)]}'
{"falco/Chart.yaml":[{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"apiVersion: v1"},{"line_number":17,"context_line":"name: falco"},{"line_number":18,"context_line":"version: 0.3.0"},{"line_number":19,"context_line":"appVersion: 0.11.1"},{"line_number":20,"context_line":"description: Sysdig Falco"},{"line_number":21,"context_line":"keywords:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_f7e80f16","line":18,"range":{"start_line":18,"start_character":9,"end_line":18,"end_character":14},"updated":"2018-09-26 13:42:58.000000000","message":"Can we make this 0.1.0 for consistency with the other charts?","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"apiVersion: v1"},{"line_number":17,"context_line":"name: falco"},{"line_number":18,"context_line":"version: 0.3.0"},{"line_number":19,"context_line":"appVersion: 0.11.1"},{"line_number":20,"context_line":"description: Sysdig Falco"},{"line_number":21,"context_line":"keywords:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_b73a97e3","line":18,"range":{"start_line":18,"start_character":9,"end_line":18,"end_character":14},"in_reply_to":"3f79a3b5_f7e80f16","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"}],"falco/rules/falco_rules.yaml":[{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"12b0bb115f5d604e3637239c3fb8d5352833e347","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"3f79a3b5_fa83d654","updated":"2018-09-04 14:12:34.000000000","message":"can we move this to be driven via the values.yaml","commit_id":"a0ac55a0027ffc5220682d9315c66c4626bb8608"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"359f5dca6ef2bbe4e97759114e0d3ba8484f8806","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"3f79a3b5_231d8d61","in_reply_to":"3f79a3b5_fa83d654","updated":"2018-09-05 14:58:49.000000000","message":"Done","commit_id":"a0ac55a0027ffc5220682d9315c66c4626bb8608"}],"falco/templates/clusterrole.yaml":[{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"62aa5e38c1fb97be2bba1f92f40985840eb49f4a","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_63bb85e4","line":1,"updated":"2018-09-05 15:13:05.000000000","message":"can we specify this in the same way as other charts.","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"d6de112dda745c88c8b730231f5bacb0aa5fa068","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_a99ad7c1","line":1,"in_reply_to":"3f79a3b5_63bb85e4","updated":"2018-09-05 20:35:45.000000000","message":"Done. Moved code to Daemonset yaml","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"}],"falco/templates/clusterrolebinding.yaml":[{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"62aa5e38c1fb97be2bba1f92f40985840eb49f4a","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_23b10d02","line":1,"updated":"2018-09-05 15:13:05.000000000","message":"can we specify this in the same way as other charts.","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"d6de112dda745c88c8b730231f5bacb0aa5fa068","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_c99f13b2","line":1,"in_reply_to":"3f79a3b5_23b10d02","updated":"2018-09-05 20:35:45.000000000","message":"Done. Moved code to Daemonset yaml","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"}],"falco/templates/configmap-etc.yaml":[{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"035cf888c7d91f0a3fdab3b34c1b04199dfcf2a5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":"f 12 [Diff preferences (Shortcut: ,)]"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"new file mode 100644"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":8,"context_line":"you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_7a2b6de9","line":5,"range":{"start_line":3,"start_character":0,"end_line":5,"end_character":20},"updated":"2018-09-27 12:51:48.000000000","message":"Oops. This needs to be removed","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"8ff29fc7fadf521afc1ea767fce761984a1f0eb2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":"f 12 [Diff preferences (Shortcut: ,)]"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"new file mode 100644"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":8,"context_line":"you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_da85e1af","line":5,"range":{"start_line":3,"start_character":0,"end_line":5,"end_character":20},"in_reply_to":"3f79a3b5_7a2b6de9","updated":"2018-09-27 16:33:02.000000000","message":"No idea where it came from .. thanks for catching that.","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"035cf888c7d91f0a3fdab3b34c1b04199dfcf2a5","unresolved":false,"context_lines":[{"line_number":17,"context_line":"limitations under the License."},{"line_number":18,"context_line":"*/}}"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"{{- if .Values.manifests.configmap_etc }}"},{"line_number":21,"context_line":"{{- $envAll :\u003d . }}"},{"line_number":22,"context_line":"---"},{"line_number":23,"context_line":"apiVersion: v1"},{"line_number":24,"context_line":"kind: ConfigMap"},{"line_number":25,"context_line":"metadata:"},{"line_number":26,"context_line":"  name: falco"},{"line_number":27,"context_line":"data:"},{"line_number":28,"context_line":"  falco.yaml: |-"},{"line_number":29,"context_line":"{{ toYaml .Values.conf.config | indent 4 }}"},{"line_number":30,"context_line":"  falco_rules.yaml: |"},{"line_number":31,"context_line":"{{ .Values.conf.rules.falco_rules | indent 4 }}"},{"line_number":32,"context_line":"  falco_rules.local.yaml: |"},{"line_number":33,"context_line":"{{ .Values.conf.rules.falco_rules_local | indent 4 }}"},{"line_number":34,"context_line":"{{- end }}"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_9a4529b7","line":34,"range":{"start_line":20,"start_character":0,"end_line":34,"end_character":10},"updated":"2018-09-27 12:51:48.000000000","message":"Sorry I missed this earlier - we\u0027ve actually moved to handling configuration configmaps as secrets instead. Could we move this to do the same? ie: https://github.com/openstack/openstack-helm-infra/blob/master/prometheus/templates/configmap-etc.yaml#L39-L52","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"8ff29fc7fadf521afc1ea767fce761984a1f0eb2","unresolved":false,"context_lines":[{"line_number":17,"context_line":"limitations under the License."},{"line_number":18,"context_line":"*/}}"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"{{- if .Values.manifests.configmap_etc }}"},{"line_number":21,"context_line":"{{- $envAll :\u003d . }}"},{"line_number":22,"context_line":"---"},{"line_number":23,"context_line":"apiVersion: v1"},{"line_number":24,"context_line":"kind: ConfigMap"},{"line_number":25,"context_line":"metadata:"},{"line_number":26,"context_line":"  name: falco"},{"line_number":27,"context_line":"data:"},{"line_number":28,"context_line":"  falco.yaml: |-"},{"line_number":29,"context_line":"{{ toYaml .Values.conf.config | indent 4 }}"},{"line_number":30,"context_line":"  falco_rules.yaml: |"},{"line_number":31,"context_line":"{{ .Values.conf.rules.falco_rules | indent 4 }}"},{"line_number":32,"context_line":"  falco_rules.local.yaml: |"},{"line_number":33,"context_line":"{{ .Values.conf.rules.falco_rules_local | indent 4 }}"},{"line_number":34,"context_line":"{{- end }}"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_4ad2605d","line":34,"range":{"start_line":20,"start_character":0,"end_line":34,"end_character":10},"in_reply_to":"3f79a3b5_9a4529b7","updated":"2018-09-27 16:33:02.000000000","message":"Done","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"}],"falco/templates/configmap-rules.yaml":[{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"0f25ffb8c67e6ee96a596ddb21bfe09dca6318be","unresolved":false,"context_lines":[{"line_number":19,"context_line":"kind: ConfigMap"},{"line_number":20,"context_line":"metadata:"},{"line_number":21,"context_line":"  name: falco-rules"},{"line_number":22,"context_line":"  labels:"},{"line_number":23,"context_line":"    app: falco"},{"line_number":24,"context_line":"    chart: \"{{ .Chart.Name }}-{{ .Chart.Version }}\""},{"line_number":25,"context_line":"    release: \"{{ .Release.Name }}\""},{"line_number":26,"context_line":"    heritage: \"{{ .Release.Service }}\""},{"line_number":27,"context_line":"data:"},{"line_number":28,"context_line":"{{- range $file, $content :\u003d  .Values.conf.custom_rules }}"},{"line_number":29,"context_line":"  {{ $file }}: |-"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_2143d741","line":26,"range":{"start_line":22,"start_character":0,"end_line":26,"end_character":38},"updated":"2018-09-24 16:40:07.000000000","message":"not required","commit_id":"61f494fde4826f8e96ca5acb26378560645b24a7"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"4639e81020183569d1413a9664ae84e06febd5ba","unresolved":false,"context_lines":[{"line_number":19,"context_line":"kind: ConfigMap"},{"line_number":20,"context_line":"metadata:"},{"line_number":21,"context_line":"  name: falco-rules"},{"line_number":22,"context_line":"  labels:"},{"line_number":23,"context_line":"    app: falco"},{"line_number":24,"context_line":"    chart: \"{{ .Chart.Name }}-{{ .Chart.Version }}\""},{"line_number":25,"context_line":"    release: \"{{ .Release.Name }}\""},{"line_number":26,"context_line":"    heritage: \"{{ .Release.Service }}\""},{"line_number":27,"context_line":"data:"},{"line_number":28,"context_line":"{{- range $file, $content :\u003d  .Values.conf.custom_rules }}"},{"line_number":29,"context_line":"  {{ $file }}: |-"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_d24d0f72","line":26,"range":{"start_line":22,"start_character":0,"end_line":26,"end_character":38},"in_reply_to":"3f79a3b5_2143d741","updated":"2018-09-24 20:25:23.000000000","message":"Done","commit_id":"61f494fde4826f8e96ca5acb26378560645b24a7"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":14,"context_line":"limitations under the License."},{"line_number":15,"context_line":"*/}}"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"{{- if and .Values.conf.custom_rules .Values.manifests.custom_rules }}"},{"line_number":18,"context_line":"apiVersion: v1"},{"line_number":19,"context_line":"kind: ConfigMap"},{"line_number":20,"context_line":"metadata:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_f736cfb3","line":17,"range":{"start_line":17,"start_character":55,"end_line":17,"end_character":67},"updated":"2018-09-26 13:42:58.000000000","message":"This should be configmap_custom_rules to be consistent with how we name manifest objects","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":14,"context_line":"limitations under the License."},{"line_number":15,"context_line":"*/}}"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"{{- if and .Values.conf.custom_rules .Values.manifests.custom_rules }}"},{"line_number":18,"context_line":"apiVersion: v1"},{"line_number":19,"context_line":"kind: ConfigMap"},{"line_number":20,"context_line":"metadata:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_7233adf8","line":17,"range":{"start_line":17,"start_character":55,"end_line":17,"end_character":67},"in_reply_to":"3f79a3b5_f736cfb3","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"035cf888c7d91f0a3fdab3b34c1b04199dfcf2a5","unresolved":false,"context_lines":[{"line_number":14,"context_line":"limitations under the License."},{"line_number":15,"context_line":"*/}}"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"{{- if and .Values.conf.rules.custom_rules .Values.manifests.configmap_custom_rules }}"},{"line_number":18,"context_line":"apiVersion: v1"},{"line_number":19,"context_line":"kind: ConfigMap"},{"line_number":20,"context_line":"metadata:"},{"line_number":21,"context_line":"  name: falco-rules"},{"line_number":22,"context_line":"data:"},{"line_number":23,"context_line":"{{- range $file, $content :\u003d  .Values.conf.rules.custom_rules }}"},{"line_number":24,"context_line":"  {{ $file }}: |-"},{"line_number":25,"context_line":"{{ $content | indent 4}}"},{"line_number":26,"context_line":"{{- end }}"},{"line_number":27,"context_line":"{{- end }}"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_5a11d1ae","line":27,"range":{"start_line":17,"start_character":0,"end_line":27,"end_character":10},"updated":"2018-09-27 12:51:48.000000000","message":"Same here","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"8ff29fc7fadf521afc1ea767fce761984a1f0eb2","unresolved":false,"context_lines":[{"line_number":14,"context_line":"limitations under the License."},{"line_number":15,"context_line":"*/}}"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"{{- if and .Values.conf.rules.custom_rules .Values.manifests.configmap_custom_rules }}"},{"line_number":18,"context_line":"apiVersion: v1"},{"line_number":19,"context_line":"kind: ConfigMap"},{"line_number":20,"context_line":"metadata:"},{"line_number":21,"context_line":"  name: falco-rules"},{"line_number":22,"context_line":"data:"},{"line_number":23,"context_line":"{{- range $file, $content :\u003d  .Values.conf.rules.custom_rules }}"},{"line_number":24,"context_line":"  {{ $file }}: |-"},{"line_number":25,"context_line":"{{ $content | indent 4}}"},{"line_number":26,"context_line":"{{- end }}"},{"line_number":27,"context_line":"{{- end }}"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_2ada841c","line":27,"range":{"start_line":17,"start_character":0,"end_line":27,"end_character":10},"in_reply_to":"3f79a3b5_5a11d1ae","updated":"2018-09-27 16:33:02.000000000","message":"Done","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"}],"falco/templates/configmap.yaml":[{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"0f25ffb8c67e6ee96a596ddb21bfe09dca6318be","unresolved":false,"context_lines":[{"line_number":28,"context_line":"      - {{ . }}"},{"line_number":29,"context_line":"      {{- end }}"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    json_output: {{ .Values.conf.json_output }}"},{"line_number":32,"context_line":"    json_include_output_property: {{ .Values.conf.json_include_output_property }}"},{"line_number":33,"context_line":"    log_stderr: {{ .Values.conf.log_stderr }}"},{"line_number":34,"context_line":"    log_syslog: {{ .Values.conf.log_syslog }}"},{"line_number":35,"context_line":"    log_level: {{ .Values.conf.log_level }}"},{"line_number":36,"context_line":"    priority: {{ .Values.conf.priority }}"},{"line_number":37,"context_line":"    buffered_outputs: {{ .Values.conf.buffered_outputs }}"},{"line_number":38,"context_line":"    outputs:"},{"line_number":39,"context_line":"      rate: {{ .Values.conf.outputs.rate }}"},{"line_number":40,"context_line":"      max_burst: {{ .Values.conf.outputs.max_burst }}"},{"line_number":41,"context_line":"    syslog_output:"},{"line_number":42,"context_line":"      enabled: {{ .Values.conf.syslog_output.enabled }}"},{"line_number":43,"context_line":"    file_output:"},{"line_number":44,"context_line":"      enabled: {{ .Values.conf.file_output.enabled }}"},{"line_number":45,"context_line":"      keep_alive: {{ .Values.conf.file_output.keep_alive }}"},{"line_number":46,"context_line":"      filename: {{ .Values.conf.file_output.filename }}"},{"line_number":47,"context_line":"    stdout_output:"},{"line_number":48,"context_line":"      enabled: {{ .Values.conf.stdout_output.enabled }}"},{"line_number":49,"context_line":"    program_output:"},{"line_number":50,"context_line":"      enabled: {{ .Values.conf.program_output.enabled }}"},{"line_number":51,"context_line":"      keep_alive: {{ .Values.conf.program_output.keep_alive }}"},{"line_number":52,"context_line":"      program: {{ .Values.conf.program_output.program }}"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"  falco_rules.yaml: |"},{"line_number":55,"context_line":"{{ .Values.conf.falco_rules | indent 4 }}"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_015fbb0f","line":52,"range":{"start_line":31,"start_character":0,"end_line":52,"end_character":56},"updated":"2018-09-24 16:40:07.000000000","message":"could we just use toyaml here, though this can follow on","commit_id":"61f494fde4826f8e96ca5acb26378560645b24a7"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"4639e81020183569d1413a9664ae84e06febd5ba","unresolved":false,"context_lines":[{"line_number":28,"context_line":"      - {{ . }}"},{"line_number":29,"context_line":"      {{- end }}"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    json_output: {{ .Values.conf.json_output }}"},{"line_number":32,"context_line":"    json_include_output_property: {{ .Values.conf.json_include_output_property }}"},{"line_number":33,"context_line":"    log_stderr: {{ .Values.conf.log_stderr }}"},{"line_number":34,"context_line":"    log_syslog: {{ .Values.conf.log_syslog }}"},{"line_number":35,"context_line":"    log_level: {{ .Values.conf.log_level }}"},{"line_number":36,"context_line":"    priority: {{ .Values.conf.priority }}"},{"line_number":37,"context_line":"    buffered_outputs: {{ .Values.conf.buffered_outputs }}"},{"line_number":38,"context_line":"    outputs:"},{"line_number":39,"context_line":"      rate: {{ .Values.conf.outputs.rate }}"},{"line_number":40,"context_line":"      max_burst: {{ .Values.conf.outputs.max_burst }}"},{"line_number":41,"context_line":"    syslog_output:"},{"line_number":42,"context_line":"      enabled: {{ .Values.conf.syslog_output.enabled }}"},{"line_number":43,"context_line":"    file_output:"},{"line_number":44,"context_line":"      enabled: {{ .Values.conf.file_output.enabled }}"},{"line_number":45,"context_line":"      keep_alive: {{ .Values.conf.file_output.keep_alive }}"},{"line_number":46,"context_line":"      filename: {{ .Values.conf.file_output.filename }}"},{"line_number":47,"context_line":"    stdout_output:"},{"line_number":48,"context_line":"      enabled: {{ .Values.conf.stdout_output.enabled }}"},{"line_number":49,"context_line":"    program_output:"},{"line_number":50,"context_line":"      enabled: {{ .Values.conf.program_output.enabled }}"},{"line_number":51,"context_line":"      keep_alive: {{ .Values.conf.program_output.keep_alive }}"},{"line_number":52,"context_line":"      program: {{ .Values.conf.program_output.program }}"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"  falco_rules.yaml: |"},{"line_number":55,"context_line":"{{ .Values.conf.falco_rules | indent 4 }}"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_b8add585","line":52,"range":{"start_line":31,"start_character":0,"end_line":52,"end_character":56},"in_reply_to":"3f79a3b5_015fbb0f","updated":"2018-09-24 20:25:23.000000000","message":"Done","commit_id":"61f494fde4826f8e96ca5acb26378560645b24a7"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_374c473e","line":1,"range":{"start_line":1,"start_character":0,"end_line":1,"end_character":4},"updated":"2018-09-26 13:42:58.000000000","message":"This template should be named configmap-etc","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_72a64d10","line":1,"range":{"start_line":1,"start_character":0,"end_line":1,"end_character":4},"in_reply_to":"3f79a3b5_374c473e","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":14,"context_line":"limitations under the License."},{"line_number":15,"context_line":"*/}}"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"{{- if .Values.manifests.configmap }}"},{"line_number":18,"context_line":"{{- $envAll :\u003d . }}"},{"line_number":19,"context_line":"---"},{"line_number":20,"context_line":"apiVersion: v1"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_d75cf3f1","line":17,"range":{"start_line":17,"start_character":25,"end_line":17,"end_character":34},"updated":"2018-09-26 13:42:58.000000000","message":"configmap_etc","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":14,"context_line":"limitations under the License."},{"line_number":15,"context_line":"*/}}"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"{{- if .Values.manifests.configmap }}"},{"line_number":18,"context_line":"{{- $envAll :\u003d . }}"},{"line_number":19,"context_line":"---"},{"line_number":20,"context_line":"apiVersion: v1"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_d280814c","line":17,"range":{"start_line":17,"start_character":25,"end_line":17,"end_character":34},"in_reply_to":"3f79a3b5_d75cf3f1","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"}],"falco/templates/daemonset.yaml":[{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"62aa5e38c1fb97be2bba1f92f40985840eb49f4a","unresolved":false,"context_lines":[{"line_number":34,"context_line":"      labels:"},{"line_number":35,"context_line":"{{ tuple $envAll \"falco\" \"falco-agent\" | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 8 }}"},{"line_number":36,"context_line":"    spec:"},{"line_number":37,"context_line":"      serviceAccountName: {{ .Values.serviceAccountName }}"},{"line_number":38,"context_line":"      tolerations:"},{"line_number":39,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":40,"context_line":"      containers:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_03cc1187","line":37,"range":{"start_line":37,"start_character":6,"end_line":37,"end_character":58},"updated":"2018-09-05 15:13:05.000000000","message":"can we specify this in the same way as other charts.","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"d6de112dda745c88c8b730231f5bacb0aa5fa068","unresolved":false,"context_lines":[{"line_number":34,"context_line":"      labels:"},{"line_number":35,"context_line":"{{ tuple $envAll \"falco\" \"falco-agent\" | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 8 }}"},{"line_number":36,"context_line":"    spec:"},{"line_number":37,"context_line":"      serviceAccountName: {{ .Values.serviceAccountName }}"},{"line_number":38,"context_line":"      tolerations:"},{"line_number":39,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":40,"context_line":"      containers:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_89a59b05","line":37,"range":{"start_line":37,"start_character":6,"end_line":37,"end_character":58},"in_reply_to":"3f79a3b5_03cc1187","updated":"2018-09-05 20:35:45.000000000","message":"Done","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"80c3dd7da578b87a40feaef9c7ebe97adcb5769e","unresolved":false,"context_lines":[{"line_number":39,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":40,"context_line":"      containers:"},{"line_number":41,"context_line":"        - name: {{ .Chart.Name }}"},{"line_number":42,"context_line":"          image: \"{{ .Values.images.repository }}:{{ .Values.images.tag }}\""},{"line_number":43,"context_line":"          imagePullPolicy: {{ .Values.images.pullPolicy }}"},{"line_number":44,"context_line":"          resources:"},{"line_number":45,"context_line":"{{ toYaml .Values.resources | indent 12 }}"},{"line_number":46,"context_line":"          securityContext:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_83d7c123","line":43,"range":{"start_line":42,"start_character":0,"end_line":43,"end_character":58},"updated":"2018-09-05 15:11:01.000000000","message":"this should be done in the same manner as other charts.","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"d6de112dda745c88c8b730231f5bacb0aa5fa068","unresolved":false,"context_lines":[{"line_number":39,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":40,"context_line":"      containers:"},{"line_number":41,"context_line":"        - name: {{ .Chart.Name }}"},{"line_number":42,"context_line":"          image: \"{{ .Values.images.repository }}:{{ .Values.images.tag }}\""},{"line_number":43,"context_line":"          imagePullPolicy: {{ .Values.images.pullPolicy }}"},{"line_number":44,"context_line":"          resources:"},{"line_number":45,"context_line":"{{ toYaml .Values.resources | indent 12 }}"},{"line_number":46,"context_line":"          securityContext:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_29aec7e6","line":43,"range":{"start_line":42,"start_character":0,"end_line":43,"end_character":58},"in_reply_to":"3f79a3b5_83d7c123","updated":"2018-09-05 20:35:45.000000000","message":"Done","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"0f25ffb8c67e6ee96a596ddb21bfe09dca6318be","unresolved":false,"context_lines":[{"line_number":85,"context_line":"{{ tuple $envAll $envAll.Values.pod.resources.falco | include \"helm-toolkit.snippets.kubernetes_resources\" | indent 10 }}"},{"line_number":86,"context_line":"          securityContext:"},{"line_number":87,"context_line":"            privileged: true"},{"line_number":88,"context_line":"          args: [ \"/usr/bin/falco\", \"-K\", \"/var/run/secrets/kubernetes.io/serviceaccount/token\", \"-k\", \"https://kubernetes.default\", \"-pk\"]"},{"line_number":89,"context_line":"          volumeMounts:"},{"line_number":90,"context_line":"            - mountPath: /host/var/run/docker.sock"},{"line_number":91,"context_line":"              name: docker-socket"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_a1a5a705","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":139},"updated":"2018-09-24 16:40:07.000000000","message":"can you move this to a script as with other charts?","commit_id":"61f494fde4826f8e96ca5acb26378560645b24a7"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"4639e81020183569d1413a9664ae84e06febd5ba","unresolved":false,"context_lines":[{"line_number":85,"context_line":"{{ tuple $envAll $envAll.Values.pod.resources.falco | include \"helm-toolkit.snippets.kubernetes_resources\" | indent 10 }}"},{"line_number":86,"context_line":"          securityContext:"},{"line_number":87,"context_line":"            privileged: true"},{"line_number":88,"context_line":"          args: [ \"/usr/bin/falco\", \"-K\", \"/var/run/secrets/kubernetes.io/serviceaccount/token\", \"-k\", \"https://kubernetes.default\", \"-pk\"]"},{"line_number":89,"context_line":"          volumeMounts:"},{"line_number":90,"context_line":"            - mountPath: /host/var/run/docker.sock"},{"line_number":91,"context_line":"              name: docker-socket"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_989b3963","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":139},"in_reply_to":"3f79a3b5_a1a5a705","updated":"2018-09-24 20:25:23.000000000","message":"Done","commit_id":"61f494fde4826f8e96ca5acb26378560645b24a7"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"0f25ffb8c67e6ee96a596ddb21bfe09dca6318be","unresolved":false,"context_lines":[{"line_number":87,"context_line":"            privileged: true"},{"line_number":88,"context_line":"          args: [ \"/usr/bin/falco\", \"-K\", \"/var/run/secrets/kubernetes.io/serviceaccount/token\", \"-k\", \"https://kubernetes.default\", \"-pk\"]"},{"line_number":89,"context_line":"          volumeMounts:"},{"line_number":90,"context_line":"            - mountPath: /host/var/run/docker.sock"},{"line_number":91,"context_line":"              name: docker-socket"},{"line_number":92,"context_line":"            - mountPath: /host/dev"},{"line_number":93,"context_line":"              name: dev-fs"},{"line_number":94,"context_line":"            - mountPath: /host/proc"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_61a78f0b","line":91,"range":{"start_line":90,"start_character":0,"end_line":91,"end_character":33},"updated":"2018-09-24 16:40:07.000000000","message":"do we need this.","commit_id":"61f494fde4826f8e96ca5acb26378560645b24a7"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"4639e81020183569d1413a9664ae84e06febd5ba","unresolved":false,"context_lines":[{"line_number":87,"context_line":"            privileged: true"},{"line_number":88,"context_line":"          args: [ \"/usr/bin/falco\", \"-K\", \"/var/run/secrets/kubernetes.io/serviceaccount/token\", \"-k\", \"https://kubernetes.default\", \"-pk\"]"},{"line_number":89,"context_line":"          volumeMounts:"},{"line_number":90,"context_line":"            - mountPath: /host/var/run/docker.sock"},{"line_number":91,"context_line":"              name: docker-socket"},{"line_number":92,"context_line":"            - mountPath: /host/dev"},{"line_number":93,"context_line":"              name: dev-fs"},{"line_number":94,"context_line":"            - mountPath: /host/proc"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_d2f0af69","line":91,"range":{"start_line":90,"start_character":0,"end_line":91,"end_character":33},"in_reply_to":"3f79a3b5_61a78f0b","updated":"2018-09-24 20:25:23.000000000","message":"No. Removed.","commit_id":"61f494fde4826f8e96ca5acb26378560645b24a7"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":14,"context_line":"limitations under the License."},{"line_number":15,"context_line":"*/}}"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"{{- if .Values.manifests.deployment_falco }}"},{"line_number":18,"context_line":"{{- $envAll :\u003d . }}"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"{{- $daemonset :\u003d \"falco-agent\" }}"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_5770e373","line":17,"range":{"start_line":17,"start_character":25,"end_line":17,"end_character":41},"updated":"2018-09-26 13:42:58.000000000","message":"daemonset","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":14,"context_line":"limitations under the License."},{"line_number":15,"context_line":"*/}}"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"{{- if .Values.manifests.deployment_falco }}"},{"line_number":18,"context_line":"{{- $envAll :\u003d . }}"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"{{- $daemonset :\u003d \"falco-agent\" }}"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_128ef978","line":17,"range":{"start_line":17,"start_character":25,"end_line":17,"end_character":41},"in_reply_to":"3f79a3b5_5770e373","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":17,"context_line":"{{- if .Values.manifests.deployment_falco }}"},{"line_number":18,"context_line":"{{- $envAll :\u003d . }}"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"{{- $daemonset :\u003d \"falco-agent\" }}"},{"line_number":21,"context_line":"{{- $serviceAccountName :\u003d \"falcon-service\" }}"},{"line_number":22,"context_line":"{{ tuple $envAll .Chart.Name $serviceAccountName | include \"helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount\" }}"},{"line_number":23,"context_line":"---"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_b70e17e2","line":20,"range":{"start_line":20,"start_character":0,"end_line":20,"end_character":34},"updated":"2018-09-26 13:42:58.000000000","message":"Why can\u0027t the naming across the template be handled like other charts? ie: Instead of referencing $daemonset throughout the chart, why not just use \u0027falco-agent\u0027?","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":17,"context_line":"{{- if .Values.manifests.deployment_falco }}"},{"line_number":18,"context_line":"{{- $envAll :\u003d . }}"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"{{- $daemonset :\u003d \"falco-agent\" }}"},{"line_number":21,"context_line":"{{- $serviceAccountName :\u003d \"falcon-service\" }}"},{"line_number":22,"context_line":"{{ tuple $envAll .Chart.Name $serviceAccountName | include \"helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount\" }}"},{"line_number":23,"context_line":"---"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_1defe51d","line":20,"range":{"start_line":20,"start_character":0,"end_line":20,"end_character":34},"in_reply_to":"3f79a3b5_b70e17e2","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"{{- $daemonset :\u003d \"falco-agent\" }}"},{"line_number":21,"context_line":"{{- $serviceAccountName :\u003d \"falcon-service\" }}"},{"line_number":22,"context_line":"{{ tuple $envAll .Chart.Name $serviceAccountName | include \"helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount\" }}"},{"line_number":23,"context_line":"---"},{"line_number":24,"context_line":"apiVersion: rbac.authorization.k8s.io/v1beta1"},{"line_number":25,"context_line":"kind: ClusterRole"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_77f07fdb","line":22,"range":{"start_line":22,"start_character":17,"end_line":22,"end_character":28},"updated":"2018-09-26 13:42:58.000000000","message":"Can we just use \u0027falco\u0027 here?","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"{{- $daemonset :\u003d \"falco-agent\" }}"},{"line_number":21,"context_line":"{{- $serviceAccountName :\u003d \"falcon-service\" }}"},{"line_number":22,"context_line":"{{ tuple $envAll .Chart.Name $serviceAccountName | include \"helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount\" }}"},{"line_number":23,"context_line":"---"},{"line_number":24,"context_line":"apiVersion: rbac.authorization.k8s.io/v1beta1"},{"line_number":25,"context_line":"kind: ClusterRole"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_92244962","line":22,"range":{"start_line":22,"start_character":17,"end_line":22,"end_character":28},"in_reply_to":"3f79a3b5_77f07fdb","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":65,"context_line":"metadata:"},{"line_number":66,"context_line":"  name: falco-agent"},{"line_number":67,"context_line":"  labels:"},{"line_number":68,"context_line":"{{ tuple $envAll .Chart.Name $daemonset | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 4 }}"},{"line_number":69,"context_line":"spec:"},{"line_number":70,"context_line":"  selector:"},{"line_number":71,"context_line":"    matchLabels:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_17ffcbab","line":68,"range":{"start_line":68,"start_character":17,"end_line":68,"end_character":39},"updated":"2018-09-26 13:42:58.000000000","message":"Same here","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":65,"context_line":"metadata:"},{"line_number":66,"context_line":"  name: falco-agent"},{"line_number":67,"context_line":"  labels:"},{"line_number":68,"context_line":"{{ tuple $envAll .Chart.Name $daemonset | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 4 }}"},{"line_number":69,"context_line":"spec:"},{"line_number":70,"context_line":"  selector:"},{"line_number":71,"context_line":"    matchLabels:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_52cc7189","line":68,"range":{"start_line":68,"start_character":17,"end_line":68,"end_character":39},"in_reply_to":"3f79a3b5_17ffcbab","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":69,"context_line":"spec:"},{"line_number":70,"context_line":"  selector:"},{"line_number":71,"context_line":"    matchLabels:"},{"line_number":72,"context_line":"{{ tuple $envAll .Chart.Name $daemonset | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 6 }}"},{"line_number":73,"context_line":"{{ tuple $envAll \"falco\" | include \"helm-toolkit.snippets.kubernetes_upgrades_daemonset\" | indent 2 }}"},{"line_number":74,"context_line":"  template:"},{"line_number":75,"context_line":"    metadata:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_37fa07ba","line":72,"range":{"start_line":72,"start_character":17,"end_line":72,"end_character":39},"updated":"2018-09-26 13:42:58.000000000","message":"Same here","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":69,"context_line":"spec:"},{"line_number":70,"context_line":"  selector:"},{"line_number":71,"context_line":"    matchLabels:"},{"line_number":72,"context_line":"{{ tuple $envAll .Chart.Name $daemonset | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 6 }}"},{"line_number":73,"context_line":"{{ tuple $envAll \"falco\" | include \"helm-toolkit.snippets.kubernetes_upgrades_daemonset\" | indent 2 }}"},{"line_number":74,"context_line":"  template:"},{"line_number":75,"context_line":"    metadata:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_12c6f969","line":72,"range":{"start_line":72,"start_character":17,"end_line":72,"end_character":39},"in_reply_to":"3f79a3b5_37fa07ba","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":74,"context_line":"  template:"},{"line_number":75,"context_line":"    metadata:"},{"line_number":76,"context_line":"      labels:"},{"line_number":77,"context_line":"{{ tuple $envAll .Chart.Name $daemonset | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 8 }}"},{"line_number":78,"context_line":"    spec:"},{"line_number":79,"context_line":"      serviceAccountName: {{ $serviceAccountName }}"},{"line_number":80,"context_line":"      tolerations:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_f72d6f45","line":77,"range":{"start_line":77,"start_character":17,"end_line":77,"end_character":39},"updated":"2018-09-26 13:42:58.000000000","message":"Same here","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":74,"context_line":"  template:"},{"line_number":75,"context_line":"    metadata:"},{"line_number":76,"context_line":"      labels:"},{"line_number":77,"context_line":"{{ tuple $envAll .Chart.Name $daemonset | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 8 }}"},{"line_number":78,"context_line":"    spec:"},{"line_number":79,"context_line":"      serviceAccountName: {{ $serviceAccountName }}"},{"line_number":80,"context_line":"      tolerations:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_32c1b54f","line":77,"range":{"start_line":77,"start_character":17,"end_line":77,"end_character":39},"in_reply_to":"3f79a3b5_f72d6f45","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":77,"context_line":"{{ tuple $envAll .Chart.Name $daemonset | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 8 }}"},{"line_number":78,"context_line":"    spec:"},{"line_number":79,"context_line":"      serviceAccountName: {{ $serviceAccountName }}"},{"line_number":80,"context_line":"      tolerations:"},{"line_number":81,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":82,"context_line":"      containers:"},{"line_number":83,"context_line":"        - name: {{ .Chart.Name }}"},{"line_number":84,"context_line":"{{ tuple $envAll \"falco_img\" | include \"helm-toolkit.snippets.image\" | indent 10 }}"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_77195f21","line":81,"range":{"start_line":80,"start_character":0,"end_line":81,"end_character":43},"updated":"2018-09-26 13:42:58.000000000","message":"We have a helm-toolkit function for tolerations now: https://github.com/openstack/openstack-helm-infra/blob/master/helm-toolkit/templates/snippets/_kubernetes_tolerations.tpl","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":77,"context_line":"{{ tuple $envAll .Chart.Name $daemonset | include \"helm-toolkit.snippets.kubernetes_metadata_labels\" | indent 8 }}"},{"line_number":78,"context_line":"    spec:"},{"line_number":79,"context_line":"      serviceAccountName: {{ $serviceAccountName }}"},{"line_number":80,"context_line":"      tolerations:"},{"line_number":81,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":82,"context_line":"      containers:"},{"line_number":83,"context_line":"        - name: {{ .Chart.Name }}"},{"line_number":84,"context_line":"{{ tuple $envAll \"falco_img\" | include \"helm-toolkit.snippets.image\" | indent 10 }}"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_4d7a9625","line":81,"range":{"start_line":80,"start_character":0,"end_line":81,"end_character":43},"in_reply_to":"3f79a3b5_77195f21","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":80,"context_line":"      tolerations:"},{"line_number":81,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":82,"context_line":"      containers:"},{"line_number":83,"context_line":"        - name: {{ .Chart.Name }}"},{"line_number":84,"context_line":"{{ tuple $envAll \"falco_img\" | include \"helm-toolkit.snippets.image\" | indent 10 }}"},{"line_number":85,"context_line":"{{ tuple $envAll $envAll.Values.pod.resources.falco | include \"helm-toolkit.snippets.kubernetes_resources\" | indent 10 }}"},{"line_number":86,"context_line":"          securityContext:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_f7d24f33","line":83,"range":{"start_line":83,"start_character":16,"end_line":83,"end_character":33},"updated":"2018-09-26 13:42:58.000000000","message":"Why cant this just be \u0027falco\u0027?","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":80,"context_line":"      tolerations:"},{"line_number":81,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":82,"context_line":"      containers:"},{"line_number":83,"context_line":"        - name: {{ .Chart.Name }}"},{"line_number":84,"context_line":"{{ tuple $envAll \"falco_img\" | include \"helm-toolkit.snippets.image\" | indent 10 }}"},{"line_number":85,"context_line":"{{ tuple $envAll $envAll.Values.pod.resources.falco | include \"helm-toolkit.snippets.kubernetes_resources\" | indent 10 }}"},{"line_number":86,"context_line":"          securityContext:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_6d751233","line":83,"range":{"start_line":83,"start_character":16,"end_line":83,"end_character":33},"in_reply_to":"3f79a3b5_f7d24f33","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":81,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":82,"context_line":"      containers:"},{"line_number":83,"context_line":"        - name: {{ .Chart.Name }}"},{"line_number":84,"context_line":"{{ tuple $envAll \"falco_img\" | include \"helm-toolkit.snippets.image\" | indent 10 }}"},{"line_number":85,"context_line":"{{ tuple $envAll $envAll.Values.pod.resources.falco | include \"helm-toolkit.snippets.kubernetes_resources\" | indent 10 }}"},{"line_number":86,"context_line":"          securityContext:"},{"line_number":87,"context_line":"            privileged: true"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_b7dcd745","line":84,"range":{"start_line":84,"start_character":18,"end_line":84,"end_character":27},"updated":"2018-09-26 13:42:58.000000000","message":"Can just be falco","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":81,"context_line":"{{ toYaml .Values.tolerations | indent 8 }}"},{"line_number":82,"context_line":"      containers:"},{"line_number":83,"context_line":"        - name: {{ .Chart.Name }}"},{"line_number":84,"context_line":"{{ tuple $envAll \"falco_img\" | include \"helm-toolkit.snippets.image\" | indent 10 }}"},{"line_number":85,"context_line":"{{ tuple $envAll $envAll.Values.pod.resources.falco | include \"helm-toolkit.snippets.kubernetes_resources\" | indent 10 }}"},{"line_number":86,"context_line":"          securityContext:"},{"line_number":87,"context_line":"            privileged: true"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_0d749e35","line":84,"range":{"start_line":84,"start_character":18,"end_line":84,"end_character":27},"in_reply_to":"3f79a3b5_b7dcd745","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":135,"context_line":"        - name: usr-fs"},{"line_number":136,"context_line":"          hostPath:"},{"line_number":137,"context_line":"            path: /usr"},{"line_number":138,"context_line":"        - name: config-volume"},{"line_number":139,"context_line":"          configMap:"},{"line_number":140,"context_line":"            name: falco"},{"line_number":141,"context_line":"            items:"},{"line_number":142,"context_line":"              - key: falco.yaml"},{"line_number":143,"context_line":"                path: falco.yaml"},{"line_number":144,"context_line":"              - key: falco_rules.yaml"},{"line_number":145,"context_line":"                path: falco_rules.yaml"},{"line_number":146,"context_line":"              - key: falco_rules.local.yaml"},{"line_number":147,"context_line":"                path: falco_rules.local.yaml"},{"line_number":148,"context_line":"        {{- if .Values.conf.custom_rules }}"},{"line_number":149,"context_line":"        - name: rules-volume"},{"line_number":150,"context_line":"          configMap:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_37e8c7dd","line":147,"range":{"start_line":138,"start_character":0,"end_line":147,"end_character":44},"updated":"2018-09-26 13:42:58.000000000","message":"We should be consistent and handle this like other volumes","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":135,"context_line":"        - name: usr-fs"},{"line_number":136,"context_line":"          hostPath:"},{"line_number":137,"context_line":"            path: /usr"},{"line_number":138,"context_line":"        - name: config-volume"},{"line_number":139,"context_line":"          configMap:"},{"line_number":140,"context_line":"            name: falco"},{"line_number":141,"context_line":"            items:"},{"line_number":142,"context_line":"              - key: falco.yaml"},{"line_number":143,"context_line":"                path: falco.yaml"},{"line_number":144,"context_line":"              - key: falco_rules.yaml"},{"line_number":145,"context_line":"                path: falco_rules.yaml"},{"line_number":146,"context_line":"              - key: falco_rules.local.yaml"},{"line_number":147,"context_line":"                path: falco_rules.local.yaml"},{"line_number":148,"context_line":"        {{- if .Values.conf.custom_rules }}"},{"line_number":149,"context_line":"        - name: rules-volume"},{"line_number":150,"context_line":"          configMap:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_9d4bf5af","line":147,"range":{"start_line":138,"start_character":0,"end_line":147,"end_character":44},"in_reply_to":"3f79a3b5_37e8c7dd","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"035cf888c7d91f0a3fdab3b34c1b04199dfcf2a5","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        - name: usr-fs"},{"line_number":134,"context_line":"          hostPath:"},{"line_number":135,"context_line":"            path: /usr"},{"line_number":136,"context_line":"        - name: config-volume"},{"line_number":137,"context_line":"          configMap:"},{"line_number":138,"context_line":"            name: falco"},{"line_number":139,"context_line":"        {{- if .Values.conf.rules.custom_rules }}"},{"line_number":140,"context_line":"        - name: rules-volume"},{"line_number":141,"context_line":"          configMap:"},{"line_number":142,"context_line":"            name: {{ template \"falco.fullname\" . }}-rules"},{"line_number":143,"context_line":"        {{- end }}"},{"line_number":144,"context_line":"{{- end }}"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_fa1f7db5","line":143,"range":{"start_line":136,"start_character":0,"end_line":143,"end_character":18},"updated":"2018-09-27 12:51:48.000000000","message":"With the move to secrets, these will change slightly. ie: https://github.com/openstack/openstack-helm-infra/blob/master/prometheus/templates/statefulset.yaml#L193-L196","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"8ff29fc7fadf521afc1ea767fce761984a1f0eb2","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        - name: usr-fs"},{"line_number":134,"context_line":"          hostPath:"},{"line_number":135,"context_line":"            path: /usr"},{"line_number":136,"context_line":"        - name: config-volume"},{"line_number":137,"context_line":"          configMap:"},{"line_number":138,"context_line":"            name: falco"},{"line_number":139,"context_line":"        {{- if .Values.conf.rules.custom_rules }}"},{"line_number":140,"context_line":"        - name: rules-volume"},{"line_number":141,"context_line":"          configMap:"},{"line_number":142,"context_line":"            name: {{ template \"falco.fullname\" . }}-rules"},{"line_number":143,"context_line":"        {{- end }}"},{"line_number":144,"context_line":"{{- end }}"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_4add8011","line":143,"range":{"start_line":136,"start_character":0,"end_line":143,"end_character":18},"in_reply_to":"3f79a3b5_fa1f7db5","updated":"2018-09-27 16:33:02.000000000","message":"Done","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"}],"falco/values.yaml":[{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"80c3dd7da578b87a40feaef9c7ebe97adcb5769e","unresolved":false,"context_lines":[{"line_number":13,"context_line":"# limitations under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"images:"},{"line_number":16,"context_line":"  repository: sysdig/falco"},{"line_number":17,"context_line":"  tag: latest"},{"line_number":18,"context_line":"  pullPolicy: Always"},{"line_number":19,"context_line":"  local_registry:"},{"line_number":20,"context_line":"    active: false"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_a3167df1","line":17,"range":{"start_line":16,"start_character":0,"end_line":17,"end_character":13},"updated":"2018-09-05 15:11:01.000000000","message":"this should be done in the same fashion as other charts.","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"d6de112dda745c88c8b730231f5bacb0aa5fa068","unresolved":false,"context_lines":[{"line_number":13,"context_line":"# limitations under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"images:"},{"line_number":16,"context_line":"  repository: sysdig/falco"},{"line_number":17,"context_line":"  tag: latest"},{"line_number":18,"context_line":"  pullPolicy: Always"},{"line_number":19,"context_line":"  local_registry:"},{"line_number":20,"context_line":"    active: false"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_49ab03d5","line":17,"range":{"start_line":16,"start_character":0,"end_line":17,"end_character":13},"in_reply_to":"3f79a3b5_a3167df1","updated":"2018-09-05 20:35:45.000000000","message":"Done","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"2509a8ffe2a04fbaa566ac61de6d422b02737a46","unresolved":false,"context_lines":[{"line_number":22,"context_line":"      - dep_check"},{"line_number":23,"context_line":"      - image_repo_sync"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"resources: {}"},{"line_number":26,"context_line":"  # limits:"},{"line_number":27,"context_line":"  #   cpu: 30m"},{"line_number":28,"context_line":"  #   memory: 128Mi"},{"line_number":29,"context_line":"  # requests:"},{"line_number":30,"context_line":"  #   cpu: 20m"},{"line_number":31,"context_line":"  #   memory: 128Mi"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"serviceAccountName: \"falcon-service\""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_c396194a","line":31,"range":{"start_line":25,"start_character":0,"end_line":31,"end_character":19},"updated":"2018-09-05 15:13:46.000000000","message":"can we specify this in the same way as other charts.","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"d6de112dda745c88c8b730231f5bacb0aa5fa068","unresolved":false,"context_lines":[{"line_number":22,"context_line":"      - dep_check"},{"line_number":23,"context_line":"      - image_repo_sync"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"resources: {}"},{"line_number":26,"context_line":"  # limits:"},{"line_number":27,"context_line":"  #   cpu: 30m"},{"line_number":28,"context_line":"  #   memory: 128Mi"},{"line_number":29,"context_line":"  # requests:"},{"line_number":30,"context_line":"  #   cpu: 20m"},{"line_number":31,"context_line":"  #   memory: 128Mi"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"serviceAccountName: \"falcon-service\""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_09b18b44","line":31,"range":{"start_line":25,"start_character":0,"end_line":31,"end_character":19},"in_reply_to":"3f79a3b5_c396194a","updated":"2018-09-05 20:35:45.000000000","message":"Done","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"0f1a290af193028bf10f270b829f0479ba3fda1f","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"serviceAccountName: \"falcon-service\""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"daemonset: {}"},{"line_number":36,"context_line":"  # Allow the DaemonSet to perform a rolling update on helm update"},{"line_number":37,"context_line":"  # ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/"},{"line_number":38,"context_line":"  # If you do want to specify resources, uncomment the following lines, adjust"},{"line_number":39,"context_line":"  # them as necessary, and remove the curly braces after \u0027resources:\u0027."