Skip to content

Commit

Permalink
Decrease terminal shell in container to debug
Browse files Browse the repository at this point in the history
From notice. That way the two main shell-related policies are both at
debug.
  • Loading branch information
mstemm committed Sep 18, 2017
1 parent 13a509b commit c2619bd
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rules/falco_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -761,7 +761,7 @@
output: >
Shell spawned in a container other than entrypoint (user=%user.name %container.info image=%container.image
shell=%proc.name pcmdline=%proc.pcmdline cmdline=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3])
priority: NOTICE
priority: DEBUG
tags: [container, shell]

# sockfamily ip is to exclude certain processes (like 'groups') that communicate on unix-domain sockets
Expand Down

0 comments on commit c2619bd

Please sign in to comment.