Skip to content

Commit

Permalink
Decrease terminal shell in container to debug
Browse files Browse the repository at this point in the history
From notice. That way the two main shell-related policies are both at
debug.
  • Loading branch information
mstemm committed Sep 14, 2017
1 parent 55f55be commit 3b30644
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rules/falco_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -761,7 +761,7 @@
output: >
Shell spawned in a container other than entrypoint (user=%user.name %container.info image=%container.image
shell=%proc.name pcmdline=%proc.pcmdline cmdline=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3])
priority: NOTICE
priority: DEBUG
tags: [container, shell]

# sockfamily ip is to exclude certain processes (like 'groups') that communicate on unix-domain sockets
Expand Down

0 comments on commit 3b30644

Please sign in to comment.