},{"line_number":40,"context_line":"  # updateStrategy: RollingUpdate"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"falco:"},{"line_number":43,"context_line":"  # The location of the rules file(s). This can contain one or more paths to"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_a3c0bd2c","line":40,"range":{"start_line":35,"start_character":0,"end_line":40,"end_character":33},"updated":"2018-09-05 15:16:46.000000000","message":"this can be controlled similarly to: https://github.com/openstack/openstack-helm/blob/master/libvirt/values.yaml#L92-L99","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"d6de112dda745c88c8b730231f5bacb0aa5fa068","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"serviceAccountName: \"falcon-service\""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"daemonset: {}"},{"line_number":36,"context_line":"  # Allow the DaemonSet to perform a rolling update on helm update"},{"line_number":37,"context_line":"  # ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/"},{"line_number":38,"context_line":"  # If you do want to specify resources, uncomment the following lines, adjust"},{"line_number":39,"context_line":"  # them as necessary, and remove the curly braces after \u0027resources:\u0027."},{"line_number":40,"context_line":"  # updateStrategy: RollingUpdate"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"falco:"},{"line_number":43,"context_line":"  # The location of the rules file(s). This can contain one or more paths to"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_69791f80","line":40,"range":{"start_line":35,"start_character":0,"end_line":40,"end_character":33},"in_reply_to":"3f79a3b5_a3c0bd2c","updated":"2018-09-05 20:35:45.000000000","message":"Done","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"94a33f2ef358f5a3d80bf5abe57f3564b5885fdd","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  # them as necessary, and remove the curly braces after \u0027resources:\u0027."},{"line_number":40,"context_line":"  # updateStrategy: RollingUpdate"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"falco:"},{"line_number":43,"context_line":"  # The location of the rules file(s). This can contain one or more paths to"},{"line_number":44,"context_line":"  # separate rules files."},{"line_number":45,"context_line":"  rulesFile:"},{"line_number":46,"context_line":"    - /etc/falco/falco_rules.yaml"},{"line_number":47,"context_line":"    - /etc/falco/falco_rules.local.yaml"},{"line_number":48,"context_line":"    - /etc/falco/rules.d"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"  # Whether to output events in json or text"},{"line_number":51,"context_line":"  jsonOutput: false"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"  # When using json output, whether or not to include the \"output\" property"},{"line_number":54,"context_line":"  # itself (e.g. \"File below a known binary directory opened for writing"},{"line_number":55,"context_line":"  # (user\u003droot ....\") in the json output."},{"line_number":56,"context_line":"  jsonIncludeOutputProperty: true"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"  # Send information logs to stderr and/or syslog Note these are *not* security"},{"line_number":59,"context_line":"  # notification logs! These are just Falco lifecycle (and possibly error) logs."},{"line_number":60,"context_line":"  logStderr: true"},{"line_number":61,"context_line":"  logSyslog: true"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"  # Minimum log level to include in logs. Note: these levels are"},{"line_number":64,"context_line":"  # separate from the priority field of rules. This refers only to the"},{"line_number":65,"context_line":"  # log level of falco\u0027s internal logging. Can be one of \"emergency\","},{"line_number":66,"context_line":"  # \"alert\", \"critical\", \"error\", \"warning\", \"notice\", \"info\", \"debug\"."},{"line_number":67,"context_line":"  logLevel: info"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  # Minimum rule priority level to load and run. All rules having a"},{"line_number":70,"context_line":"  # priority more severe than this level will be loaded/run.  Can be one"},{"line_number":71,"context_line":"  # of \"emergency\", \"alert\", \"critical\", \"error\", \"warning\", \"notice\","},{"line_number":72,"context_line":"  # \"info\", \"debug\"."},{"line_number":73,"context_line":"  priority: debug"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"  # Whether or not output to any of the output channels below is"},{"line_number":76,"context_line":"  # buffered."},{"line_number":77,"context_line":"  bufferedOutputs: false"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"  # A throttling mechanism implemented as a token bucket limits the"},{"line_number":80,"context_line":"  # rate of falco notifications. This throttling is controlled by the following configuration"},{"line_number":81,"context_line":"  # options:"},{"line_number":82,"context_line":"  #  - rate: the number of tokens (i.e. right to send a notification)"},{"line_number":83,"context_line":"  #    gained per second. Defaults to 1."},{"line_number":84,"context_line":"  #  - max_burst: the maximum number of tokens outstanding. Defaults to 1000."},{"line_number":85,"context_line":"  #"},{"line_number":86,"context_line":"  # With these defaults, falco could send up to 1000 notifications after"},{"line_number":87,"context_line":"  # an initial quiet period, and then up to 1 notification per second"},{"line_number":88,"context_line":"  # afterward. It would gain the full burst back after 1000 seconds of"},{"line_number":89,"context_line":"  # no activity."},{"line_number":90,"context_line":"  outputs:"},{"line_number":91,"context_line":"    rate: 1"},{"line_number":92,"context_line":"    maxBurst: 1000"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"  # Where security notifications should go."},{"line_number":95,"context_line":"  # Multiple outputs can be enabled."},{"line_number":96,"context_line":"  syslogOutput:"},{"line_number":97,"context_line":"    enabled: true"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"  # If keep_alive is set to true, the file will be opened once and"},{"line_number":100,"context_line":"  # continuously written to, with each output message on its own"},{"line_number":101,"context_line":"  # line. If keep_alive is set to false, the file will be re-opened"},{"line_number":102,"context_line":"  # for each output message."},{"line_number":103,"context_line":"  #"},{"line_number":104,"context_line":"  # Also, the file will be closed and reopened if falco is signaled with"},{"line_number":105,"context_line":"  # SIGUSR1."},{"line_number":106,"context_line":"  fileOutput:"},{"line_number":107,"context_line":"    enabled: false"},{"line_number":108,"context_line":"    keepAlive: false"},{"line_number":109,"context_line":"    filename: ./events.txt"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"  stdoutOutput:"},{"line_number":112,"context_line":"    enabled: true"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"  # Possible additional things you might want to do with program output:"},{"line_number":115,"context_line":"  #   - send to a slack webhook:"},{"line_number":116,"context_line":"  #         program: \"jq \u0027{text: .output}\u0027 | curl -d @- -X POST https://hooks.slack.com/services/XXX\""},{"line_number":117,"context_line":"  #   - logging (alternate method than syslog):"},{"line_number":118,"context_line":"  #         program: logger -t falco-test"},{"line_number":119,"context_line":"  #   - send over a network connection:"},{"line_number":120,"context_line":"  #         program: nc host.example.com 80"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"  # If keep_alive is set to true, the program will be started once and"},{"line_number":123,"context_line":"  # continuously written to, with each output message on its own"},{"line_number":124,"context_line":"  # line. If keep_alive is set to false, the program will be re-spawned"},{"line_number":125,"context_line":"  # for each output message."},{"line_number":126,"context_line":"  #"},{"line_number":127,"context_line":"  # Also, the program will be closed and reopened if falco is signaled with"},{"line_number":128,"context_line":"  # SIGUSR1."},{"line_number":129,"context_line":"  programOutput:"},{"line_number":130,"context_line":"    enabled: false"},{"line_number":131,"context_line":"    keepAlive: false"},{"line_number":132,"context_line":"    program: mail -s \"Falco Notification\" someone@example.com"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"falco_rules: |"},{"line_number":135,"context_line":"  - macro: open_write"},{"line_number":136,"context_line":"    condition: (evt.type\u003dopen or evt.type\u003dopenat) and evt.is_open_write\u003dtrue and fd.typechar\u003d\u0027f\u0027 and fd.num\u003e\u003d0"},{"line_number":137,"context_line":"  - macro: open_read"},{"line_number":138,"context_line":"    condition: (evt.type\u003dopen or evt.type\u003dopenat) and evt.is_open_read\u003dtrue and fd.typechar\u003d\u0027f\u0027 and fd.num\u003e\u003d0"},{"line_number":139,"context_line":"  - macro: never_true"},{"line_number":140,"context_line":"    condition: (evt.num\u003d0)"},{"line_number":141,"context_line":"  - macro: always_true"},{"line_number":142,"context_line":"    condition: (evt.num\u003d\u003e0)"},{"line_number":143,"context_line":"  - macro: proc_name_exists"},{"line_number":144,"context_line":"    condition: (proc.name!\u003d\"\u003cNA\u003e\")"},{"line_number":145,"context_line":"  - macro: rename"},{"line_number":146,"context_line":"    condition: evt.type in (rename, renameat)"},{"line_number":147,"context_line":"  - macro: mkdir"},{"line_number":148,"context_line":"    condition: evt.type \u003d mkdir"},{"line_number":149,"context_line":"  - macro: remove"},{"line_number":150,"context_line":"    condition: evt.type in (rmdir, unlink, unlinkat)"},{"line_number":151,"context_line":"  - macro: modify"},{"line_number":152,"context_line":"    condition: rename or remove"},{"line_number":153,"context_line":"  - macro: spawned_process"},{"line_number":154,"context_line":"    condition: evt.type \u003d execve and evt.dir\u003d\u003c"},{"line_number":155,"context_line":"  - macro: bin_dir"},{"line_number":156,"context_line":"    condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)"},{"line_number":157,"context_line":"  - macro: bin_dir_mkdir"},{"line_number":158,"context_line":"    condition: \u003e"},{"line_number":159,"context_line":"      (evt.arg[1] startswith /bin/ or"},{"line_number":160,"context_line":"       evt.arg[1] startswith /sbin/ or"},{"line_number":161,"context_line":"       evt.arg[1] startswith /usr/bin/ or"},{"line_number":162,"context_line":"       evt.arg[1] startswith /usr/sbin/)"},{"line_number":163,"context_line":"  - macro: bin_dir_rename"},{"line_number":164,"context_line":"    condition: \u003e"},{"line_number":165,"context_line":"      evt.arg[1] startswith /bin/ or"},{"line_number":166,"context_line":"      evt.arg[1] startswith /sbin/ or"},{"line_number":167,"context_line":"      evt.arg[1] startswith /usr/bin/ or"},{"line_number":168,"context_line":"      evt.arg[1] startswith /usr/sbin/"},{"line_number":169,"context_line":"  - macro: etc_dir"},{"line_number":170,"context_line":"    condition: fd.name startswith /etc/"},{"line_number":171,"context_line":"  - macro: root_dir"},{"line_number":172,"context_line":"    condition: ((fd.directory\u003d/ or fd.name startswith /root) and fd.name contains \"/\")"},{"line_number":173,"context_line":"  - list: shell_binaries"},{"line_number":174,"context_line":"    items: [bash, csh, ksh, sh, tcsh, zsh, dash]"},{"line_number":175,"context_line":"  - list: shell_mgmt_binaries"},{"line_number":176,"context_line":"    items: [add-shell, remove-shell]"},{"line_number":177,"context_line":"  - macro: shell_procs"},{"line_number":178,"context_line":"    condition: (proc.name in (shell_binaries))"},{"line_number":179,"context_line":"  - list: coreutils_binaries"},{"line_number":180,"context_line":"    items: ["},{"line_number":181,"context_line":"      truncate, sha1sum, numfmt, fmt, fold, uniq, cut, who,"},{"line_number":182,"context_line":"      groups, csplit, sort, expand, printf, printenv, unlink, tee, chcon, stat,"},{"line_number":183,"context_line":"      basename, split, nice, \"yes\", whoami, sha224sum, hostid, users, stdbuf,"},{"line_number":184,"context_line":"      base64, unexpand, cksum, od, paste, nproc, pathchk, sha256sum, wc, test,"},{"line_number":185,"context_line":"      comm, arch, du, factor, sha512sum, md5sum, tr, runcon, env, dirname,"},{"line_number":186,"context_line":"      tsort, join, shuf, install, logname, pinky, nohup, expr, pr, tty, timeout,"},{"line_number":187,"context_line":"      tail, \"[\", seq, sha384sum, nl, head, id, mkfifo, sum, dircolors, ptx, shred,"},{"line_number":188,"context_line":"      tac, link, chroot, vdir, chown, touch, ls, dd, uname, \"true\", pwd, date,"},{"line_number":189,"context_line":"      chgrp, chmod, mktemp, cat, mknod, sync, ln, \"false\", rm, mv, cp, echo,"},{"line_number":190,"context_line":"      readlink, sleep, stty, mkdir, df, dir, rmdir, touch"},{"line_number":191,"context_line":"      ]"},{"line_number":192,"context_line":"  - list: login_binaries"},{"line_number":193,"context_line":"    items: ["},{"line_number":194,"context_line":"      login, systemd, \u0027\"(systemd)\"\u0027, systemd-logind, su,"},{"line_number":195,"context_line":"      nologin, faillog, lastlog, newgrp, sg"},{"line_number":196,"context_line":"      ]"},{"line_number":197,"context_line":"  - list: passwd_binaries"},{"line_number":198,"context_line":"    items: ["},{"line_number":199,"context_line":"      shadowconfig, grpck, pwunconv, grpconv, pwck,"},{"line_number":200,"context_line":"      groupmod, vipw, pwconv, useradd, newusers, cppw, chpasswd, usermod,"},{"line_number":201,"context_line":"      groupadd, groupdel, grpunconv, chgpasswd, userdel, chage, chsh,"},{"line_number":202,"context_line":"      gpasswd, chfn, expiry, passwd, vigr, cpgr"},{"line_number":203,"context_line":"      ]"},{"line_number":204,"context_line":"  - list: shadowutils_binaries"},{"line_number":205,"context_line":"    items: ["},{"line_number":206,"context_line":"      chage, gpasswd, lastlog, newgrp, sg, adduser, deluser, chpasswd,"},{"line_number":207,"context_line":"      groupadd, groupdel, addgroup, delgroup, groupmems, groupmod, grpck, grpconv, grpunconv,"},{"line_number":208,"context_line":"      newusers, pwck, pwconv, pwunconv, useradd, userdel, usermod, vigr, vipw, unix_chkpwd"},{"line_number":209,"context_line":"      ]"},{"line_number":210,"context_line":"  - list: sysdigcloud_binaries"},{"line_number":211,"context_line":"    items: [setup-backend, dragent, sdchecks]"},{"line_number":212,"context_line":"  - list: docker_binaries"},{"line_number":213,"context_line":"    items: [docker, dockerd, exe, docker-compose, docker-entrypoi, docker-runc-cur, docker-current]"},{"line_number":214,"context_line":"  - list: k8s_binaries"},{"line_number":215,"context_line":"    items: [hyperkube, skydns, kube2sky, exechealthz]"},{"line_number":216,"context_line":"  - list: lxd_binaries"},{"line_number":217,"context_line":"    items: [lxd, lxcfs]"},{"line_number":218,"context_line":"  - list: http_server_binaries"},{"line_number":219,"context_line":"    items: [nginx, httpd, httpd-foregroun, lighttpd, apache, apache2]"},{"line_number":220,"context_line":"  - list: db_server_binaries"},{"line_number":221,"context_line":"    items: [mysqld, postgres, sqlplus]"},{"line_number":222,"context_line":"  - list: mysql_mgmt_binaries"},{"line_number":223,"context_line":"    items: [mysql_install_d, mysql_ssl_rsa_s]"},{"line_number":224,"context_line":"  - list: postgres_mgmt_binaries"},{"line_number":225,"context_line":"    items: [pg_dumpall, pg_ctl, pg_lsclusters, pg_ctlcluster]"},{"line_number":226,"context_line":"  - list: db_mgmt_binaries"},{"line_number":227,"context_line":"    items: [mysql_mgmt_binaries, postgres_mgmt_binaries]"},{"line_number":228,"context_line":"  - list: nosql_server_binaries"},{"line_number":229,"context_line":"    items: [couchdb, memcached, redis-server, rabbitmq-server, mongod]"},{"line_number":230,"context_line":"  - list: gitlab_binaries"},{"line_number":231,"context_line":"    items: [gitlab-shell, gitlab-mon, gitlab-runner-b, git]"},{"line_number":232,"context_line":"  - macro: server_procs"},{"line_number":233,"context_line":"    condition: proc.name in (http_server_binaries, db_server_binaries, docker_binaries, sshd)"},{"line_number":234,"context_line":"  - list: rpm_binaries"},{"line_number":235,"context_line":"    items: [dnf, rpm, rpmkey, yum, \u0027\"75-system-updat\"\u0027, rhsmcertd-worke, subscription-ma,"},{"line_number":236,"context_line":"            repoquery, rpmkeys, rpmq, yum-cron, yum-config-mana, yum-debug-dump,"},{"line_number":237,"context_line":"            abrt-action-sav, rpmdb_stat, microdnf]"},{"line_number":238,"context_line":"  - macro: rpm_procs"},{"line_number":239,"context_line":"    condition: proc.name in (rpm_binaries) or proc.name in (salt-minion)"},{"line_number":240,"context_line":"  - list: deb_binaries"},{"line_number":241,"context_line":"    items: [dpkg, dpkg-preconfigu, dpkg-reconfigur, dpkg-divert, apt, apt-get, aptitude,"},{"line_number":242,"context_line":"      frontend, preinst, add-apt-reposit, apt-auto-remova, apt-key,"},{"line_number":243,"context_line":"      apt-listchanges, unattended-upgr, apt-add-reposit"},{"line_number":244,"context_line":"      ]"},{"line_number":245,"context_line":"  - list: package_mgmt_binaries"},{"line_number":246,"context_line":"    items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client]"},{"line_number":247,"context_line":"  - macro: package_mgmt_procs"},{"line_number":248,"context_line":"    condition: proc.name in (package_mgmt_binaries)"},{"line_number":249,"context_line":"  - macro: coreos_write_ssh_dir"},{"line_number":250,"context_line":"    condition: (proc.name\u003dupdate-ssh-keys and fd.name startswith /home/core/.ssh)"},{"line_number":251,"context_line":"  - macro: run_by_package_mgmt_binaries"},{"line_number":252,"context_line":"    condition: proc.aname in (package_mgmt_binaries, needrestart)"},{"line_number":253,"context_line":"  - list: ssl_mgmt_binaries"},{"line_number":254,"context_line":"    items: [ca-certificates]"},{"line_number":255,"context_line":"  - list: dhcp_binaries"},{"line_number":256,"context_line":"    items: [dhclient, dhclient-script]"},{"line_number":257,"context_line":"  - list: userexec_binaries"},{"line_number":258,"context_line":"    items: [sudo, su, suexec]"},{"line_number":259,"context_line":"  - list: known_setuid_binaries"},{"line_number":260,"context_line":"    items: ["},{"line_number":261,"context_line":"      sshd, dbus-daemon-lau, ping, ping6, critical-stack-, pmmcli,"},{"line_number":262,"context_line":"      filemng, PassengerAgent, bwrap, osdetect, nginxmng, sw-engine-fpm,"},{"line_number":263,"context_line":"      start-stop-daem"},{"line_number":264,"context_line":"      ]"},{"line_number":265,"context_line":"  - list: user_mgmt_binaries"},{"line_number":266,"context_line":"    items: [login_binaries, passwd_binaries, shadowutils_binaries]"},{"line_number":267,"context_line":"  - list: dev_creation_binaries"},{"line_number":268,"context_line":"    items: [blkid, rename_device, update_engine, sgdisk]"},{"line_number":269,"context_line":"  - list: hids_binaries"},{"line_number":270,"context_line":"    items: [aide]"},{"line_number":271,"context_line":"  - list: vpn_binaries"},{"line_number":272,"context_line":"    items: [openvpn]"},{"line_number":273,"context_line":"  - list: nomachine_binaries"},{"line_number":274,"context_line":"    items: [nxexec, nxnode.bin, nxserver.bin, nxclient.bin]"},{"line_number":275,"context_line":"  - macro: system_procs"},{"line_number":276,"context_line":"    condition: proc.name in (coreutils_binaries, user_mgmt_binaries)"},{"line_number":277,"context_line":"  - list: mail_binaries"},{"line_number":278,"context_line":"    items: ["},{"line_number":279,"context_line":"      sendmail, sendmail-msp, postfix, procmail, exim4,"},{"line_number":280,"context_line":"      pickup, showq, mailq, dovecot, imap-login, imap,"},{"line_number":281,"context_line":"      mailmng-core, pop3-login, dovecot-lda, pop3"},{"line_number":282,"context_line":"      ]"},{"line_number":283,"context_line":"  - list: mail_config_binaries"},{"line_number":284,"context_line":"    items: ["},{"line_number":285,"context_line":"      update_conf, parse_mc, makemap_hash, newaliases, update_mk, update_tlsm4,"},{"line_number":286,"context_line":"      update_db, update_mc, ssmtp.postinst, mailq, postalias, postfix.config.,"},{"line_number":287,"context_line":"      postfix.config, postfix-script"},{"line_number":288,"context_line":"      ]"},{"line_number":289,"context_line":"  - list: sensitive_file_names"},{"line_number":290,"context_line":"    items: [/etc/shadow, /etc/sudoers, /etc/pam.conf]"},{"line_number":291,"context_line":"  - macro: sensitive_files"},{"line_number":292,"context_line":"    condition: \u003e"},{"line_number":293,"context_line":"      fd.name startswith /etc and"},{"line_number":294,"context_line":"      (fd.name in (sensitive_file_names)"},{"line_number":295,"context_line":"       or fd.directory in (/etc/sudoers.d, /etc/pam.d))"},{"line_number":296,"context_line":"  - macro: proc_is_new"},{"line_number":297,"context_line":"    condition: proc.duration \u003c\u003d 5000000000"},{"line_number":298,"context_line":"  - macro: inbound"},{"line_number":299,"context_line":"    condition: \u003e"},{"line_number":300,"context_line":"      (((evt.type in (accept,listen) and evt.dir\u003d\u003c)) or"},{"line_number":301,"context_line":"       (fd.typechar \u003d 4 or fd.typechar \u003d 6) and"},{"line_number":302,"context_line":"       (fd.ip !