its output fields
Rule Outbound Connection to C2 Servers has more tags than before
Rule Linux Kernel Module Injection Detected changed its output fields
Rule Linux Kernel Module Injection Detected has more tags than before
Rule Container Run as Root User changed its output fields
Rule Container Run as Root User has more tags than before
Rule Sudo Potential Privilege Escalation changed its output fields
Rule Sudo Potential Privilege Escalation has more tags than before
Rule Debugfs Launched in Privileged Container changed its output fields
Rule Debugfs Launched in Privileged Container has more tags than before
Rule Mount Launched in Privileged Container changed its output fields
Rule Mount Launched in Privileged Container has more tags than before
Rule Unprivileged Delegation of Page Faults Handling to a Userspace Process changed its output fields
Rule Unprivileged Delegation of Page Faults Handling to a Userspace Process has more tags than before
Rule Launch Ingress Remote File Copy Tools in Container changed its output fields
Rule Launch Ingress Remote File Copy Tools in Container has more tags than before
Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) changed its output fields
Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) has more tags than before
Rule Detect release_agent File Container Escapes changed its output fields
Rule Detect release_agent File Container Escapes has more tags than before
Rule Java Process Class File Download changed its output fields
Rule Java Process Class File Download has more tags than before
Rule Modify Container Entrypoint changed its output fields
Rule Modify Container Entrypoint has more tags than before
Rule Read environment variable from /proc files changed its output fields
Rule Read environment variable from /proc files has more tags than before
Rule PTRACE attached to process changed its output fields
Rule PTRACE attached to process has more tags than before
Rule PTRACE anti-debug attempt changed its output fields
Rule PTRACE anti-debug attempt has more tags than before
Rule Find AWS Credentials changed its output fields
Rule Find AWS Credentials has more tags than before
Rule Execution from /dev/shm changed its output fields
Rule Execution from /dev/shm has more tags than before
Rule Drop and execute new binary in container changed its output fields
Rule Drop and execute new binary in container has more tags than before

poiana · 2023-07-31T16:32:27Z

LGTM label has been added.

Git tree hash: dcfd1284cdec1a8f78feaed709d0b683c455cbc7

poiana · 2023-07-31T16:32:27Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: incertum, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [incertum,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

poiana added kind/cleanup dco-signoff: yes labels Jul 27, 2023

poiana requested a review from darryk10 July 27, 2023 04:51

poiana added the area/rules label Jul 27, 2023

poiana requested a review from Kaizhe July 27, 2023 04:51

poiana added approved size/M labels Jul 27, 2023

incertum force-pushed the cleanup-output-round1 branch 2 times, most recently from d102298 to 8a7bb37 Compare July 27, 2023 05:26

leogr mentioned this pull request Jul 27, 2023

Falco Graduation Path: Progress Tracker falcosecurity/evolution#281

Closed

incertum force-pushed the cleanup-output-round1 branch from 8a7bb37 to 63ce05a Compare July 27, 2023 19:26

poiana added size/L and removed size/M labels Jul 27, 2023

incertum force-pushed the cleanup-output-round1 branch from 63ce05a to df6ecce Compare July 27, 2023 21:17

poiana added size/XL and removed size/L labels Jul 27, 2023

incertum changed the title ~~cleanup(rules): adjust output fields wrt new style guide round1~~ cleanup(rules): adjust output fields wrt new style guide Jul 27, 2023

incertum force-pushed the cleanup-output-round1 branch from df6ecce to 41076e1 Compare July 28, 2023 03:40

falcosecurity deleted a comment from github-actions bot Jul 28, 2023

leogr reviewed Jul 28, 2023

View reviewed changes

rules/falco_rules.yaml Outdated Show resolved Hide resolved

rules/falco_rules.yaml Outdated Show resolved Hide resolved

rules/falco_rules.yaml Show resolved Hide resolved

rules/falco_rules.yaml Show resolved Hide resolved

rules/falco_rules.yaml Outdated Show resolved Hide resolved

cleanup(rules): adjust output fields wrt new style guide

3c8d9bc

https://falco.org/docs/rules/style-guide/ Signed-off-by: Melissa Kilby <[email protected]>

incertum force-pushed the cleanup-output-round1 branch 3 times, most recently from ff09fa3 to 434784d Compare July 28, 2023 15:03

cleanup(rules): adjust output fields

ec3b7dd

Co-authored-by: Leonardo Grasso <[email protected]> Signed-off-by: Melissa Kilby <[email protected]>

incertum force-pushed the cleanup-output-round1 branch from e2e1c53 to ec3b7dd Compare July 28, 2023 15:11

leogr approved these changes Jul 31, 2023

View reviewed changes

poiana assigned leogr Jul 31, 2023

poiana added the lgtm label Jul 31, 2023

poiana merged commit 0328c59 into falcosecurity:main Jul 31, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cleanup(rules): adjust output fields wrt new style guide #122

cleanup(rules): adjust output fields wrt new style guide #122

incertum commented Jul 27, 2023

leogr commented Jul 27, 2023

github-actions bot commented Jul 28, 2023

leogr commented Jul 28, 2023

leogr left a comment

github-actions bot commented Jul 28, 2023

github-actions bot commented Jul 28, 2023

poiana commented Jul 31, 2023

poiana commented Jul 31, 2023

cleanup(rules): adjust output fields wrt new style guide #122

cleanup(rules): adjust output fields wrt new style guide #122

Conversation

incertum commented Jul 27, 2023

leogr commented Jul 27, 2023

github-actions bot commented Jul 28, 2023

Rules files suggestions

falco_rules.yaml

leogr commented Jul 28, 2023

leogr left a comment

Choose a reason for hiding this comment

github-actions bot commented Jul 28, 2023

Rules files suggestions

falco_rules.yaml

github-actions bot commented Jul 28, 2023

Rules files suggestions

falco_rules.yaml

poiana commented Jul 31, 2023

poiana commented Jul 31, 2023