\u003d \"0.0.0.0\" and fd.net !\u003d \"127.0.0.0/8\") and"},{"line_number":303,"context_line":"       (evt.rawres \u003e\u003d 0 or evt.res \u003d EINPROGRESS))"},{"line_number":304,"context_line":"  - macro: outbound"},{"line_number":305,"context_line":"    condition: \u003e"},{"line_number":306,"context_line":"      (((evt.type \u003d connect and evt.dir\u003d\u003c)) or"},{"line_number":307,"context_line":"       (fd.typechar \u003d 4 or fd.typechar \u003d 6) and"},{"line_number":308,"context_line":"       (fd.ip !\u003d \"0.0.0.0\" and fd.net !\u003d \"127.0.0.0/8\") and"},{"line_number":309,"context_line":"       (evt.rawres \u003e\u003d 0 or evt.res \u003d EINPROGRESS))"},{"line_number":310,"context_line":"  - macro: inbound_outbound"},{"line_number":311,"context_line":"    condition: \u003e"},{"line_number":312,"context_line":"      (((evt.type in (accept,listen,connect) and evt.dir\u003d\u003c)) or"},{"line_number":313,"context_line":"       (fd.typechar \u003d 4 or fd.typechar \u003d 6) and"},{"line_number":314,"context_line":"       (fd.ip !\u003d \"0.0.0.0\" and fd.net !\u003d \"127.0.0.0/8\") and"},{"line_number":315,"context_line":"       (evt.rawres \u003e\u003d 0 or evt.res \u003d EINPROGRESS))"},{"line_number":316,"context_line":"  - macro: ssh_port"},{"line_number":317,"context_line":"    condition: fd.sport\u003d22"},{"line_number":318,"context_line":"  - macro: allowed_ssh_hosts"},{"line_number":319,"context_line":"    condition: ssh_port"},{"line_number":320,"context_line":"  - rule: Disallowed SSH Connection"},{"line_number":321,"context_line":"    desc: Detect any new ssh connection to a host other than those in an allowed group of hosts"},{"line_number":322,"context_line":"    condition: (inbound_outbound) and ssh_port and not allowed_ssh_hosts"},{"line_number":323,"context_line":"    output: Disallowed SSH Connection (command\u003d%proc.cmdline connection\u003d%fd.name user\u003d%user.name)"},{"line_number":324,"context_line":"    priority: NOTICE"},{"line_number":325,"context_line":"    tags: [network]"},{"line_number":326,"context_line":"  - macro: container"},{"line_number":327,"context_line":"    condition: container.id !\u003d host"},{"line_number":328,"context_line":"  - macro: interactive"},{"line_number":329,"context_line":"    condition: \u003e"},{"line_number":330,"context_line":"      ((proc.aname\u003dsshd and proc.name !\u003d sshd) or"},{"line_number":331,"context_line":"      proc.name\u003dsystemd-logind or proc.name\u003dlogin)"},{"line_number":332,"context_line":"  - list: cron_binaries"},{"line_number":333,"context_line":"    items: [anacron, cron, crond, crontab]"},{"line_number":334,"context_line":"  - list: needrestart_binaries"},{"line_number":335,"context_line":"    items: [needrestart, 10-dpkg, 20-rpm, 30-pacman]"},{"line_number":336,"context_line":"  - list: sshkit_script_binaries"},{"line_number":337,"context_line":"    items: [10_etc_sudoers., 10_passwd_group]"},{"line_number":338,"context_line":"  - list: plesk_binaries"},{"line_number":339,"context_line":"    items: [sw-engine, sw-engine-fpm, sw-engine-kv, filemng, f2bmng]"},{"line_number":340,"context_line":"  - macro: system_users"},{"line_number":341,"context_line":"    condition: user.name in (bin, daemon, games, lp, mail, nobody, sshd, sync, uucp, www-data)"},{"line_number":342,"context_line":"  - macro: parent_ansible_running_python"},{"line_number":343,"context_line":"    condition: (proc.pname in (python, pypy) and proc.pcmdline contains ansible)"},{"line_number":344,"context_line":"  - macro: parent_bro_running_python"},{"line_number":345,"context_line":"    condition: (proc.pname\u003dpython and proc.cmdline contains /usr/share/broctl)"},{"line_number":346,"context_line":"  - macro: parent_python_running_denyhosts"},{"line_number":347,"context_line":"    condition: \u003e"},{"line_number":348,"context_line":"      (proc.cmdline startswith \"denyhosts.py /usr/bin/denyhosts.py\" or"},{"line_number":349,"context_line":"       (proc.pname\u003dpython and"},{"line_number":350,"context_line":"       (proc.pcmdline contains /usr/sbin/denyhosts or"},{"line_number":351,"context_line":"        proc.pcmdline contains /usr/local/bin/denyhosts.py)))"},{"line_number":352,"context_line":"  - macro: parent_python_running_sdchecks"},{"line_number":353,"context_line":"    condition: \u003e"},{"line_number":354,"context_line":"      (proc.pname in (python, python2.7) and"},{"line_number":355,"context_line":"      (proc.pcmdline contains /opt/draios/bin/sdchecks))"},{"line_number":356,"context_line":"  - macro: parent_linux_image_upgrade_script"},{"line_number":357,"context_line":"    condition: proc.pname startswith linux-image-"},{"line_number":358,"context_line":"  - macro: parent_java_running_echo"},{"line_number":359,"context_line":"    condition: (proc.pname\u003djava and proc.cmdline startswith \"sh -c echo\")"},{"line_number":360,"context_line":"  - macro: parent_scripting_running_builds"},{"line_number":361,"context_line":"    condition: \u003e"},{"line_number":362,"context_line":"      (proc.pname in (php,php5-fpm,php-fpm7.1,python,ruby,ruby2.3,ruby2.1,node,conda) and ("},{"line_number":363,"context_line":"         proc.cmdline startswith \"sh -c git\" or"},{"line_number":364,"context_line":"         proc.cmdline startswith \"sh -c date\" or"},{"line_number":365,"context_line":"         proc.cmdline startswith \"sh -c /usr/bin/g++\" or"},{"line_number":366,"context_line":"         proc.cmdline startswith \"sh -c /usr/bin/gcc\" or"},{"line_number":367,"context_line":"         proc.cmdline startswith \"sh -c gcc\" or"},{"line_number":368,"context_line":"         proc.cmdline startswith \"sh -c if type gcc\" or"},{"line_number":369,"context_line":"         proc.cmdline startswith \"sh -c cd \u0027/var/www/edi/\u0027;LC_ALL\u003den_US.UTF-8 git\" or"},{"line_number":370,"context_line":"         proc.cmdline startswith \"sh -c /var/www/edi/bin/sftp.sh\" or"},{"line_number":371,"context_line":"         proc.cmdline startswith \"sh -c /usr/src/app/crxlsx/bin/linux/crxlsx\" or"},{"line_number":372,"context_line":"         proc.cmdline startswith \"sh -c make parent\" or"},{"line_number":373,"context_line":"         proc.cmdline startswith \"node /jenkins/tools\" or"},{"line_number":374,"context_line":"         proc.cmdline startswith \"sh -c \u0027/usr/bin/node\u0027\" or"},{"line_number":375,"context_line":"         proc.cmdline startswith \"sh -c stty -a |\" or"},{"line_number":376,"context_line":"         proc.pcmdline startswith \"node /opt/nodejs/bin/yarn\" or"},{"line_number":377,"context_line":"         proc.pcmdline startswith \"node /usr/local/bin/yarn\" or"},{"line_number":378,"context_line":"         proc.pcmdline startswith \"node /root/.config/yarn\" or"},{"line_number":379,"context_line":"         proc.pcmdline startswith \"node /opt/yarn/bin/yarn.js\"))"},{"line_number":380,"context_line":"  - macro: httpd_writing_ssl_conf"},{"line_number":381,"context_line":"    condition: \u003e"},{"line_number":382,"context_line":"      (proc.pname\u003drun-httpd and"},{"line_number":383,"context_line":"       (proc.cmdline startswith \"sed -ri\" or proc.cmdline startswith \"sed -i\") and"},{"line_number":384,"context_line":"       (fd.name startswith /etc/httpd/conf.d/ or fd.name startswith /etc/httpd/conf))"},{"line_number":385,"context_line":"  - macro: userhelper_writing_etc_security"},{"line_number":386,"context_line":"    condition: (proc.name\u003duserhelper and fd.name startswith /etc/security)"},{"line_number":387,"context_line":"  - macro: parent_Xvfb_running_xkbcomp"},{"line_number":388,"context_line":"    condition: (proc.pname\u003dXvfb and proc.cmdline startswith \u0027sh -c \"/usr/bin/xkbcomp\"\u0027)"},{"line_number":389,"context_line":"  - macro: parent_nginx_running_serf"},{"line_number":390,"context_line":"    condition: (proc.pname\u003dnginx and proc.cmdline startswith \"sh -c serf\")"},{"line_number":391,"context_line":"  - macro: parent_node_running_npm"},{"line_number":392,"context_line":"    condition: (proc.pcmdline startswith \"node /usr/local/bin/npm\" or"},{"line_number":393,"context_line":"                proc.pcmdline startswith \"node /usr/local/nodejs/bin/npm\" or"},{"line_number":394,"context_line":"                proc.pcmdline startswith \"node /opt/rh/rh-nodejs6/root/usr/bin/npm\")"},{"line_number":395,"context_line":"  - macro: parent_java_running_sbt"},{"line_number":396,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains sbt-launch.jar)"},{"line_number":397,"context_line":"  - list: known_container_shell_spawn_cmdlines"},{"line_number":398,"context_line":"    items: []"},{"line_number":399,"context_line":"  - list: known_shell_spawn_binaries"},{"line_number":400,"context_line":"    items: []"},{"line_number":401,"context_line":"  - macro: ansible_running_python"},{"line_number":402,"context_line":"    condition: (proc.name in (python, pypy) and proc.cmdline contains ansible)"},{"line_number":403,"context_line":"  - macro: python_running_chef"},{"line_number":404,"context_line":"    condition: (proc.name\u003dpython and (proc.cmdline contains yum-dump.py or proc.cmdline\u003d\"python /usr/bin/chef-monitor.py\"))"},{"line_number":405,"context_line":"  - macro: python_running_denyhosts"},{"line_number":406,"context_line":"    condition: \u003e"},{"line_number":407,"context_line":"      (proc.name\u003dpython and"},{"line_number":408,"context_line":"      (proc.cmdline contains /usr/sbin/denyhosts or"},{"line_number":409,"context_line":"       proc.cmdline contains /usr/local/bin/denyhosts.py))"},{"line_number":410,"context_line":"  - macro: run_by_qualys"},{"line_number":411,"context_line":"    condition: \u003e"},{"line_number":412,"context_line":"      (proc.pname\u003dqualys-cloud-ag or"},{"line_number":413,"context_line":"       proc.aname[2]\u003dqualys-cloud-ag or"},{"line_number":414,"context_line":"       proc.aname[3]\u003dqualys-cloud-ag or"},{"line_number":415,"context_line":"       proc.aname[4]\u003dqualys-cloud-ag)"},{"line_number":416,"context_line":"  - macro: run_by_sumologic_securefiles"},{"line_number":417,"context_line":"    condition: \u003e"},{"line_number":418,"context_line":"      ((proc.cmdline\u003d\"usermod -a -G sumologic_collector\" or"},{"line_number":419,"context_line":"        proc.cmdline\u003d\"groupadd sumologic_collector\") and"},{"line_number":420,"context_line":"       (proc.pname\u003dsecureFiles.sh and proc.aname[2]\u003djava))"},{"line_number":421,"context_line":"  - macro: run_by_yum"},{"line_number":422,"context_line":"    condition: ((proc.pname\u003dsh and proc.aname[2]\u003dyum) or"},{"line_number":423,"context_line":"                (proc.aname[2]\u003dsh and proc.aname[3]\u003dyum))"},{"line_number":424,"context_line":"  - macro: run_by_ms_oms"},{"line_number":425,"context_line":"    condition: \u003e"},{"line_number":426,"context_line":"      (proc.aname[3] startswith omsagent- or"},{"line_number":427,"context_line":"       proc.aname[3] startswith scx-)"},{"line_number":428,"context_line":"  - macro: run_by_google_accounts_daemon"},{"line_number":429,"context_line":"    condition: \u003e"},{"line_number":430,"context_line":"      (proc.aname[1] startswith google_accounts or"},{"line_number":431,"context_line":"       proc.aname[2] startswith google_accounts)"},{"line_number":432,"context_line":"  - macro: run_by_chef"},{"line_number":433,"context_line":"    condition: (proc.aname[2]\u003dchef_command_wr or proc.aname[3]\u003dchef_command_wr or"},{"line_number":434,"context_line":"                proc.aname[2]\u003dchef-client or proc.aname[3]\u003dchef-client or"},{"line_number":435,"context_line":"                proc.name\u003dchef-client)"},{"line_number":436,"context_line":"  - macro: run_by_adclient"},{"line_number":437,"context_line":"    condition: (proc.aname[2]\u003dadclient or proc.aname[3]\u003dadclient or proc.aname[4]\u003dadclient)"},{"line_number":438,"context_line":"  - macro: run_by_centrify"},{"line_number":439,"context_line":"    condition: (proc.aname[2]\u003dcentrify or proc.aname[3]\u003dcentrify or proc.aname[4]\u003dcentrify)"},{"line_number":440,"context_line":"  - macro: run_by_puppet"},{"line_number":441,"context_line":"    condition: (proc.aname[2]\u003dpuppet or proc.aname[3]\u003dpuppet)"},{"line_number":442,"context_line":"  - macro: run_by_foreman"},{"line_number":443,"context_line":"    condition: \u003e"},{"line_number":444,"context_line":"      (user.name\u003dforeman and"},{"line_number":445,"context_line":"       (proc.pname in (rake, ruby, scl) and proc.aname[5] in (tfm-rake,tfm-ruby)) or"},{"line_number":446,"context_line":"       (proc.pname\u003dscl and proc.aname[2] in (tfm-rake,tfm-ruby)))"},{"line_number":447,"context_line":"  - macro: java_running_sdjagent"},{"line_number":448,"context_line":"    condition: proc.name\u003djava and proc.cmdline contains sdjagent.jar"},{"line_number":449,"context_line":"  - macro: kubelet_running_loopback"},{"line_number":450,"context_line":"    condition: (proc.pname\u003dkubelet and proc.name\u003dloopback)"},{"line_number":451,"context_line":"  - macro: python_mesos_marathon_scripting"},{"line_number":452,"context_line":"    condition: (proc.pcmdline startswith \"python3 /marathon-lb/marathon_lb.py\")"},{"line_number":453,"context_line":"  - macro: splunk_running_forwarder"},{"line_number":454,"context_line":"    condition: (proc.pname\u003dsplunkd and proc.cmdline startswith \"sh -c /opt/splunkforwarder\")"},{"line_number":455,"context_line":"  - macro: parent_supervise_running_multilog"},{"line_number":456,"context_line":"    condition: (proc.name\u003dmultilog and proc.pname\u003dsupervise)"},{"line_number":457,"context_line":"  - macro: supervise_writing_status"},{"line_number":458,"context_line":"    condition: (proc.name in (supervise,svc) and fd.name startswith \"/etc/sb/\")"},{"line_number":459,"context_line":"  - macro: pki_realm_writing_realms"},{"line_number":460,"context_line":"    condition: (proc.cmdline startswith \"bash /usr/local/lib/pki/pki-realm\" and fd.name startswith /etc/pki/realms)"},{"line_number":461,"context_line":"  - macro: htpasswd_writing_passwd"},{"line_number":462,"context_line":"    condition: (proc.name\u003dhtpasswd and fd.name\u003d/etc/nginx/.htpasswd)"},{"line_number":463,"context_line":"  - macro: lvprogs_writing_conf"},{"line_number":464,"context_line":"    condition: \u003e"},{"line_number":465,"context_line":"      (proc.name in (dmeventd,lvcreate,pvscan) and"},{"line_number":466,"context_line":"       (fd.name startswith /etc/lvm/archive or"},{"line_number":467,"context_line":"        fd.name startswith /etc/lvm/backup or"},{"line_number":468,"context_line":"        fd.name startswith /etc/lvm/cache))"},{"line_number":469,"context_line":"  - macro: ovsdb_writing_openvswitch"},{"line_number":470,"context_line":"    condition: (proc.name\u003dovsdb-server and fd.directory\u003d/etc/openvswitch)"},{"line_number":471,"context_line":"  - macro: perl_running_plesk"},{"line_number":472,"context_line":"    condition: (proc.cmdline startswith \"perl /opt/psa/admin/bin/plesk_agent_manager\" or"},{"line_number":473,"context_line":"                proc.pcmdline startswith \"perl /opt/psa/admin/bin/plesk_agent_manager\")"},{"line_number":474,"context_line":"  - macro: perl_running_updmap"},{"line_number":475,"context_line":"    condition: (proc.cmdline startswith \"perl /usr/bin/updmap\")"},{"line_number":476,"context_line":"  - macro: perl_running_centrifydc"},{"line_number":477,"context_line":"    condition: (proc.cmdline startswith \"perl /usr/share/centrifydc\")"},{"line_number":478,"context_line":"  - macro: parent_ucf_writing_conf"},{"line_number":479,"context_line":"    condition: (proc.pname\u003ducf and proc.aname[2]\u003dfrontend)"},{"line_number":480,"context_line":"  - macro: consul_template_writing_conf"},{"line_number":481,"context_line":"    condition: \u003e"},{"line_number":482,"context_line":"      ((proc.name\u003dconsul-template and fd.name startswith /etc/haproxy) or"},{"line_number":483,"context_line":"       (proc.name\u003dreload.sh and proc.aname[2]\u003dconsul-template and fd.name startswith /etc/ssl))"},{"line_number":484,"context_line":"  - macro: countly_writing_nginx_conf"},{"line_number":485,"context_line":"    condition: (proc.cmdline startswith \"nodejs /opt/countly/bin\" and fd.name startswith /etc/nginx)"},{"line_number":486,"context_line":"  - list: ms_oms_binaries"},{"line_number":487,"context_line":"    items: [omi.postinst, omsconfig.posti, scx.postinst, omsadmin.sh, omiagent]"},{"line_number":488,"context_line":"  - macro: ms_oms_writing_conf"},{"line_number":489,"context_line":"    condition: \u003e"},{"line_number":490,"context_line":"      ((proc.name in (omiagent,omsagent,in_heartbeat_r*,omsadmin.sh,PerformInventor)"},{"line_number":491,"context_line":"         or proc.pname in (ms_oms_binaries)"},{"line_number":492,"context_line":"         or proc.aname[2] in (ms_oms_binaries))"},{"line_number":493,"context_line":"       and (fd.name startswith /etc/opt/omi or fd.name startswith /etc/opt/microsoft/omsagent))"},{"line_number":494,"context_line":"  - macro: ms_scx_writing_conf"},{"line_number":495,"context_line":"    condition: (proc.name in (GetLinuxOS.sh) and fd.name startswith /etc/opt/microsoft/scx)"},{"line_number":496,"context_line":"  - macro: azure_scripts_writing_conf"},{"line_number":497,"context_line":"    condition: (proc.pname startswith \"bash /var/lib/waagent/\" and fd.name startswith /etc/azure)"},{"line_number":498,"context_line":"  - macro: azure_networkwatcher_writing_conf"},{"line_number":499,"context_line":"    condition: (proc.name in (NetworkWatcherA) and fd.name\u003d/etc/init.d/AzureNetworkWatcherAgent)"},{"line_number":500,"context_line":"  - macro: couchdb_writing_conf"},{"line_number":501,"context_line":"    condition: (proc.name\u003dbeam.smp and proc.cmdline contains couchdb and fd.name startswith /etc/couchdb)"},{"line_number":502,"context_line":"  - macro: update_texmf_writing_conf"},{"line_number":503,"context_line":"    condition: (proc.name\u003dupdate-texmf and fd.name startswith /etc/texmf)"},{"line_number":504,"context_line":"  - macro: slapadd_writing_conf"},{"line_number":505,"context_line":"    condition: (proc.name\u003dslapadd and fd.name startswith /etc/ldap)"},{"line_number":506,"context_line":"  - macro: openldap_writing_conf"},{"line_number":507,"context_line":"    condition: (proc.pname\u003drun-openldap.sh and fd.name startswith /etc/openldap)"},{"line_number":508,"context_line":"  - macro: ucpagent_writing_conf"},{"line_number":509,"context_line":"    condition: (proc.name\u003dapiserver and container.image startswith docker/ucp-agent and fd.name\u003d/etc/authorization_config.cfg)"},{"line_number":510,"context_line":"  - macro: iscsi_writing_conf"},{"line_number":511,"context_line":"    condition: (proc.name\u003discsiadm and fd.name startswith /etc/iscsi)"},{"line_number":512,"context_line":"  - macro: symantec_writing_conf"},{"line_number":513,"context_line":"    condition: \u003e"},{"line_number":514,"context_line":"      ((proc.name\u003dsymcfgd and fd.name startswith /etc/symantec) or"},{"line_number":515,"context_line":"       (proc.name\u003dnavdefutil and fd.name\u003d/etc/symc-defutils.conf))"},{"line_number":516,"context_line":"  - macro: liveupdate_writing_conf"},{"line_number":517,"context_line":"    condition: (proc.cmdline startswith \"java LiveUpdate\" and fd.name in (/etc/liveupdate.conf, /etc/Product.Catalog.JavaLiveUpdate))"},{"line_number":518,"context_line":"  - macro: sosreport_writing_files"},{"line_number":519,"context_line":"    condition: \u003e"},{"line_number":520,"context_line":"      (proc.name\u003durlgrabber-ext- and proc.aname[3]\u003dsosreport and"},{"line_number":521,"context_line":"       (fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb))"},{"line_number":522,"context_line":"  - macro: pkgmgmt_progs_writing_pki"},{"line_number":523,"context_line":"    condition: \u003e"},{"line_number":524,"context_line":"      (proc.name\u003durlgrabber-ext- and proc.pname in (yum, yum-cron, repoquery) and"},{"line_number":525,"context_line":"       (fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb))"},{"line_number":526,"context_line":"  - macro: update_ca_trust_writing_pki"},{"line_number":527,"context_line":"    condition: (proc.pname\u003dupdate-ca-trust and proc.name\u003dtrust and fd.name startswith /etc/pki)"},{"line_number":528,"context_line":"  - macro: brandbot_writing_os_release"},{"line_number":529,"context_line":"    condition: proc.name\u003dbrandbot and fd.name\u003d/etc/os-release"},{"line_number":530,"context_line":"  - macro: selinux_writing_conf"},{"line_number":531,"context_line":"    condition: (proc.name in (semodule,genhomedircon,sefcontext_comp) and fd.name startswith /etc/selinux)"},{"line_number":532,"context_line":"  - list: veritas_binaries"},{"line_number":533,"context_line":"    items: [vxconfigd, sfcache, vxclustadm, vxdctl, vxprint, vxdmpadm, vxdisk, vxdg, vxassist, vxtune]"},{"line_number":534,"context_line":"  - macro: veritas_driver_script"},{"line_number":535,"context_line":"    condition: (proc.cmdline startswith \"perl /opt/VRTSsfmh/bin/mh_driver.pl\")"},{"line_number":536,"context_line":"  - macro: veritas_progs"},{"line_number":537,"context_line":"    condition: (proc.name in (veritas_binaries) or veritas_driver_script)"},{"line_number":538,"context_line":"  - macro: veritas_writing_config"},{"line_number":539,"context_line":"    condition: (veritas_progs and (fd.name startswith /etc/vx or fd.name startswith /etc/opt/VRTS or fd.name startswith /etc/vom))"},{"line_number":540,"context_line":"  - macro: nginx_writing_conf"},{"line_number":541,"context_line":"    condition: (proc.name\u003dnginx and fd.name startswith /etc/nginx)"},{"line_number":542,"context_line":"  - macro: nginx_writing_certs"},{"line_number":543,"context_line":"    condition: \u003e"},{"line_number":544,"context_line":"      (((proc.name\u003dopenssl and proc.pname\u003dnginx-launch.sh) or proc.name\u003dnginx-launch.sh) and fd.name startswith /etc/nginx/certs)"},{"line_number":545,"context_line":"  - macro: chef_client_writing_conf"},{"line_number":546,"context_line":"    condition: (proc.pcmdline startswith \"chef-client /opt/gitlab\" and fd.name startswith /etc/gitlab)"},{"line_number":547,"context_line":"  - macro: centrify_writing_krb"},{"line_number":548,"context_line":"    condition: (proc.name in (adjoin,addns) and fd.name startswith /etc/krb5)"},{"line_number":549,"context_line":"  - macro: cockpit_writing_conf"},{"line_number":550,"context_line":"    condition: \u003e"},{"line_number":551,"context_line":"      ((proc.pname\u003dcockpit-kube-la or proc.aname[2]\u003dcockpit-kube-la)"},{"line_number":552,"context_line":"       and fd.name startswith /etc/cockpit)"},{"line_number":553,"context_line":"  - macro: ipsec_writing_conf"},{"line_number":554,"context_line":"    condition: (proc.name\u003dstart-ipsec.sh and fd.directory\u003d/etc/ipsec)"},{"line_number":555,"context_line":"  - macro: exe_running_docker_save"},{"line_number":556,"context_line":"    condition: (proc.cmdline startswith \"exe /var/lib/docker\" and proc.pname in (dockerd, docker))"},{"line_number":557,"context_line":"  - macro: sed_temporary_file"},{"line_number":558,"context_line":"    condition: (proc.name\u003dsed and fd.name startswith \"/etc/sed\")"},{"line_number":559,"context_line":"  - macro: python_running_get_pip"},{"line_number":560,"context_line":"    condition: (proc.cmdline startswith \"python get-pip.py\")"},{"line_number":561,"context_line":"  - macro: python_running_ms_oms"},{"line_number":562,"context_line":"    condition: (proc.cmdline startswith \"python /var/lib/waagent/\")"},{"line_number":563,"context_line":"  - macro: gugent_writing_guestagent_log"},{"line_number":564,"context_line":"    condition: (proc.name\u003dgugent and fd.name\u003dGuestAgent.log)"},{"line_number":565,"context_line":"  - macro: dse_writing_tmp"},{"line_number":566,"context_line":"    condition: (proc.name\u003ddse-entrypoint and fd.name\u003d/root/tmp__)"},{"line_number":567,"context_line":"  - macro: zap_writing_state"},{"line_number":568,"context_line":"    condition: (proc.name\u003djava and proc.cmdline contains \"jar /zap\" and fd.name startswith /root/.ZAP)"},{"line_number":569,"context_line":"  - macro: airflow_writing_state"},{"line_number":570,"context_line":"    condition: (proc.name\u003dairflow and fd.name startswith /root/airflow)"},{"line_number":571,"context_line":"  - macro: rpm_writing_root_rpmdb"},{"line_number":572,"context_line":"    condition: (proc.name\u003drpm and fd.directory\u003d/root/.rpmdb)"},{"line_number":573,"context_line":"  - macro: maven_writing_groovy"},{"line_number":574,"context_line":"    condition: (proc.name\u003djava and proc.cmdline contains \"classpath /usr/local/apache-maven\" and fd.name startswith /root/.groovy)"},{"line_number":575,"context_line":"  - rule: Write below binary dir"},{"line_number":576,"context_line":"    desc: an attempt to write to any file below a set of binary directories"},{"line_number":577,"context_line":"    condition: \u003e"},{"line_number":578,"context_line":"      bin_dir and evt.dir \u003d \u003c and open_write"},{"line_number":579,"context_line":"      and not package_mgmt_procs"},{"line_number":580,"context_line":"      and not exe_running_docker_save"},{"line_number":581,"context_line":"      and not python_running_get_pip"},{"line_number":582,"context_line":"      and not python_running_ms_oms"},{"line_number":583,"context_line":"    output: \u003e"},{"line_number":584,"context_line":"      File below a known binary directory opened for writing (user\u003d%user.name"},{"line_number":585,"context_line":"      command\u003d%proc.cmdline file\u003d%fd.name parent\u003d%proc.pname pcmdline\u003d%proc.pcmdline gparent\u003d%proc.aname[2])"},{"line_number":586,"context_line":"    priority: ERROR"},{"line_number":587,"context_line":"    tags: [filesystem]"},{"line_number":588,"context_line":"  - list: monitored_directories"},{"line_number":589,"context_line":"    items: [/boot, /lib, /lib64, /usr/lib, /usr/local/lib, /usr/local/sbin, /usr/local/bin, /root/.ssh, /etc/cardserver]"},{"line_number":590,"context_line":"  - macro: user_ssh_directory"},{"line_number":591,"context_line":"    condition: (fd.name startswith \u0027/home\u0027 and fd.name contains \u0027.ssh\u0027)"},{"line_number":592,"context_line":"  - macro: mkinitramfs_writing_boot"},{"line_number":593,"context_line":"    condition: (proc.pname in (mkinitramfs, update-initramf) and fd.directory\u003d/boot)"},{"line_number":594,"context_line":"  - macro: monitored_dir"},{"line_number":595,"context_line":"    condition: \u003e"},{"line_number":596,"context_line":"      (fd.directory in (monitored_directories)"},{"line_number":597,"context_line":"       or user_ssh_directory)"},{"line_number":598,"context_line":"      and not mkinitramfs_writing_boot"},{"line_number":599,"context_line":"  - rule: Write below monitored dir"},{"line_number":600,"context_line":"    desc: an attempt to write to any file below a set of binary directories"},{"line_number":601,"context_line":"    condition: \u003e"},{"line_number":602,"context_line":"      evt.dir \u003d \u003c and open_write and monitored_dir"},{"line_number":603,"context_line":"      and not package_mgmt_procs"},{"line_number":604,"context_line":"      and not coreos_write_ssh_dir"},{"line_number":605,"context_line":"      and not exe_running_docker_save"},{"line_number":606,"context_line":"      and not python_running_get_pip"},{"line_number":607,"context_line":"      and not python_running_ms_oms"},{"line_number":608,"context_line":"    output: \u003e"},{"line_number":609,"context_line":"      File below a monitored directory opened for writing (user\u003d%user.name"},{"line_number":610,"context_line":"      command\u003d%proc.cmdline file\u003d%fd.name parent\u003d%proc.pname pcmdline\u003d%proc.pcmdline gparent\u003d%proc.aname[2])"},{"line_number":611,"context_line":"    priority: ERROR"},{"line_number":612,"context_line":"    tags: [filesystem]"},{"line_number":613,"context_line":"  - list: safe_etc_dirs"},{"line_number":614,"context_line":"    items: [/etc/cassandra, /etc/ssl/certs/java, /etc/logstash, /etc/nginx/conf.d, /etc/container_environment, /etc/hrmconfig]"},{"line_number":615,"context_line":"  - macro: fluentd_writing_conf_files"},{"line_number":616,"context_line":"    condition: (proc.name\u003dstart-fluentd and fd.name in (/etc/fluent/fluent.conf, /etc/td-agent/td-agent.conf))"},{"line_number":617,"context_line":"  - macro: qualys_writing_conf_files"},{"line_number":618,"context_line":"    condition: (proc.name\u003dqualys-cloud-ag and fd.name\u003d/etc/qualys/cloud-agent/qagent-log.conf)"},{"line_number":619,"context_line":"  - macro: git_writing_nssdb"},{"line_number":620,"context_line":"    condition: (proc.name\u003dgit-remote-http and fd.directory\u003d/etc/pki/nssdb)"},{"line_number":621,"context_line":"  - macro: plesk_writing_keys"},{"line_number":622,"context_line":"    condition: (proc.name in (plesk_binaries) and fd.name startswith /etc/sw/keys)"},{"line_number":623,"context_line":"  - macro: plesk_install_writing_apache_conf"},{"line_number":624,"context_line":"    condition: (proc.cmdline startswith \"bash -hB /usr/lib/plesk-9.0/services/webserver.apache configure\""},{"line_number":625,"context_line":"                and fd.name\u003d\"/etc/apache2/apache2.conf.tmp\")"},{"line_number":626,"context_line":"  - macro: plesk_running_mktemp"},{"line_number":627,"context_line":"    condition: (proc.name\u003dmktemp and proc.aname[3] in (plesk_binaries))"},{"line_number":628,"context_line":"  - macro: networkmanager_writing_resolv_conf"},{"line_number":629,"context_line":"    condition: proc.aname[2]\u003dnm-dispatcher and fd.name\u003d/etc/resolv.conf"},{"line_number":630,"context_line":"  - macro: add_shell_writing_shells_tmp"},{"line_number":631,"context_line":"    condition: (proc.name\u003dadd-shell and fd.name\u003d/etc/shells.tmp)"},{"line_number":632,"context_line":"  - macro: duply_writing_exclude_files"},{"line_number":633,"context_line":"    condition: (proc.name\u003dtouch and proc.pcmdline startswith \"bash /usr/bin/duply\" and fd.name startswith \"/etc/duply\")"},{"line_number":634,"context_line":"  - macro: xmlcatalog_writing_files"},{"line_number":635,"context_line":"    condition: (proc.name\u003dupdate-xmlcatal and fd.directory\u003d/etc/xml)"},{"line_number":636,"context_line":"  - macro: datadog_writing_conf"},{"line_number":637,"context_line":"    condition: ((proc.cmdline startswith \"python /opt/datadog-agent\" or"},{"line_number":638,"context_line":"                 proc.cmdline startswith \"entrypoint.sh /entrypoint.sh datadog start\" or"},{"line_number":639,"context_line":"                 proc.cmdline startswith \"agent.py /opt/datadog-agent\")"},{"line_number":640,"context_line":"                and fd.name startswith \"/etc/dd-agent\")"},{"line_number":641,"context_line":"  - macro: curl_writing_pki_db"},{"line_number":642,"context_line":"    condition: (proc.name\u003dcurl and fd.directory\u003d/etc/pki/nssdb)"},{"line_number":643,"context_line":"  - macro: haproxy_writing_conf"},{"line_number":644,"context_line":"    condition: ((proc.name in (update-haproxy-,haproxy_reload.) or proc.pname in (update-haproxy-,haproxy_reload,haproxy_reload.))"},{"line_number":645,"context_line":"                 and (fd.name\u003d/etc/openvpn/client.map or fd.name startswith /etc/haproxy))"},{"line_number":646,"context_line":"  - macro: java_writing_conf"},{"line_number":647,"context_line":"    condition: (proc.name\u003djava and fd.name\u003d/etc/.java/.systemPrefs/.system.lock)"},{"line_number":648,"context_line":"  - macro: rabbitmq_writing_conf"},{"line_number":649,"context_line":"    condition: (proc.name\u003drabbitmq-server and fd.directory\u003d/etc/rabbitmq)"},{"line_number":650,"context_line":"  - macro: rook_writing_conf"},{"line_number":651,"context_line":"    condition: (proc.name\u003dtoolbox.sh and container.image startswith rook/toolbox"},{"line_number":652,"context_line":"                and fd.directory\u003d/etc/ceph)"},{"line_number":653,"context_line":"  - macro: httpd_writing_conf_logs"},{"line_number":654,"context_line":"    condition: (proc.name\u003dhttpd and fd.name startswith /etc/httpd/)"},{"line_number":655,"context_line":"  - macro: mysql_writing_conf"},{"line_number":656,"context_line":"    condition: \u003e"},{"line_number":657,"context_line":"      ((proc.name in (start-mysql.sh, run-mysqld) or proc.pname\u003dstart-mysql.sh) and"},{"line_number":658,"context_line":"       (fd.name startswith /etc/mysql or fd.directory\u003d/etc/my.cnf.d))"},{"line_number":659,"context_line":"  - macro: redis_writing_conf"},{"line_number":660,"context_line":"    condition: \u003e"},{"line_number":661,"context_line":"      (proc.name in (run-redis, redis-launcher.) and fd.name\u003d/etc/redis.conf or fd.name startswith /etc/redis)"},{"line_number":662,"context_line":"  - macro: openvpn_writing_conf"},{"line_number":663,"context_line":"    condition: (proc.name in (openvpn,openvpn-entrypo) and fd.name startswith /etc/openvpn)"},{"line_number":664,"context_line":"  - macro: php_handlers_writing_conf"},{"line_number":665,"context_line":"    condition: (proc.name\u003dphp_handlers_co and fd.name\u003d/etc/psa/php_versions.json)"},{"line_number":666,"context_line":"  - macro: sed_writing_temp_file"},{"line_number":667,"context_line":"    condition: \u003e"},{"line_number":668,"context_line":"      ((proc.aname[3]\u003dcron_start.sh and fd.name startswith /etc/security/sed) or"},{"line_number":669,"context_line":"       (proc.name\u003dsed and (fd.name startswith /etc/apt/sources.list.d/sed or"},{"line_number":670,"context_line":"                           fd.name startswith /etc/apt/sed or"},{"line_number":671,"context_line":"                           fd.name startswith /etc/apt/apt.conf.d/sed)))"},{"line_number":672,"context_line":"  - macro: cron_start_writing_pam_env"},{"line_number":673,"context_line":"    condition: (proc.cmdline\u003d\"bash /usr/sbin/start-cron\" and fd.name\u003d/etc/security/pam_env.conf)"},{"line_number":674,"context_line":"  - macro: dpkg_scripting"},{"line_number":675,"context_line":"    condition: (proc.aname[2] in (dpkg-reconfigur, dpkg-preconfigu))"},{"line_number":676,"context_line":"  - macro: user_known_write_etc_conditions"},{"line_number":677,"context_line":"    condition: proc.name\u003dconfd"},{"line_number":678,"context_line":"  - macro: write_etc_common"},{"line_number":679,"context_line":"    condition: \u003e"},{"line_number":680,"context_line":"      etc_dir and evt.dir \u003d \u003c and open_write"},{"line_number":681,"context_line":"      and proc_name_exists"},{"line_number":682,"context_line":"      and not proc.name in (passwd_binaries, shadowutils_binaries, sysdigcloud_binaries,"},{"line_number":683,"context_line":"                            package_mgmt_binaries, ssl_mgmt_binaries, dhcp_binaries,"},{"line_number":684,"context_line":"                            dev_creation_binaries, shell_mgmt_binaries,"},{"line_number":685,"context_line":"                            mail_config_binaries,"},{"line_number":686,"context_line":"                            sshkit_script_binaries,"},{"line_number":687,"context_line":"                            ldconfig.real, ldconfig, confd, gpg, insserv,"},{"line_number":688,"context_line":"                            apparmor_parser, update-mime, tzdata.config, tzdata.postinst,"},{"line_number":689,"context_line":"                            systemd, systemd-machine, systemd-sysuser,"},{"line_number":690,"context_line":"                            debconf-show, rollerd, bind9.postinst, sv,"},{"line_number":691,"context_line":"                            gen_resolvconf., update-ca-certi, certbot, runsv,"},{"line_number":692,"context_line":"                            qualys-cloud-ag, locales.postins, nomachine_binaries,"},{"line_number":693,"context_line":"                            adclient, certutil, crlutil, pam-auth-update, parallels_insta,"},{"line_number":694,"context_line":"                            openshift-launc, update-rc.d)"},{"line_number":695,"context_line":"      and not proc.pname in (sysdigcloud_binaries, mail_config_binaries, hddtemp.postins, sshkit_script_binaries, locales.postins, deb_binaries, dhcp_binaries)"},{"line_number":696,"context_line":"      and not fd.name pmatch (safe_etc_dirs)"},{"line_number":697,"context_line":"      and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json, /etc/motd, /etc/motd.svc)"},{"line_number":698,"context_line":"      and not sed_temporary_file"},{"line_number":699,"context_line":"      and not exe_running_docker_save"},{"line_number":700,"context_line":"      and not ansible_running_python"},{"line_number":701,"context_line":"      and not python_running_denyhosts"},{"line_number":702,"context_line":"      and not fluentd_writing_conf_files"},{"line_number":703,"context_line":"      and not user_known_write_etc_conditions"},{"line_number":704,"context_line":"      and not run_by_centrify"},{"line_number":705,"context_line":"      and not run_by_adclient"},{"line_number":706,"context_line":"      and not qualys_writing_conf_files"},{"line_number":707,"context_line":"      and not git_writing_nssdb"},{"line_number":708,"context_line":"      and not plesk_writing_keys"},{"line_number":709,"context_line":"      and not plesk_install_writing_apache_conf"},{"line_number":710,"context_line":"      and not plesk_running_mktemp"},{"line_number":711,"context_line":"      and not networkmanager_writing_resolv_conf"},{"line_number":712,"context_line":"      and not run_by_chef"},{"line_number":713,"context_line":"      and not add_shell_writing_shells_tmp"},{"line_number":714,"context_line":"      and not duply_writing_exclude_files"},{"line_number":715,"context_line":"      and not xmlcatalog_writing_files"},{"line_number":716,"context_line":"      and not parent_supervise_running_multilog"},{"line_number":717,"context_line":"      and not supervise_writing_status"},{"line_number":718,"context_line":"      and not pki_realm_writing_realms"},{"line_number":719,"context_line":"      and not htpasswd_writing_passwd"},{"line_number":720,"context_line":"      and not lvprogs_writing_conf"},{"line_number":721,"context_line":"      and not ovsdb_writing_openvswitch"},{"line_number":722,"context_line":"      and not datadog_writing_conf"},{"line_number":723,"context_line":"      and not curl_writing_pki_db"},{"line_number":724,"context_line":"      and not haproxy_writing_conf"},{"line_number":725,"context_line":"      and not java_writing_conf"},{"line_number":726,"context_line":"      and not dpkg_scripting"},{"line_number":727,"context_line":"      and not parent_ucf_writing_conf"},{"line_number":728,"context_line":"      and not rabbitmq_writing_conf"},{"line_number":729,"context_line":"      and not rook_writing_conf"},{"line_number":730,"context_line":"      and not php_handlers_writing_conf"},{"line_number":731,"context_line":"      and not sed_writing_temp_file"},{"line_number":732,"context_line":"      and not cron_start_writing_pam_env"},{"line_number":733,"context_line":"      and not httpd_writing_conf_logs"},{"line_number":734,"context_line":"      and not mysql_writing_conf"},{"line_number":735,"context_line":"      and not openvpn_writing_conf"},{"line_number":736,"context_line":"      and not consul_template_writing_conf"},{"line_number":737,"context_line":"      and not countly_writing_nginx_conf"},{"line_number":738,"context_line":"      and not ms_oms_writing_conf"},{"line_number":739,"context_line":"      and not ms_scx_writing_conf"},{"line_number":740,"context_line":"      and not azure_scripts_writing_conf"},{"line_number":741,"context_line":"      and not azure_networkwatcher_writing_conf"},{"line_number":742,"context_line":"      and not couchdb_writing_conf"},{"line_number":743,"context_line":"      and not update_texmf_writing_conf"},{"line_number":744,"context_line":"      and not slapadd_writing_conf"},{"line_number":745,"context_line":"      and not symantec_writing_conf"},{"line_number":746,"context_line":"      and not liveupdate_writing_conf"},{"line_number":747,"context_line":"      and not sosreport_writing_files"},{"line_number":748,"context_line":"      and not selinux_writing_conf"},{"line_number":749,"context_line":"      and not veritas_writing_config"},{"line_number":750,"context_line":"      and not nginx_writing_conf"},{"line_number":751,"context_line":"      and not nginx_writing_certs"},{"line_number":752,"context_line":"      and not chef_client_writing_conf"},{"line_number":753,"context_line":"      and not centrify_writing_krb"},{"line_number":754,"context_line":"      and not cockpit_writing_conf"},{"line_number":755,"context_line":"      and not ipsec_writing_conf"},{"line_number":756,"context_line":"      and not httpd_writing_ssl_conf"},{"line_number":757,"context_line":"      and not userhelper_writing_etc_security"},{"line_number":758,"context_line":"      and not pkgmgmt_progs_writing_pki"},{"line_number":759,"context_line":"      and not update_ca_trust_writing_pki"},{"line_number":760,"context_line":"      and not brandbot_writing_os_release"},{"line_number":761,"context_line":"      and not redis_writing_conf"},{"line_number":762,"context_line":"      and not openldap_writing_conf"},{"line_number":763,"context_line":"      and not ucpagent_writing_conf"},{"line_number":764,"context_line":"      and not iscsi_writing_conf"},{"line_number":765,"context_line":"  - rule: Write below etc"},{"line_number":766,"context_line":"    desc: an attempt to write to any file below /etc"},{"line_number":767,"context_line":"    condition: write_etc_common"},{"line_number":768,"context_line":"    output: \"File below /etc opened for writing (user\u003d%user.name command\u003d%proc.cmdline parent\u003d%proc.pname pcmdline\u003d%proc.pcmdline file\u003d%fd.name program\u003d%proc.name gparent\u003d%proc.aname[2] ggparent\u003d%proc.aname[3] gggparent\u003d%proc.aname[4])\""},{"line_number":769,"context_line":"    priority: ERROR"},{"line_number":770,"context_line":"    tags: [filesystem]"},{"line_number":771,"context_line":"  - list: known_root_files"},{"line_number":772,"context_line":"    items: [/root/.monit.state, /root/.auth_tokens, /root/.bash_history, /root/.ash_history, /root/.aws/credentials,"},{"line_number":773,"context_line":"            /root/.viminfo.tmp, /root/.lesshst, /root/.bzr.log, /root/.gitconfig.lock, /root/.babel.json, /root/.localstack,"},{"line_number":774,"context_line":"            /root/.node_repl_history, /root/.mongorc.js, /root/.dbshell, /root/.augeas/history, /root/.rnd, /root/.wget-hsts]"},{"line_number":775,"context_line":"  - list: known_root_directories"},{"line_number":776,"context_line":"    items: [/root/.oracle_jre_usage, /root/.ssh, /root/.subversion, /root/.nami]"},{"line_number":777,"context_line":"  - macro: known_root_conditions"},{"line_number":778,"context_line":"    condition: (fd.name startswith /root/orcexec."},{"line_number":779,"context_line":"                or fd.name startswith /root/.m2"},{"line_number":780,"context_line":"                or fd.name startswith /root/.npm"},{"line_number":781,"context_line":"                or fd.name startswith /root/.pki"},{"line_number":782,"context_line":"                or fd.name startswith /root/.ivy2"},{"line_number":783,"context_line":"                or fd.name startswith /root/.config/Cypress"},{"line_number":784,"context_line":"                or fd.name startswith /root/.config/pulse"},{"line_number":785,"context_line":"                or fd.name startswith /root/.config/configstore"},{"line_number":786,"context_line":"                or fd.name startswith /root/jenkins/workspace"},{"line_number":787,"context_line":"                or fd.name startswith /root/.jenkins"},{"line_number":788,"context_line":"                or fd.name startswith /root/.cache"},{"line_number":789,"context_line":"                or fd.name startswith /root/.sbt"},{"line_number":790,"context_line":"                or fd.name startswith /root/.java"},{"line_number":791,"context_line":"                or fd.name startswith /root/.glide"},{"line_number":792,"context_line":"                or fd.name startswith /root/.sonar"},{"line_number":793,"context_line":"                or fd.name startswith /root/.v8flag"},{"line_number":794,"context_line":"                or fd.name startswith /root/infaagent"},{"line_number":795,"context_line":"                or fd.name startswith /root/.local/lib/python"},{"line_number":796,"context_line":"                or fd.name startswith /root/.pm2"},{"line_number":797,"context_line":"                or fd.name startswith /root/.gnupg"},{"line_number":798,"context_line":"                or fd.name startswith /root/.pgpass"},{"line_number":799,"context_line":"                or fd.name startswith /root/.theano"},{"line_number":800,"context_line":"                or fd.name startswith /root/.gradle"},{"line_number":801,"context_line":"                or fd.name startswith /root/.android"},{"line_number":802,"context_line":"                or fd.name startswith /root/.ansible"},{"line_number":803,"context_line":"                or fd.name startswith /root/.crashlytics"},{"line_number":804,"context_line":"                or fd.name startswith /root/.dbus"},{"line_number":805,"context_line":"                or fd.name startswith /root/.composer"},{"line_number":806,"context_line":"                or fd.name startswith /root/.gconf"},{"line_number":807,"context_line":"                or fd.name startswith /root/.nv"},{"line_number":808,"context_line":"                or fd.name startswith /root/.local/share/jupyter"},{"line_number":809,"context_line":"                or fd.name startswith /root/oradiag_root"},{"line_number":810,"context_line":"                or fd.name startswith /root/workspace"},{"line_number":811,"context_line":"                or fd.name startswith /root/jvm"},{"line_number":812,"context_line":"                or fd.name startswith /root/.node-gyp)"},{"line_number":813,"context_line":"  - rule: Write below root"},{"line_number":814,"context_line":"    desc: an attempt to write to any file directly below / or /root"},{"line_number":815,"context_line":"    condition: \u003e"},{"line_number":816,"context_line":"      root_dir and evt.dir \u003d \u003c and open_write"},{"line_number":817,"context_line":"      and not fd.name in (known_root_files)"},{"line_number":818,"context_line":"      and not fd.directory in (known_root_directories)"},{"line_number":819,"context_line":"      and not exe_running_docker_save"},{"line_number":820,"context_line":"      and not gugent_writing_guestagent_log"},{"line_number":821,"context_line":"      and not dse_writing_tmp"},{"line_number":822,"context_line":"      and not zap_writing_state"},{"line_number":823,"context_line":"      and not airflow_writing_state"},{"line_number":824,"context_line":"      and not rpm_writing_root_rpmdb"},{"line_number":825,"context_line":"      and not maven_writing_groovy"},{"line_number":826,"context_line":"      and not known_root_conditions"},{"line_number":827,"context_line":"    output: \"File below / or /root opened for writing (user\u003d%user.name command\u003d%proc.cmdline parent\u003d%proc.pname file\u003d%fd.name program\u003d%proc.name)\""},{"line_number":828,"context_line":"    priority: ERROR"},{"line_number":829,"context_line":"    tags: [filesystem]"},{"line_number":830,"context_line":"  - macro: cmp_cp_by_passwd"},{"line_number":831,"context_line":"    condition: proc.name in (cmp, cp) and proc.pname in (passwd, run-parts)"},{"line_number":832,"context_line":"  - rule: Read sensitive file trusted after startup"},{"line_number":833,"context_line":"    desc: \u003e"},{"line_number":834,"context_line":"      an attempt to read any sensitive file (e.g. files containing user/password/authentication"},{"line_number":835,"context_line":"      information) by a trusted program after startup. Trusted programs might read these files"},{"line_number":836,"context_line":"      at startup to load initial state, but not afterwards."},{"line_number":837,"context_line":"    condition: sensitive_files and open_read and server_procs and not proc_is_new and proc.name!\u003d\"sshd\""},{"line_number":838,"context_line":"    output: \u003e"},{"line_number":839,"context_line":"      Sensitive file opened for reading by trusted program after startup (user\u003d%user.name"},{"line_number":840,"context_line":"      command\u003d%proc.cmdline parent\u003d%proc.pname file\u003d%fd.name parent\u003d%proc.pname gparent\u003d%proc.aname[2])"},{"line_number":841,"context_line":"    priority: WARNING"},{"line_number":842,"context_line":"    tags: [filesystem]"},{"line_number":843,"context_line":"  - list: read_sensitive_file_binaries"},{"line_number":844,"context_line":"    items: ["},{"line_number":845,"context_line":"      iptables, ps, lsb_release, check-new-relea, dumpe2fs, accounts-daemon, sshd,"},{"line_number":846,"context_line":"      vsftpd, systemd, mysql_install_d, psql, screen, debconf-show, sa-update,"},{"line_number":847,"context_line":"      pam-auth-update, pam-config, /usr/sbin/spamd, polkit-agent-he, lsattr, file, sosreport,"},{"line_number":848,"context_line":"      scxcimservera, adclient, rtvscand, cockpit-session, userhelper, ossec-syscheckd"},{"line_number":849,"context_line":"      ]"},{"line_number":850,"context_line":"  - macro: user_read_sensitive_file_conditions"},{"line_number":851,"context_line":"    condition: cmp_cp_by_passwd"},{"line_number":852,"context_line":"  - rule: Read sensitive file untrusted"},{"line_number":853,"context_line":"    desc: \u003e"},{"line_number":854,"context_line":"      an attempt to read any sensitive file (e.g. files containing user/password/authentication"},{"line_number":855,"context_line":"      information). Exceptions are made for known trusted programs."},{"line_number":856,"context_line":"    condition: \u003e"},{"line_number":857,"context_line":"      sensitive_files and open_read"},{"line_number":858,"context_line":"      and proc_name_exists"},{"line_number":859,"context_line":"      and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries,"},{"line_number":860,"context_line":"       cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries,"},{"line_number":861,"context_line":"       vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries,"},{"line_number":862,"context_line":"       in.proftpd, mandb, salt-minion, postgres_mgmt_binaries)"},{"line_number":863,"context_line":"      and not cmp_cp_by_passwd"},{"line_number":864,"context_line":"      and not ansible_running_python"},{"line_number":865,"context_line":"      and not proc.cmdline contains /usr/bin/mandb"},{"line_number":866,"context_line":"      and not run_by_qualys"},{"line_number":867,"context_line":"      and not run_by_chef"},{"line_number":868,"context_line":"      and not user_read_sensitive_file_conditions"},{"line_number":869,"context_line":"      and not perl_running_plesk"},{"line_number":870,"context_line":"      and not perl_running_updmap"},{"line_number":871,"context_line":"      and not veritas_driver_script"},{"line_number":872,"context_line":"      and not perl_running_centrifydc"},{"line_number":873,"context_line":"    output: \u003e"},{"line_number":874,"context_line":"      Sensitive file opened for reading by non-trusted program (user\u003d%user.name program\u003d%proc.name"},{"line_number":875,"context_line":"      command\u003d%proc.cmdline file\u003d%fd.name parent\u003d%proc.pname gparent\u003d%proc.aname[2] ggparent\u003d%proc.aname[3] gggparent\u003d%proc.aname[4])"},{"line_number":876,"context_line":"    priority: WARNING"},{"line_number":877,"context_line":"    tags: [filesystem]"},{"line_number":878,"context_line":"  - rule: Write below rpm database"},{"line_number":879,"context_line":"    desc: an attempt to write to the rpm database by any non-rpm related program"},{"line_number":880,"context_line":"    condition: fd.name startswith /var/lib/rpm and open_write and not rpm_procs and not ansible_running_python and not python_running_chef"},{"line_number":881,"context_line":"    output: \"Rpm database opened for writing by a non-rpm program (command\u003d%proc.cmdline file\u003d%fd.name parent\u003d%proc.pname pcmdline\u003d%proc.pcmdline)\""},{"line_number":882,"context_line":"    priority: ERROR"},{"line_number":883,"context_line":"    tags: [filesystem, software_mgmt]"},{"line_number":884,"context_line":"  - macro: postgres_running_wal_e"},{"line_number":885,"context_line":"    condition: (proc.pname\u003dpostgres and proc.cmdline startswith \"sh -c envdir /etc/wal-e.d/env /usr/local/bin/wal-e\")"},{"line_number":886,"context_line":"  - macro: redis_running_prepost_scripts"},{"line_number":887,"context_line":"    condition: (proc.aname[2]\u003dredis-server and (proc.cmdline contains \"redis-server.post-up.d\" or proc.cmdline contains \"redis-server.pre-up.d\"))"},{"line_number":888,"context_line":"  - macro: rabbitmq_running_scripts"},{"line_number":889,"context_line":"    condition: \u003e"},{"line_number":890,"context_line":"      (proc.pname\u003dbeam.smp and"},{"line_number":891,"context_line":"      (proc.cmdline startswith \"sh -c exec ps\" or"},{"line_number":892,"context_line":"       proc.cmdline startswith \"sh -c exec inet_gethost\" or"},{"line_number":893,"context_line":"       proc.cmdline\u003d \"sh -s unix:cmd\" or"},{"line_number":894,"context_line":"       proc.cmdline\u003d \"sh -c exec /bin/sh -s unix:cmd 2\u003e\u00261\"))"},{"line_number":895,"context_line":"  - macro: rabbitmqctl_running_scripts"},{"line_number":896,"context_line":"    condition: (proc.aname[2]\u003drabbitmqctl and proc.cmdline startswith \"sh -c \")"},{"line_number":897,"context_line":"  - macro: run_by_appdynamics"},{"line_number":898,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline startswith \"java -jar -Dappdynamics\")"},{"line_number":899,"context_line":"  - rule: DB program spawned process"},{"line_number":900,"context_line":"    desc: \u003e"},{"line_number":901,"context_line":"      a database-server related program spawned a new process other than itself."},{"line_number":902,"context_line":"      This shouldn\\\u0027t occur and is a follow on from some SQL injection attacks."},{"line_number":903,"context_line":"    condition: \u003e"},{"line_number":904,"context_line":"      proc.pname in (db_server_binaries)"},{"line_number":905,"context_line":"      and spawned_process"},{"line_number":906,"context_line":"      and not proc.name in (db_server_binaries)"},{"line_number":907,"context_line":"      and not postgres_running_wal_e"},{"line_number":908,"context_line":"    output: \u003e"},{"line_number":909,"context_line":"      Database-related program spawned process other than itself (user\u003d%user.name"},{"line_number":910,"context_line":"      program\u003d%proc.cmdline parent\u003d%proc.pname)"},{"line_number":911,"context_line":"    priority: NOTICE"},{"line_number":912,"context_line":"    tags: [process, database]"},{"line_number":913,"context_line":"  - rule: Modify binary dirs"},{"line_number":914,"context_line":"    desc: an attempt to modify any file below a set of binary directories."},{"line_number":915,"context_line":"    condition: (bin_dir_rename) and modify and not package_mgmt_procs and not exe_running_docker_save"},{"line_number":916,"context_line":"    output: \u003e"},{"line_number":917,"context_line":"      File below known binary directory renamed/removed (user\u003d%user.name command\u003d%proc.cmdline"},{"line_number":918,"context_line":"      pcmdline\u003d%proc.pcmdline operation\u003d%evt.type file\u003d%fd.name %evt.args)"},{"line_number":919,"context_line":"    priority: ERROR"},{"line_number":920,"context_line":"    tags: [filesystem]"},{"line_number":921,"context_line":"  - rule: Mkdir binary dirs"},{"line_number":922,"context_line":"    desc: an attempt to create a directory below a set of binary directories."},{"line_number":923,"context_line":"    condition: mkdir and bin_dir_mkdir and not package_mgmt_procs"},{"line_number":924,"context_line":"    output: \u003e"},{"line_number":925,"context_line":"      Directory below known binary directory created (user\u003d%user.name"},{"line_number":926,"context_line":"      command\u003d%proc.cmdline directory\u003d%evt.arg.path)"},{"line_number":927,"context_line":"    priority: ERROR"},{"line_number":928,"context_line":"    tags: [filesystem]"},{"line_number":929,"context_line":"  - list: user_known_change_thread_namespace_binaries"},{"line_number":930,"context_line":"    items: []"},{"line_number":931,"context_line":"  - rule: Change thread namespace"},{"line_number":932,"context_line":"    desc: \u003e"},{"line_number":933,"context_line":"      an attempt to change a program/thread\\\u0027s namespace (commonly done"},{"line_number":934,"context_line":"      as a part of creating a container) by calling setns."},{"line_number":935,"context_line":"    condition: \u003e"},{"line_number":936,"context_line":"      evt.type \u003d setns"},{"line_number":937,"context_line":"      and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, sysdig, nsenter)"},{"line_number":938,"context_line":"      and not proc.name in (user_known_change_thread_namespace_binaries)"},{"line_number":939,"context_line":"      and not proc.name startswith \"runc:\""},{"line_number":940,"context_line":"      and not proc.pname in (sysdigcloud_binaries)"},{"line_number":941,"context_line":"      and not java_running_sdjagent"},{"line_number":942,"context_line":"      and not kubelet_running_loopback"},{"line_number":943,"context_line":"    output: \u003e"},{"line_number":944,"context_line":"      Namespace change (setns) by unexpected program (user\u003d%user.name command\u003d%proc.cmdline"},{"line_number":945,"context_line":"      parent\u003d%proc.pname %container.info)"},{"line_number":946,"context_line":"    priority: NOTICE"},{"line_number":947,"context_line":"    tags: [process]"},{"line_number":948,"context_line":"  - list: protected_shell_spawning_binaries"},{"line_number":949,"context_line":"    items: ["},{"line_number":950,"context_line":"      http_server_binaries, db_server_binaries, nosql_server_binaries, mail_binaries,"},{"line_number":951,"context_line":"      fluentd, flanneld, splunkd, consul, smbd, runsv, PM2"},{"line_number":952,"context_line":"      ]"},{"line_number":953,"context_line":"  - macro: parent_java_running_zookeeper"},{"line_number":954,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains org.apache.zookeeper.server)"},{"line_number":955,"context_line":"  - macro: parent_java_running_kafka"},{"line_number":956,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains kafka.Kafka)"},{"line_number":957,"context_line":"  - macro: parent_java_running_elasticsearch"},{"line_number":958,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains org.elasticsearch.bootstrap.Elasticsearch)"},{"line_number":959,"context_line":"  - macro: parent_java_running_activemq"},{"line_number":960,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains activemq.jar)"},{"line_number":961,"context_line":"  - macro: parent_java_running_cassandra"},{"line_number":962,"context_line":"    condition: (proc.pname\u003djava and (proc.pcmdline contains \"-Dcassandra.config.loader\" or proc.pcmdline contains org.apache.cassandra.service.CassandraDaemon))"},{"line_number":963,"context_line":"  - macro: parent_java_running_jboss_wildfly"},{"line_number":964,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains org.jboss)"},{"line_number":965,"context_line":"  - macro: parent_java_running_glassfish"},{"line_number":966,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains com.sun.enterprise.glassfish)"},{"line_number":967,"context_line":"  - macro: parent_java_running_hadoop"},{"line_number":968,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains org.apache.hadoop)"},{"line_number":969,"context_line":"  - macro: parent_java_running_datastax"},{"line_number":970,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains com.datastax)"},{"line_number":971,"context_line":"  - macro: nginx_starting_nginx"},{"line_number":972,"context_line":"    condition: (proc.pname\u003dnginx and proc.cmdline contains \"/usr/sbin/nginx -c /etc/nginx/nginx.conf\")"},{"line_number":973,"context_line":"  - macro: nginx_running_aws_s3_cp"},{"line_number":974,"context_line":"    condition: (proc.pname\u003dnginx and proc.cmdline startswith \"sh -c /usr/local/bin/aws s3 cp\")"},{"line_number":975,"context_line":"  - macro: consul_running_net_scripts"},{"line_number":976,"context_line":"    condition: (proc.pname\u003dconsul and (proc.cmdline startswith \"sh -c curl\" or proc.cmdline startswith \"sh -c nc\"))"},{"line_number":977,"context_line":"  - macro: consul_running_alert_checks"},{"line_number":978,"context_line":"    condition: (proc.pname\u003dconsul and proc.cmdline startswith \"sh -c /bin/consul-alerts\")"},{"line_number":979,"context_line":"  - macro: serf_script"},{"line_number":980,"context_line":"    condition: (proc.cmdline startswith \"sh -c serf\")"},{"line_number":981,"context_line":"  - macro: check_process_status"},{"line_number":982,"context_line":"    condition: (proc.cmdline startswith \"sh -c kill -0 \")"},{"line_number":983,"context_line":"  - macro: possibly_node_in_container"},{"line_number":984,"context_line":"    condition: (never_true and (proc.pname\u003dnode and proc.aname[3]\u003ddocker-containe))"},{"line_number":985,"context_line":"  - macro: possibly_parent_java_running_tomcat"},{"line_number":986,"context_line":"    condition: (never_true and proc.pname\u003djava and proc.pcmdline contains org.apache.catalina.startup.Bootstrap)"},{"line_number":987,"context_line":"  - macro: protected_shell_spawner"},{"line_number":988,"context_line":"    condition: \u003e"},{"line_number":989,"context_line":"      (proc.aname in (protected_shell_spawning_binaries)"},{"line_number":990,"context_line":"      or parent_java_running_zookeeper"},{"line_number":991,"context_line":"      or parent_java_running_kafka"},{"line_number":992,"context_line":"      or parent_java_running_elasticsearch"},{"line_number":993,"context_line":"      or parent_java_running_activemq"},{"line_number":994,"context_line":"      or parent_java_running_cassandra"},{"line_number":995,"context_line":"      or parent_java_running_jboss_wildfly"},{"line_number":996,"context_line":"      or parent_java_running_glassfish"},{"line_number":997,"context_line":"      or parent_java_running_hadoop"},{"line_number":998,"context_line":"      or parent_java_running_datastax"},{"line_number":999,"context_line":"      or possibly_parent_java_running_tomcat"},{"line_number":1000,"context_line":"      or possibly_node_in_container)"},{"line_number":1001,"context_line":"  - list: mesos_shell_binaries"},{"line_number":1002,"context_line":"    items: [mesos-docker-ex, mesos-slave, mesos-health-ch]"},{"line_number":1003,"context_line":"  - rule: Run shell untrusted"},{"line_number":1004,"context_line":"    desc: an attempt to spawn a shell below a non-shell application. Specific applications are monitored."},{"line_number":1005,"context_line":"    condition: \u003e"},{"line_number":1006,"context_line":"      spawned_process"},{"line_number":1007,"context_line":"      and shell_procs"},{"line_number":1008,"context_line":"      and proc.pname exists"},{"line_number":1009,"context_line":"      and protected_shell_spawner"},{"line_number":1010,"context_line":"      and not proc.pname in (shell_binaries, gitlab_binaries, cron_binaries, user_known_shell_spawn_binaries,"},{"line_number":1011,"context_line":"                             needrestart_binaries,"},{"line_number":1012,"context_line":"                             mesos_shell_binaries,"},{"line_number":1013,"context_line":"                             erl_child_setup, exechealthz,"},{"line_number":1014,"context_line":"                             PM2, PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf,"},{"line_number":1015,"context_line":"                             lb-controller, nvidia-installe, runsv, statsite, erlexec)"},{"line_number":1016,"context_line":"      and not proc.cmdline in (known_shell_spawn_cmdlines)"},{"line_number":1017,"context_line":"      and not proc.aname in (unicorn_launche)"},{"line_number":1018,"context_line":"      and not consul_running_net_scripts"},{"line_number":1019,"context_line":"      and not consul_running_alert_checks"},{"line_number":1020,"context_line":"      and not nginx_starting_nginx"},{"line_number":1021,"context_line":"      and not nginx_running_aws_s3_cp"},{"line_number":1022,"context_line":"      and not run_by_package_mgmt_binaries"},{"line_number":1023,"context_line":"      and not serf_script"},{"line_number":1024,"context_line":"      and not check_process_status"},{"line_number":1025,"context_line":"      and not run_by_foreman"},{"line_number":1026,"context_line":"      and not python_mesos_marathon_scripting"},{"line_number":1027,"context_line":"      and not splunk_running_forwarder"},{"line_number":1028,"context_line":"      and not postgres_running_wal_e"},{"line_number":1029,"context_line":"      and not redis_running_prepost_scripts"},{"line_number":1030,"context_line":"      and not rabbitmq_running_scripts"},{"line_number":1031,"context_line":"      and not rabbitmqctl_running_scripts"},{"line_number":1032,"context_line":"      and not run_by_appdynamics"},{"line_number":1033,"context_line":"      and not user_shell_container_exclusions"},{"line_number":1034,"context_line":"    output: \u003e"},{"line_number":1035,"context_line":"      Shell spawned by untrusted binary (user\u003d%user.name shell\u003d%proc.name parent\u003d%proc.pname"},{"line_number":1036,"context_line":"      cmdline\u003d%proc.cmdline pcmdline\u003d%proc.pcmdline gparent\u003d%proc.aname[2] ggparent\u003d%proc.aname[3]"},{"line_number":1037,"context_line":"      aname[4]\u003d%proc.aname[4] aname[5]\u003d%proc.aname[5] aname[6]\u003d%proc.aname[6] aname[7]\u003d%proc.aname[7])"},{"line_number":1038,"context_line":"    priority: DEBUG"},{"line_number":1039,"context_line":"    tags: [shell]"},{"line_number":1040,"context_line":"  - macro: trusted_containers"},{"line_number":1041,"context_line":"    condition: (container.image startswith sysdig/agent or"},{"line_number":1042,"context_line":"                (container.image startswith sysdig/falco and"},{"line_number":1043,"context_line":"                 not container.image startswith sysdig/falco-event-generator) or"},{"line_number":1044,"context_line":"                container.image startswith quay.io/sysdig or"},{"line_number":1045,"context_line":"                container.image startswith sysdig/sysdig or"},{"line_number":1046,"context_line":"                container.image startswith gcr.io/google_containers/hyperkube or"},{"line_number":1047,"context_line":"                container.image startswith quay.io/coreos/flannel or"},{"line_number":1048,"context_line":"                container.image startswith gcr.io/google_containers/kube-proxy or"},{"line_number":1049,"context_line":"                container.image startswith calico/node or"},{"line_number":1050,"context_line":"                container.image startswith rook/toolbox or"},{"line_number":1051,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/logging-fluentd or"},{"line_number":1052,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/logging-elasticsearch or"},{"line_number":1053,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/metrics-cassandra or"},{"line_number":1054,"context_line":"                container.image startswith openshift3/ose-sti-builder or"},{"line_number":1055,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/ose-sti-builder or"},{"line_number":1056,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/ose-docker-builder or"},{"line_number":1057,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/image-inspector or"},{"line_number":1058,"context_line":"                container.image startswith cloudnativelabs/kube-router or"},{"line_number":1059,"context_line":"                container.image startswith \"consul:\" or"},{"line_number":1060,"context_line":"                container.image startswith mesosphere/mesos-slave or"},{"line_number":1061,"context_line":"                container.image startswith istio/proxy_ or"},{"line_number":1062,"context_line":"                container.image startswith datadog/docker-dd-agent or"},{"line_number":1063,"context_line":"                container.image startswith datadog/agent or"},{"line_number":1064,"context_line":"                container.image startswith docker/ucp-agent or"},{"line_number":1065,"context_line":"                container.image startswith gliderlabs/logspout)"},{"line_number":1066,"context_line":"  - macro: user_trusted_containers"},{"line_number":1067,"context_line":"    condition: (container.image startswith sysdig/agent)"},{"line_number":1068,"context_line":"  - macro: user_sensitive_mount_containers"},{"line_number":1069,"context_line":"    condition: (container.image startswith sysdig/agent)"},{"line_number":1070,"context_line":"  - rule: Launch Privileged Container"},{"line_number":1071,"context_line":"    desc: Detect the initial process started in a privileged container. Exceptions are made for known trusted images."},{"line_number":1072,"context_line":"    condition: \u003e"},{"line_number":1073,"context_line":"      evt.type\u003dexecve and proc.vpid\u003d1 and container"},{"line_number":1074,"context_line":"      and container.privileged\u003dtrue"},{"line_number":1075,"context_line":"      and not trusted_containers"},{"line_number":1076,"context_line":"      and not user_trusted_containers"},{"line_number":1077,"context_line":"    output: Privileged container started (user\u003d%user.name command\u003d%proc.cmdline %container.info image\u003d%container.image)"},{"line_number":1078,"context_line":"    priority: INFO"},{"line_number":1079,"context_line":"    tags: [container, cis]"},{"line_number":1080,"context_line":"  - macro: sensitive_mount"},{"line_number":1081,"context_line":"    condition: (container.mount.dest[/proc*] !\u003d \"N/A\" or"},{"line_number":1082,"context_line":"                container.mount.dest[/var/run/docker.sock] !\u003d \"N/A\" or"},{"line_number":1083,"context_line":"                container.mount.dest[/] !\u003d \"N/A\" or"},{"line_number":1084,"context_line":"                container.mount.dest[/etc] !\u003d \"N/A\" or"},{"line_number":1085,"context_line":"                container.mount.dest[/root*] !\u003d \"N/A\")"},{"line_number":1086,"context_line":"  - macro: container_entrypoint"},{"line_number":1087,"context_line":"    condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], docker-runc, exe))"},{"line_number":1088,"context_line":"  - rule: Launch Sensitive Mount Container"},{"line_number":1089,"context_line":"    desc: \u003e"},{"line_number":1090,"context_line":"      Detect the initial process started by a container that has a mount from a sensitive host directory"},{"line_number":1091,"context_line":"      (i.e. /proc). Exceptions are made for known trusted images."},{"line_number":1092,"context_line":"    condition: \u003e"},{"line_number":1093,"context_line":"      evt.type\u003dexecve and proc.vpid\u003d1 and container"},{"line_number":1094,"context_line":"      and sensitive_mount"},{"line_number":1095,"context_line":"      and not trusted_containers"},{"line_number":1096,"context_line":"      and not user_sensitive_mount_containers"},{"line_number":1097,"context_line":"    output: Container with sensitive mount started (user\u003d%user.name command\u003d%proc.cmdline %container.info image\u003d%container.image mounts\u003d%container.mounts)"},{"line_number":1098,"context_line":"    priority: INFO"},{"line_number":1099,"context_line":"    tags: [container, cis]"},{"line_number":1100,"context_line":"  - macro: allowed_containers"},{"line_number":1101,"context_line":"    condition: (proc.vpid\u003d1)"},{"line_number":1102,"context_line":"  - rule: Launch Disallowed Container"},{"line_number":1103,"context_line":"    desc: \u003e"},{"line_number":1104,"context_line":"      Detect the initial process started by a container that is not in a list of allowed containers."},{"line_number":1105,"context_line":"    condition: evt.type\u003dexecve and proc.vpid\u003d1 and container and not allowed_containers"},{"line_number":1106,"context_line":"    output: Container started and not in allowed list (user\u003d%user.name command\u003d%proc.cmdline %container.info image\u003d%container.image)"},{"line_number":1107,"context_line":"    priority: WARNING"},{"line_number":1108,"context_line":"    tags: [container]"},{"line_number":1109,"context_line":"  - rule: System user interactive"},{"line_number":1110,"context_line":"    desc: an attempt to run interactive commands by a system (i.e. non-login) user"},{"line_number":1111,"context_line":"    condition: spawned_process and system_users and interactive"},{"line_number":1112,"context_line":"    output: \"System user ran an interactive command (user\u003d%user.name command\u003d%proc.cmdline)\""},{"line_number":1113,"context_line":"    priority: INFO"},{"line_number":1114,"context_line":"    tags: [users]"},{"line_number":1115,"context_line":"  - rule: Terminal shell in container"},{"line_number":1116,"context_line":"    desc: A shell was used as the entrypoint/exec point into a container with an attached terminal."},{"line_number":1117,"context_line":"    condition: \u003e"},{"line_number":1118,"context_line":"      spawned_process and container"},{"line_number":1119,"context_line":"      and shell_procs and proc.tty !\u003d 0"},{"line_number":1120,"context_line":"      and container_entrypoint"},{"line_number":1121,"context_line":"    output: \u003e"},{"line_number":1122,"context_line":"      A shell was spawned in a container with an attached terminal (user\u003d%user.name %container.info"},{"line_number":1123,"context_line":"      shell\u003d%proc.name parent\u003d%proc.pname cmdline\u003d%proc.cmdline terminal\u003d%proc.tty)"},{"line_number":1124,"context_line":"    priority: NOTICE"},{"line_number":1125,"context_line":"    tags: [container, shell]"},{"line_number":1126,"context_line":"  - list: known_shell_spawn_cmdlines"},{"line_number":1127,"context_line":"    items: ["},{"line_number":1128,"context_line":"      \u0027\"sh -c uname -p 2\u003e /dev/null\"\u0027,"},{"line_number":1129,"context_line":"      \u0027\"sh -c uname -s 2\u003e\u00261\"\u0027,"},{"line_number":1130,"context_line":"      \u0027\"sh -c uname -r 2\u003e\u00261\"\u0027,"},{"line_number":1131,"context_line":"      \u0027\"sh -c uname -v 2\u003e\u00261\"\u0027,"},{"line_number":1132,"context_line":"      \u0027\"sh -c uname -a 2\u003e\u00261\"\u0027,"},{"line_number":1133,"context_line":"      \u0027\"sh -c ruby -v 2\u003e\u00261\"\u0027,"},{"line_number":1134,"context_line":"      \u0027\"sh -c getconf CLK_TCK\"\u0027,"},{"line_number":1135,"context_line":"      \u0027\"sh -c getconf PAGESIZE\"\u0027,"},{"line_number":1136,"context_line":"      \u0027\"sh -c LC_ALL\u003dC LANG\u003dC /sbin/ldconfig -p 2\u003e/dev/null\"\u0027,"},{"line_number":1137,"context_line":"      \u0027\"sh -c LANG\u003dC /sbin/ldconfig -p 2\u003e/dev/null\"\u0027,"},{"line_number":1138,"context_line":"      \u0027\"sh -c /sbin/ldconfig -p 2\u003e/dev/null\"\u0027,"},{"line_number":1139,"context_line":"      \u0027\"sh -c stty -a 2\u003e/dev/null\"\u0027,"},{"line_number":1140,"context_line":"      \u0027\"sh -c stty -a \u003c /dev/tty\"\u0027,"},{"line_number":1141,"context_line":"      \u0027\"sh -c stty -g \u003c /dev/tty\"\u0027,"},{"line_number":1142,"context_line":"      \u0027\"sh -c node index.js\"\u0027,"},{"line_number":1143,"context_line":"      \u0027\"sh -c node index\"\u0027,"},{"line_number":1144,"context_line":"      \u0027\"sh -c node ./src/start.js\"\u0027,"},{"line_number":1145,"context_line":"      \u0027\"sh -c node app.js\"\u0027,"},{"line_number":1146,"context_line":"      \u0027\"sh -c node -e \\\"require(\u0027\u0027nan\u0027\u0027)\\\"\"\u0027,"},{"line_number":1147,"context_line":"      \u0027\"sh -c node -e \\\"require(\u0027\u0027nan\u0027\u0027)\\\")\"\u0027,"},{"line_number":1148,"context_line":"      \u0027\"sh -c node $NODE_DEBUG_OPTION index.js \"\u0027,"},{"line_number":1149,"context_line":"      \u0027\"sh -c crontab -l 2\"\u0027,"},{"line_number":1150,"context_line":"      \u0027\"sh -c lsb_release -a\"\u0027,"},{"line_number":1151,"context_line":"      \u0027\"sh -c lsb_release -is 2\u003e/dev/null\"\u0027,"},{"line_number":1152,"context_line":"      \u0027\"sh -c whoami\"\u0027,"},{"line_number":1153,"context_line":"      \u0027\"sh -c node_modules/.bin/bower-installer\"\u0027,"},{"line_number":1154,"context_line":"      \u0027\"sh -c /bin/hostname -f 2\u003e /dev/null\"\u0027,"},{"line_number":1155,"context_line":"      \u0027\"sh -c locale -a\"\u0027,"},{"line_number":1156,"context_line":"      \u0027\"sh -c  -t -i\"\u0027,"},{"line_number":1157,"context_line":"      \u0027\"sh -c openssl version\"\u0027,"},{"line_number":1158,"context_line":"      \u0027\"bash -c id -Gn kafadmin\"\u0027,"},{"line_number":1159,"context_line":"      \u0027\"sh -c /bin/sh -c \u0027\u0027date +%%s\u0027\u0027\"\u0027"},{"line_number":1160,"context_line":"      ]"},{"line_number":1161,"context_line":"  - list: user_known_shell_spawn_binaries"},{"line_number":1162,"context_line":"    items: []"},{"line_number":1163,"context_line":"  - macro: user_shell_container_exclusions"},{"line_number":1164,"context_line":"    condition: (never_true)"},{"line_number":1165,"context_line":"  - macro: login_doing_dns_lookup"},{"line_number":1166,"context_line":"    condition: (proc.name\u003dlogin and fd.l4proto\u003dudp and fd.sport\u003d53)"},{"line_number":1167,"context_line":"  - rule: System procs network activity"},{"line_number":1168,"context_line":"    desc: any network activity performed by system binaries that are not expected to send or receive any network traffic"},{"line_number":1169,"context_line":"    condition: \u003e"},{"line_number":1170,"context_line":"      (fd.sockfamily \u003d ip and system_procs)"},{"line_number":1171,"context_line":"      and (inbound_outbound)"},{"line_number":1172,"context_line":"      and not proc.name in (systemd, hostid, id)"},{"line_number":1173,"context_line":"      and not login_doing_dns_lookup"},{"line_number":1174,"context_line":"    output: \u003e"},{"line_number":1175,"context_line":"      Known system binary sent/received network traffic"},{"line_number":1176,"context_line":"      (user\u003d%user.name command\u003d%proc.cmdline connection\u003d%fd.name)"},{"line_number":1177,"context_line":"    priority: NOTICE"},{"line_number":1178,"context_line":"    tags: [network]"},{"line_number":1179,"context_line":"  - list: openvpn_udp_ports"},{"line_number":1180,"context_line":"    items: [1194, 1197, 1198, 8080, 9201]"},{"line_number":1181,"context_line":"  - list: l2tp_udp_ports"},{"line_number":1182,"context_line":"    items: [500, 1701, 4500, 10000]"},{"line_number":1183,"context_line":"  - list: statsd_ports"},{"line_number":1184,"context_line":"    items: [8125]"},{"line_number":1185,"context_line":"  - list: ntp_ports"},{"line_number":1186,"context_line":"    items: [123]"},{"line_number":1187,"context_line":"  - list: test_connect_ports"},{"line_number":1188,"context_line":"    items: [0, 9, 80, 3306]"},{"line_number":1189,"context_line":"  - macro: do_unexpected_udp_check"},{"line_number":1190,"context_line":"    condition: (never_true)"},{"line_number":1191,"context_line":"  - list: expected_udp_ports"},{"line_number":1192,"context_line":"    items: [53, openvpn_udp_ports, l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports]"},{"line_number":1193,"context_line":"  - macro: expected_udp_traffic"},{"line_number":1194,"context_line":"    condition: fd.port in (expected_udp_ports)"},{"line_number":1195,"context_line":"  - rule: Unexpected UDP Traffic"},{"line_number":1196,"context_line":"    desc: UDP traffic not on port 53 (DNS) or other commonly used ports"},{"line_number":1197,"context_line":"    condition: (inbound_outbound) and do_unexpected_udp_check and fd.l4proto\u003dudp and not expected_udp_traffic"},{"line_number":1198,"context_line":"    output: \u003e"},{"line_number":1199,"context_line":"      Unexpected UDP Traffic Seen"},{"line_number":1200,"context_line":"      (user\u003d%user.name command\u003d%proc.cmdline connection\u003d%fd.name proto\u003d%fd.l4proto evt\u003d%evt.type %evt.args)"},{"line_number":1201,"context_line":"    priority: NOTICE"},{"line_number":1202,"context_line":"    tags: [network]"},{"line_number":1203,"context_line":"  - macro: somebody_becoming_themself"},{"line_number":1204,"context_line":"    condition: ((user.name\u003dnobody and evt.arg.uid\u003dnobody) or"},{"line_number":1205,"context_line":"                (user.name\u003dwww-data and evt.arg.uid\u003dwww-data) or"},{"line_number":1206,"context_line":"                (user.name\u003d_apt and evt.arg.uid\u003d_apt) or"},{"line_number":1207,"context_line":"                (user.name\u003dpostfix and evt.arg.uid\u003dpostfix) or"},{"line_number":1208,"context_line":"                (user.name\u003dpki-agent and evt.arg.uid\u003dpki-agent) or"},{"line_number":1209,"context_line":"                (user.name\u003dpki-acme and evt.arg.uid\u003dpki-acme) or"},{"line_number":1210,"context_line":"                (user.name\u003dnfsnobody and evt.arg.uid\u003dnfsnobody) or"},{"line_number":1211,"context_line":"                (user.name\u003dpostgres and evt.arg.uid\u003dpostgres))"},{"line_number":1212,"context_line":"  - macro: nrpe_becoming_nagios"},{"line_number":1213,"context_line":"    condition: (proc.name\u003dnrpe and evt.arg.uid\u003dnagios)"},{"line_number":1214,"context_line":"  - macro: known_user_in_container"},{"line_number":1215,"context_line":"    condition: (container and user.name !\u003d \"N/A\")"},{"line_number":1216,"context_line":"  - rule: Non sudo setuid"},{"line_number":1217,"context_line":"    desc: \u003e"},{"line_number":1218,"context_line":"      an attempt to change users by calling setuid. sudo/su are excluded. users \"root\" and \"nobody\""},{"line_number":1219,"context_line":"      suing to itself are also excluded, as setuid calls typically involve dropping privileges."},{"line_number":1220,"context_line":"    condition: \u003e"},{"line_number":1221,"context_line":"      evt.type\u003dsetuid and evt.dir\u003d\u003e"},{"line_number":1222,"context_line":"      and (known_user_in_container or not container)"},{"line_number":1223,"context_line":"      and not user.name\u003droot and not somebody_becoming_themself"},{"line_number":1224,"context_line":"      and not proc.name in (known_setuid_binaries, userexec_binaries, mail_binaries, docker_binaries,"},{"line_number":1225,"context_line":"                            nomachine_binaries)"},{"line_number":1226,"context_line":"      and not java_running_sdjagent"},{"line_number":1227,"context_line":"      and not nrpe_becoming_nagios"},{"line_number":1228,"context_line":"    output: \u003e"},{"line_number":1229,"context_line":"      Unexpected setuid call by non-sudo, non-root program (user\u003d%user.name cur_uid\u003d%user.uid parent\u003d%proc.pname"},{"line_number":1230,"context_line":"      command\u003d%proc.cmdline uid\u003d%evt.arg.uid)"},{"line_number":1231,"context_line":"    priority: NOTICE"},{"line_number":1232,"context_line":"    tags: [users]"},{"line_number":1233,"context_line":"  - rule: User mgmt binaries"},{"line_number":1234,"context_line":"    desc: \u003e"},{"line_number":1235,"context_line":"      activity by any programs that can manage users, passwords, or permissions. sudo and su are excluded."},{"line_number":1236,"context_line":"      Activity in containers is also excluded--some containers create custom users on top"},{"line_number":1237,"context_line":"      of a base linux distribution at startup."},{"line_number":1238,"context_line":"      Some innocuous commandlines that don\u0027t actually change anything are excluded."},{"line_number":1239,"context_line":"    condition: \u003e"},{"line_number":1240,"context_line":"      spawned_process and proc.name in (user_mgmt_binaries) and"},{"line_number":1241,"context_line":"      not proc.name in (su, sudo, lastlog, nologin, unix_chkpwd) and not container and"},{"line_number":1242,"context_line":"      not proc.pname in (cron_binaries, systemd, systemd.postins, udev.postinst, run-parts) and"},{"line_number":1243,"context_line":"      not proc.cmdline startswith \"passwd -S\" and"},{"line_number":1244,"context_line":"      not proc.cmdline startswith \"useradd -D\" and"},{"line_number":1245,"context_line":"      not proc.cmdline startswith \"systemd --version\" and"},{"line_number":1246,"context_line":"      not run_by_qualys and"},{"line_number":1247,"context_line":"      not run_by_sumologic_securefiles and"},{"line_number":1248,"context_line":"      not run_by_yum and"},{"line_number":1249,"context_line":"      not run_by_ms_oms and"},{"line_number":1250,"context_line":"      not run_by_google_accounts_daemon"},{"line_number":1251,"context_line":"    output: \u003e"},{"line_number":1252,"context_line":"      User management binary command run outside of container"},{"line_number":1253,"context_line":"      (user\u003d%user.name command\u003d%proc.cmdline parent\u003d%proc.pname gparent\u003d%proc.aname[2] ggparent\u003d%proc.aname[3] gggparent\u003d%proc.aname[4])"},{"line_number":1254,"context_line":"    priority: NOTICE"},{"line_number":1255,"context_line":"    tags: [host, users]"},{"line_number":1256,"context_line":"  - list: allowed_dev_files"},{"line_number":1257,"context_line":"    items: ["},{"line_number":1258,"context_line":"      /dev/null, /dev/stdin, /dev/stdout, /dev/stderr,"},{"line_number":1259,"context_line":"      /dev/random, /dev/urandom, /dev/console, /dev/kmsg"},{"line_number":1260,"context_line":"      ]"},{"line_number":1261,"context_line":"  - rule: Create files below dev"},{"line_number":1262,"context_line":"    desc: creating any files below /dev other than known programs that manage devices. Some rootkits hide files in /dev."},{"line_number":1263,"context_line":"    condition: \u003e"},{"line_number":1264,"context_line":"      fd.directory \u003d /dev and"},{"line_number":1265,"context_line":"      (evt.type \u003d creat or (evt.type \u003d open and evt.arg.flags contains O_CREAT))"},{"line_number":1266,"context_line":"      and not proc.name in (dev_creation_binaries)"},{"line_number":1267,"context_line":"      and not fd.name in (allowed_dev_files)"},{"line_number":1268,"context_line":"      and not fd.name startswith /dev/tty"},{"line_number":1269,"context_line":"    output: \"File created below /dev by untrusted program (user\u003d%user.name command\u003d%proc.cmdline file\u003d%fd.name)\""},{"line_number":1270,"context_line":"    priority: ERROR"},{"line_number":1271,"context_line":"    tags: [filesystem]"},{"line_number":1272,"context_line":"  - macro: ec2_metadata_containers"},{"line_number":1273,"context_line":"    condition: container"},{"line_number":1274,"context_line":"  - rule: Contact EC2 Instance Metadata Service From Container"},{"line_number":1275,"context_line":"    desc: Detect attempts to contact the EC2 Instance Metadata Service from a container"},{"line_number":1276,"context_line":"    condition: outbound and fd.sip\u003d\"169.254.169.254\" and container and not ec2_metadata_containers"},{"line_number":1277,"context_line":"    output: Outbound connection to EC2 instance metadata service (command\u003d%proc.cmdline connection\u003d%fd.name %container.info image\u003d%container.image)"},{"line_number":1278,"context_line":"    priority: NOTICE"},{"line_number":1279,"context_line":"    tags: [network, aws, container]"},{"line_number":1280,"context_line":"  - macro: k8s_api_server"},{"line_number":1281,"context_line":"    condition: (fd.sip\u003d\"1.2.3.4\" and fd.sport\u003d8080)"},{"line_number":1282,"context_line":"  - macro: k8s_containers"},{"line_number":1283,"context_line":"    condition: \u003e"},{"line_number":1284,"context_line":"      (container.image startswith gcr.io/google_containers/hyperkube-amd64 or"},{"line_number":1285,"context_line":"       container.image startswith gcr.io/google_containers/kube2sky or"},{"line_number":1286,"context_line":"       container.image startswith sysdig/agent or"},{"line_number":1287,"context_line":"       container.image startswith sysdig/falco or"},{"line_number":1288,"context_line":"       container.image startswith sysdig/sysdig)"},{"line_number":1289,"context_line":"  - rule: Contact K8S API Server From Container"},{"line_number":1290,"context_line":"    desc: Detect attempts to contact the K8S API Server from a container"},{"line_number":1291,"context_line":"    condition: outbound and k8s_api_server and container and not k8s_containers"},{"line_number":1292,"context_line":"    output: Unexpected connection to K8s API Server from container (command\u003d%proc.cmdline %container.info image\u003d%container.image connection\u003d%fd.name)"},{"line_number":1293,"context_line":"    priority: NOTICE"},{"line_number":1294,"context_line":"    tags: [network, k8s, container]"},{"line_number":1295,"context_line":"  - macro: nodeport_containers"},{"line_number":1296,"context_line":"    condition: container"},{"line_number":1297,"context_line":"  - rule: Unexpected K8s NodePort Connection"},{"line_number":1298,"context_line":"    desc: Detect attempts to use K8s NodePorts from a container"},{"line_number":1299,"context_line":"    condition: (inbound_outbound) and fd.sport \u003e\u003d 30000 and fd.sport \u003c\u003d 32767 and container and not nodeport_containers"},{"line_number":1300,"context_line":"    output: Unexpected K8s NodePort Connection (command\u003d%proc.cmdline connection\u003d%fd.name)"},{"line_number":1301,"context_line":"    priority: NOTICE"},{"line_number":1302,"context_line":"    tags: [network, k8s, container]"},{"line_number":1303,"context_line":""},{"line_number":1304,"context_line":"falco_rules_local: |"},{"line_number":1305,"context_line":"####################"},{"line_number":1306,"context_line":"# Your custom rules!"},{"line_number":1307,"context_line":"####################"},{"line_number":1308,"context_line":""},{"line_number":1309,"context_line":"# Add new rules, like this one"},{"line_number":1310,"context_line":"# - rule: The program \"sudo\" is run in a container"},{"line_number":1311,"context_line":"#   desc: An event will trigger every time you run sudo in a container"},{"line_number":1312,"context_line":"#   condition: evt.type \u003d execve and evt.dir\u003d\u003c and container.id !\u003d host and proc.name \u003d sudo"},{"line_number":1313,"context_line":"#   output: \"Sudo run in container (user\u003d%user.name %container.info parent\u003d%proc.pname cmdline\u003d%proc.cmdline)\""},{"line_number":1314,"context_line":"#   priority: ERROR"},{"line_number":1315,"context_line":"#   tags: [users, container]"},{"line_number":1316,"context_line":""},{"line_number":1317,"context_line":"# Or override/append to any rule, macro, or list from the Default Rules"},{"line_number":1318,"context_line":"customRules: {}"},{"line_number":1319,"context_line":"  # Although Falco comes with a nice default rule set for detecting weird"},{"line_number":1320,"context_line":"  # behavior in containers, our users are going to customize the run-time"},{"line_number":1321,"context_line":"  # security rule sets or policies for the specific container images and"},{"line_number":1322,"context_line":"  # applications they run. This feature can be handled in this section."},{"line_number":1323,"context_line":"  #"},{"line_number":1324,"context_line":"  # Example:"},{"line_number":1325,"context_line":"  #"},{"line_number":1326,"context_line":"  # rules-traefik.yaml: |-"},{"line_number":1327,"context_line":"  #   [ rule body ]"},{"line_number":1328,"context_line":""},{"line_number":1329,"context_line":"# Allow falco to run on Kubernetes 1.6 masters."},{"line_number":1330,"context_line":"tolerations:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_4399a96a","line":1327,"range":{"start_line":42,"start_character":0,"end_line":1327,"end_character":19},"updated":"2018-09-05 15:14:37.000000000","message":"can we move this to be under a `conf` top-level key inline with other charts.","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"d6de112dda745c88c8b730231f5bacb0aa5fa068","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  # them as necessary, and remove the curly braces after \u0027resources:\u0027."},{"line_number":40,"context_line":"  # updateStrategy: RollingUpdate"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"falco:"},{"line_number":43,"context_line":"  # The location of the rules file(s). This can contain one or more paths to"},{"line_number":44,"context_line":"  # separate rules files."},{"line_number":45,"context_line":"  rulesFile:"},{"line_number":46,"context_line":"    - /etc/falco/falco_rules.yaml"},{"line_number":47,"context_line":"    - /etc/falco/falco_rules.local.yaml"},{"line_number":48,"context_line":"    - /etc/falco/rules.d"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"  # Whether to output events in json or text"},{"line_number":51,"context_line":"  jsonOutput: false"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"  # When using json output, whether or not to include the \"output\" property"},{"line_number":54,"context_line":"  # itself (e.g. \"File below a known binary directory opened for writing"},{"line_number":55,"context_line":"  # (user\u003droot ....\") in the json output."},{"line_number":56,"context_line":"  jsonIncludeOutputProperty: true"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"  # Send information logs to stderr and/or syslog Note these are *not* security"},{"line_number":59,"context_line":"  # notification logs! These are just Falco lifecycle (and possibly error) logs."},{"line_number":60,"context_line":"  logStderr: true"},{"line_number":61,"context_line":"  logSyslog: true"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"  # Minimum log level to include in logs. Note: these levels are"},{"line_number":64,"context_line":"  # separate from the priority field of rules. This refers only to the"},{"line_number":65,"context_line":"  # log level of falco\u0027s internal logging. Can be one of \"emergency\","},{"line_number":66,"context_line":"  # \"alert\", \"critical\", \"error\", \"warning\", \"notice\", \"info\", \"debug\"."},{"line_number":67,"context_line":"  logLevel: info"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  # Minimum rule priority level to load and run. All rules having a"},{"line_number":70,"context_line":"  # priority more severe than this level will be loaded/run.  Can be one"},{"line_number":71,"context_line":"  # of \"emergency\", \"alert\", \"critical\", \"error\", \"warning\", \"notice\","},{"line_number":72,"context_line":"  # \"info\", \"debug\"."},{"line_number":73,"context_line":"  priority: debug"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"  # Whether or not output to any of the output channels below is"},{"line_number":76,"context_line":"  # buffered."},{"line_number":77,"context_line":"  bufferedOutputs: false"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"  # A throttling mechanism implemented as a token bucket limits the"},{"line_number":80,"context_line":"  # rate of falco notifications. This throttling is controlled by the following configuration"},{"line_number":81,"context_line":"  # options:"},{"line_number":82,"context_line":"  #  - rate: the number of tokens (i.e. right to send a notification)"},{"line_number":83,"context_line":"  #    gained per second. Defaults to 1."},{"line_number":84,"context_line":"  #  - max_burst: the maximum number of tokens outstanding. Defaults to 1000."},{"line_number":85,"context_line":"  #"},{"line_number":86,"context_line":"  # With these defaults, falco could send up to 1000 notifications after"},{"line_number":87,"context_line":"  # an initial quiet period, and then up to 1 notification per second"},{"line_number":88,"context_line":"  # afterward. It would gain the full burst back after 1000 seconds of"},{"line_number":89,"context_line":"  # no activity."},{"line_number":90,"context_line":"  outputs:"},{"line_number":91,"context_line":"    rate: 1"},{"line_number":92,"context_line":"    maxBurst: 1000"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"  # Where security notifications should go."},{"line_number":95,"context_line":"  # Multiple outputs can be enabled."},{"line_number":96,"context_line":"  syslogOutput:"},{"line_number":97,"context_line":"    enabled: true"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"  # If keep_alive is set to true, the file will be opened once and"},{"line_number":100,"context_line":"  # continuously written to, with each output message on its own"},{"line_number":101,"context_line":"  # line. If keep_alive is set to false, the file will be re-opened"},{"line_number":102,"context_line":"  # for each output message."},{"line_number":103,"context_line":"  #"},{"line_number":104,"context_line":"  # Also, the file will be closed and reopened if falco is signaled with"},{"line_number":105,"context_line":"  # SIGUSR1."},{"line_number":106,"context_line":"  fileOutput:"},{"line_number":107,"context_line":"    enabled: false"},{"line_number":108,"context_line":"    keepAlive: false"},{"line_number":109,"context_line":"    filename: ./events.txt"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"  stdoutOutput:"},{"line_number":112,"context_line":"    enabled: true"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"  # Possible additional things you might want to do with program output:"},{"line_number":115,"context_line":"  #   - send to a slack webhook:"},{"line_number":116,"context_line":"  #         program: \"jq \u0027{text: .output}\u0027 | curl -d @- -X POST https://hooks.slack.com/services/XXX\""},{"line_number":117,"context_line":"  #   - logging (alternate method than syslog):"},{"line_number":118,"context_line":"  #         program: logger -t falco-test"},{"line_number":119,"context_line":"  #   - send over a network connection:"},{"line_number":120,"context_line":"  #         program: nc host.example.com 80"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"  # If keep_alive is set to true, the program will be started once and"},{"line_number":123,"context_line":"  # continuously written to, with each output message on its own"},{"line_number":124,"context_line":"  # line. If keep_alive is set to false, the program will be re-spawned"},{"line_number":125,"context_line":"  # for each output message."},{"line_number":126,"context_line":"  #"},{"line_number":127,"context_line":"  # Also, the program will be closed and reopened if falco is signaled with"},{"line_number":128,"context_line":"  # SIGUSR1."},{"line_number":129,"context_line":"  programOutput:"},{"line_number":130,"context_line":"    enabled: false"},{"line_number":131,"context_line":"    keepAlive: false"},{"line_number":132,"context_line":"    program: mail -s \"Falco Notification\" someone@example.com"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"falco_rules: |"},{"line_number":135,"context_line":"  - macro: open_write"},{"line_number":136,"context_line":"    condition: (evt.type\u003dopen or evt.type\u003dopenat) and evt.is_open_write\u003dtrue and fd.typechar\u003d\u0027f\u0027 and fd.num\u003e\u003d0"},{"line_number":137,"context_line":"  - macro: open_read"},{"line_number":138,"context_line":"    condition: (evt.type\u003dopen or evt.type\u003dopenat) and evt.is_open_read\u003dtrue and fd.typechar\u003d\u0027f\u0027 and fd.num\u003e\u003d0"},{"line_number":139,"context_line":"  - macro: never_true"},{"line_number":140,"context_line":"    condition: (evt.num\u003d0)"},{"line_number":141,"context_line":"  - macro: always_true"},{"line_number":142,"context_line":"    condition: (evt.num\u003d\u003e0)"},{"line_number":143,"context_line":"  - macro: proc_name_exists"},{"line_number":144,"context_line":"    condition: (proc.name!\u003d\"\u003cNA\u003e\")"},{"line_number":145,"context_line":"  - macro: rename"},{"line_number":146,"context_line":"    condition: evt.type in (rename, renameat)"},{"line_number":147,"context_line":"  - macro: mkdir"},{"line_number":148,"context_line":"    condition: evt.type \u003d mkdir"},{"line_number":149,"context_line":"  - macro: remove"},{"line_number":150,"context_line":"    condition: evt.type in (rmdir, unlink, unlinkat)"},{"line_number":151,"context_line":"  - macro: modify"},{"line_number":152,"context_line":"    condition: rename or remove"},{"line_number":153,"context_line":"  - macro: spawned_process"},{"line_number":154,"context_line":"    condition: evt.type \u003d execve and evt.dir\u003d\u003c"},{"line_number":155,"context_line":"  - macro: bin_dir"},{"line_number":156,"context_line":"    condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)"},{"line_number":157,"context_line":"  - macro: bin_dir_mkdir"},{"line_number":158,"context_line":"    condition: \u003e"},{"line_number":159,"context_line":"      (evt.arg[1] startswith /bin/ or"},{"line_number":160,"context_line":"       evt.arg[1] startswith /sbin/ or"},{"line_number":161,"context_line":"       evt.arg[1] startswith /usr/bin/ or"},{"line_number":162,"context_line":"       evt.arg[1] startswith /usr/sbin/)"},{"line_number":163,"context_line":"  - macro: bin_dir_rename"},{"line_number":164,"context_line":"    condition: \u003e"},{"line_number":165,"context_line":"      evt.arg[1] startswith /bin/ or"},{"line_number":166,"context_line":"      evt.arg[1] startswith /sbin/ or"},{"line_number":167,"context_line":"      evt.arg[1] startswith /usr/bin/ or"},{"line_number":168,"context_line":"      evt.arg[1] startswith /usr/sbin/"},{"line_number":169,"context_line":"  - macro: etc_dir"},{"line_number":170,"context_line":"    condition: fd.name startswith /etc/"},{"line_number":171,"context_line":"  - macro: root_dir"},{"line_number":172,"context_line":"    condition: ((fd.directory\u003d/ or fd.name startswith /root) and fd.name contains \"/\")"},{"line_number":173,"context_line":"  - list: shell_binaries"},{"line_number":174,"context_line":"    items: [bash, csh, ksh, sh, tcsh, zsh, dash]"},{"line_number":175,"context_line":"  - list: shell_mgmt_binaries"},{"line_number":176,"context_line":"    items: [add-shell, remove-shell]"},{"line_number":177,"context_line":"  - macro: shell_procs"},{"line_number":178,"context_line":"    condition: (proc.name in (shell_binaries))"},{"line_number":179,"context_line":"  - list: coreutils_binaries"},{"line_number":180,"context_line":"    items: ["},{"line_number":181,"context_line":"      truncate, sha1sum, numfmt, fmt, fold, uniq, cut, who,"},{"line_number":182,"context_line":"      groups, csplit, sort, expand, printf, printenv, unlink, tee, chcon, stat,"},{"line_number":183,"context_line":"      basename, split, nice, \"yes\", whoami, sha224sum, hostid, users, stdbuf,"},{"line_number":184,"context_line":"      base64, unexpand, cksum, od, paste, nproc, pathchk, sha256sum, wc, test,"},{"line_number":185,"context_line":"      comm, arch, du, factor, sha512sum, md5sum, tr, runcon, env, dirname,"},{"line_number":186,"context_line":"      tsort, join, shuf, install, logname, pinky, nohup, expr, pr, tty, timeout,"},{"line_number":187,"context_line":"      tail, \"[\", seq, sha384sum, nl, head, id, mkfifo, sum, dircolors, ptx, shred,"},{"line_number":188,"context_line":"      tac, link, chroot, vdir, chown, touch, ls, dd, uname, \"true\", pwd, date,"},{"line_number":189,"context_line":"      chgrp, chmod, mktemp, cat, mknod, sync, ln, \"false\", rm, mv, cp, echo,"},{"line_number":190,"context_line":"      readlink, sleep, stty, mkdir, df, dir, rmdir, touch"},{"line_number":191,"context_line":"      ]"},{"line_number":192,"context_line":"  - list: login_binaries"},{"line_number":193,"context_line":"    items: ["},{"line_number":194,"context_line":"      login, systemd, \u0027\"(systemd)\"\u0027, systemd-logind, su,"},{"line_number":195,"context_line":"      nologin, faillog, lastlog, newgrp, sg"},{"line_number":196,"context_line":"      ]"},{"line_number":197,"context_line":"  - list: passwd_binaries"},{"line_number":198,"context_line":"    items: ["},{"line_number":199,"context_line":"      shadowconfig, grpck, pwunconv, grpconv, pwck,"},{"line_number":200,"context_line":"      groupmod, vipw, pwconv, useradd, newusers, cppw, chpasswd, usermod,"},{"line_number":201,"context_line":"      groupadd, groupdel, grpunconv, chgpasswd, userdel, chage, chsh,"},{"line_number":202,"context_line":"      gpasswd, chfn, expiry, passwd, vigr, cpgr"},{"line_number":203,"context_line":"      ]"},{"line_number":204,"context_line":"  - list: shadowutils_binaries"},{"line_number":205,"context_line":"    items: ["},{"line_number":206,"context_line":"      chage, gpasswd, lastlog, newgrp, sg, adduser, deluser, chpasswd,"},{"line_number":207,"context_line":"      groupadd, groupdel, addgroup, delgroup, groupmems, groupmod, grpck, grpconv, grpunconv,"},{"line_number":208,"context_line":"      newusers, pwck, pwconv, pwunconv, useradd, userdel, usermod, vigr, vipw, unix_chkpwd"},{"line_number":209,"context_line":"      ]"},{"line_number":210,"context_line":"  - list: sysdigcloud_binaries"},{"line_number":211,"context_line":"    items: [setup-backend, dragent, sdchecks]"},{"line_number":212,"context_line":"  - list: docker_binaries"},{"line_number":213,"context_line":"    items: [docker, dockerd, exe, docker-compose, docker-entrypoi, docker-runc-cur, docker-current]"},{"line_number":214,"context_line":"  - list: k8s_binaries"},{"line_number":215,"context_line":"    items: [hyperkube, skydns, kube2sky, exechealthz]"},{"line_number":216,"context_line":"  - list: lxd_binaries"},{"line_number":217,"context_line":"    items: [lxd, lxcfs]"},{"line_number":218,"context_line":"  - list: http_server_binaries"},{"line_number":219,"context_line":"    items: [nginx, httpd, httpd-foregroun, lighttpd, apache, apache2]"},{"line_number":220,"context_line":"  - list: db_server_binaries"},{"line_number":221,"context_line":"    items: [mysqld, postgres, sqlplus]"},{"line_number":222,"context_line":"  - list: mysql_mgmt_binaries"},{"line_number":223,"context_line":"    items: [mysql_install_d, mysql_ssl_rsa_s]"},{"line_number":224,"context_line":"  - list: postgres_mgmt_binaries"},{"line_number":225,"context_line":"    items: [pg_dumpall, pg_ctl, pg_lsclusters, pg_ctlcluster]"},{"line_number":226,"context_line":"  - list: db_mgmt_binaries"},{"line_number":227,"context_line":"    items: [mysql_mgmt_binaries, postgres_mgmt_binaries]"},{"line_number":228,"context_line":"  - list: nosql_server_binaries"},{"line_number":229,"context_line":"    items: [couchdb, memcached, redis-server, rabbitmq-server, mongod]"},{"line_number":230,"context_line":"  - list: gitlab_binaries"},{"line_number":231,"context_line":"    items: [gitlab-shell, gitlab-mon, gitlab-runner-b, git]"},{"line_number":232,"context_line":"  - macro: server_procs"},{"line_number":233,"context_line":"    condition: proc.name in (http_server_binaries, db_server_binaries, docker_binaries, sshd)"},{"line_number":234,"context_line":"  - list: rpm_binaries"},{"line_number":235,"context_line":"    items: [dnf, rpm, rpmkey, yum, \u0027\"75-system-updat\"\u0027, rhsmcertd-worke, subscription-ma,"},{"line_number":236,"context_line":"            repoquery, rpmkeys, rpmq, yum-cron, yum-config-mana, yum-debug-dump,"},{"line_number":237,"context_line":"            abrt-action-sav, rpmdb_stat, microdnf]"},{"line_number":238,"context_line":"  - macro: rpm_procs"},{"line_number":239,"context_line":"    condition: proc.name in (rpm_binaries) or proc.name in (salt-minion)"},{"line_number":240,"context_line":"  - list: deb_binaries"},{"line_number":241,"context_line":"    items: [dpkg, dpkg-preconfigu, dpkg-reconfigur, dpkg-divert, apt, apt-get, aptitude,"},{"line_number":242,"context_line":"      frontend, preinst, add-apt-reposit, apt-auto-remova, apt-key,"},{"line_number":243,"context_line":"      apt-listchanges, unattended-upgr, apt-add-reposit"},{"line_number":244,"context_line":"      ]"},{"line_number":245,"context_line":"  - list: package_mgmt_binaries"},{"line_number":246,"context_line":"    items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client]"},{"line_number":247,"context_line":"  - macro: package_mgmt_procs"},{"line_number":248,"context_line":"    condition: proc.name in (package_mgmt_binaries)"},{"line_number":249,"context_line":"  - macro: coreos_write_ssh_dir"},{"line_number":250,"context_line":"    condition: (proc.name\u003dupdate-ssh-keys and fd.name startswith /home/core/.ssh)"},{"line_number":251,"context_line":"  - macro: run_by_package_mgmt_binaries"},{"line_number":252,"context_line":"    condition: proc.aname in (package_mgmt_binaries, needrestart)"},{"line_number":253,"context_line":"  - list: ssl_mgmt_binaries"},{"line_number":254,"context_line":"    items: [ca-certificates]"},{"line_number":255,"context_line":"  - list: dhcp_binaries"},{"line_number":256,"context_line":"    items: [dhclient, dhclient-script]"},{"line_number":257,"context_line":"  - list: userexec_binaries"},{"line_number":258,"context_line":"    items: [sudo, su, suexec]"},{"line_number":259,"context_line":"  - list: known_setuid_binaries"},{"line_number":260,"context_line":"    items: ["},{"line_number":261,"context_line":"      sshd, dbus-daemon-lau, ping, ping6, critical-stack-, pmmcli,"},{"line_number":262,"context_line":"      filemng, PassengerAgent, bwrap, osdetect, nginxmng, sw-engine-fpm,"},{"line_number":263,"context_line":"      start-stop-daem"},{"line_number":264,"context_line":"      ]"},{"line_number":265,"context_line":"  - list: user_mgmt_binaries"},{"line_number":266,"context_line":"    items: [login_binaries, passwd_binaries, shadowutils_binaries]"},{"line_number":267,"context_line":"  - list: dev_creation_binaries"},{"line_number":268,"context_line":"    items: [blkid, rename_device, update_engine, sgdisk]"},{"line_number":269,"context_line":"  - list: hids_binaries"},{"line_number":270,"context_line":"    items: [aide]"},{"line_number":271,"context_line":"  - list: vpn_binaries"},{"line_number":272,"context_line":"    items: [openvpn]"},{"line_number":273,"context_line":"  - list: nomachine_binaries"},{"line_number":274,"context_line":"    items: [nxexec, nxnode.bin, nxserver.bin, nxclient.bin]"},{"line_number":275,"context_line":"  - macro: system_procs"},{"line_number":276,"context_line":"    condition: proc.name in (coreutils_binaries, user_mgmt_binaries)"},{"line_number":277,"context_line":"  - list: mail_binaries"},{"line_number":278,"context_line":"    items: ["},{"line_number":279,"context_line":"      sendmail, sendmail-msp, postfix, procmail, exim4,"},{"line_number":280,"context_line":"      pickup, showq, mailq, dovecot, imap-login, imap,"},{"line_number":281,"context_line":"      mailmng-core, pop3-login, dovecot-lda, pop3"},{"line_number":282,"context_line":"      ]"},{"line_number":283,"context_line":"  - list: mail_config_binaries"},{"line_number":284,"context_line":"    items: ["},{"line_number":285,"context_line":"      update_conf, parse_mc, makemap_hash, newaliases, update_mk, update_tlsm4,"},{"line_number":286,"context_line":"      update_db, update_mc, ssmtp.postinst, mailq, postalias, postfix.config.,"},{"line_number":287,"context_line":"      postfix.config, postfix-script"},{"line_number":288,"context_line":"      ]"},{"line_number":289,"context_line":"  - list: sensitive_file_names"},{"line_number":290,"context_line":"    items: [/etc/shadow, /etc/sudoers, /etc/pam.conf]"},{"line_number":291,"context_line":"  - macro: sensitive_files"},{"line_number":292,"context_line":"    condition: \u003e"},{"line_number":293,"context_line":"      fd.name startswith /etc and"},{"line_number":294,"context_line":"      (fd.name in (sensitive_file_names)"},{"line_number":295,"context_line":"       or fd.directory in (/etc/sudoers.d, /etc/pam.d))"},{"line_number":296,"context_line":"  - macro: proc_is_new"},{"line_number":297,"context_line":"    condition: proc.duration \u003c\u003d 5000000000"},{"line_number":298,"context_line":"  - macro: inbound"},{"line_number":299,"context_line":"    condition: \u003e"},{"line_number":300,"context_line":"      (((evt.type in (accept,listen) and evt.dir\u003d\u003c)) or"},{"line_number":301,"context_line":"       (fd.typechar \u003d 4 or fd.typechar \u003d 6) and"},{"line_number":302,"context_line":"       (fd.ip !\u003d \"0.0.0.0\" and fd.net !\u003d \"127.0.0.0/8\") and"},{"line_number":303,"context_line":"       (evt.rawres \u003e\u003d 0 or evt.res \u003d EINPROGRESS))"},{"line_number":304,"context_line":"  - macro: outbound"},{"line_number":305,"context_line":"    condition: \u003e"},{"line_number":306,"context_line":"      (((evt.type \u003d connect and evt.dir\u003d\u003c)) or"},{"line_number":307,"context_line":"       (fd.typechar \u003d 4 or fd.typechar \u003d 6) and"},{"line_number":308,"context_line":"       (fd.ip !\u003d \"0.0.0.0\" and fd.net !\u003d \"127.0.0.0/8\") and"},{"line_number":309,"context_line":"       (evt.rawres \u003e\u003d 0 or evt.res \u003d EINPROGRESS))"},{"line_number":310,"context_line":"  - macro: inbound_outbound"},{"line_number":311,"context_line":"    condition: \u003e"},{"line_number":312,"context_line":"      (((evt.type in (accept,listen,connect) and evt.dir\u003d\u003c)) or"},{"line_number":313,"context_line":"       (fd.typechar \u003d 4 or fd.typechar \u003d 6) and"},{"line_number":314,"context_line":"       (fd.ip !\u003d \"0.0.0.0\" and fd.net !\u003d \"127.0.0.0/8\") and"},{"line_number":315,"context_line":"       (evt.rawres \u003e\u003d 0 or evt.res \u003d EINPROGRESS))"},{"line_number":316,"context_line":"  - macro: ssh_port"},{"line_number":317,"context_line":"    condition: fd.sport\u003d22"},{"line_number":318,"context_line":"  - macro: allowed_ssh_hosts"},{"line_number":319,"context_line":"    condition: ssh_port"},{"line_number":320,"context_line":"  - rule: Disallowed SSH Connection"},{"line_number":321,"context_line":"    desc: Detect any new ssh connection to a host other than those in an allowed group of hosts"},{"line_number":322,"context_line":"    condition: (inbound_outbound) and ssh_port and not allowed_ssh_hosts"},{"line_number":323,"context_line":"    output: Disallowed SSH Connection (command\u003d%proc.cmdline connection\u003d%fd.name user\u003d%user.name)"},{"line_number":324,"context_line":"    priority: NOTICE"},{"line_number":325,"context_line":"    tags: [network]"},{"line_number":326,"context_line":"  - macro: container"},{"line_number":327,"context_line":"    condition: container.id !\u003d host"},{"line_number":328,"context_line":"  - macro: interactive"},{"line_number":329,"context_line":"    condition: \u003e"},{"line_number":330,"context_line":"      ((proc.aname\u003dsshd and proc.name !\u003d sshd) or"},{"line_number":331,"context_line":"      proc.name\u003dsystemd-logind or proc.name\u003dlogin)"},{"line_number":332,"context_line":"  - list: cron_binaries"},{"line_number":333,"context_line":"    items: [anacron, cron, crond, crontab]"},{"line_number":334,"context_line":"  - list: needrestart_binaries"},{"line_number":335,"context_line":"    items: [needrestart, 10-dpkg, 20-rpm, 30-pacman]"},{"line_number":336,"context_line":"  - list: sshkit_script_binaries"},{"line_number":337,"context_line":"    items: [10_etc_sudoers., 10_passwd_group]"},{"line_number":338,"context_line":"  - list: plesk_binaries"},{"line_number":339,"context_line":"    items: [sw-engine, sw-engine-fpm, sw-engine-kv, filemng, f2bmng]"},{"line_number":340,"context_line":"  - macro: system_users"},{"line_number":341,"context_line":"    condition: user.name in (bin, daemon, games, lp, mail, nobody, sshd, sync, uucp, www-data)"},{"line_number":342,"context_line":"  - macro: parent_ansible_running_python"},{"line_number":343,"context_line":"    condition: (proc.pname in (python, pypy) and proc.pcmdline contains ansible)"},{"line_number":344,"context_line":"  - macro: parent_bro_running_python"},{"line_number":345,"context_line":"    condition: (proc.pname\u003dpython and proc.cmdline contains /usr/share/broctl)"},{"line_number":346,"context_line":"  - macro: parent_python_running_denyhosts"},{"line_number":347,"context_line":"    condition: \u003e"},{"line_number":348,"context_line":"      (proc.cmdline startswith \"denyhosts.py /usr/bin/denyhosts.py\" or"},{"line_number":349,"context_line":"       (proc.pname\u003dpython and"},{"line_number":350,"context_line":"       (proc.pcmdline contains /usr/sbin/denyhosts or"},{"line_number":351,"context_line":"        proc.pcmdline contains /usr/local/bin/denyhosts.py)))"},{"line_number":352,"context_line":"  - macro: parent_python_running_sdchecks"},{"line_number":353,"context_line":"    condition: \u003e"},{"line_number":354,"context_line":"      (proc.pname in (python, python2.7) and"},{"line_number":355,"context_line":"      (proc.pcmdline contains /opt/draios/bin/sdchecks))"},{"line_number":356,"context_line":"  - macro: parent_linux_image_upgrade_script"},{"line_number":357,"context_line":"    condition: proc.pname startswith linux-image-"},{"line_number":358,"context_line":"  - macro: parent_java_running_echo"},{"line_number":359,"context_line":"    condition: (proc.pname\u003djava and proc.cmdline startswith \"sh -c echo\")"},{"line_number":360,"context_line":"  - macro: parent_scripting_running_builds"},{"line_number":361,"context_line":"    condition: \u003e"},{"line_number":362,"context_line":"      (proc.pname in (php,php5-fpm,php-fpm7.1,python,ruby,ruby2.3,ruby2.1,node,conda) and ("},{"line_number":363,"context_line":"         proc.cmdline startswith \"sh -c git\" or"},{"line_number":364,"context_line":"         proc.cmdline startswith \"sh -c date\" or"},{"line_number":365,"context_line":"         proc.cmdline startswith \"sh -c /usr/bin/g++\" or"},{"line_number":366,"context_line":"         proc.cmdline startswith \"sh -c /usr/bin/gcc\" or"},{"line_number":367,"context_line":"         proc.cmdline startswith \"sh -c gcc\" or"},{"line_number":368,"context_line":"         proc.cmdline startswith \"sh -c if type gcc\" or"},{"line_number":369,"context_line":"         proc.cmdline startswith \"sh -c cd \u0027/var/www/edi/\u0027;LC_ALL\u003den_US.UTF-8 git\" or"},{"line_number":370,"context_line":"         proc.cmdline startswith \"sh -c /var/www/edi/bin/sftp.sh\" or"},{"line_number":371,"context_line":"         proc.cmdline startswith \"sh -c /usr/src/app/crxlsx/bin/linux/crxlsx\" or"},{"line_number":372,"context_line":"         proc.cmdline startswith \"sh -c make parent\" or"},{"line_number":373,"context_line":"         proc.cmdline startswith \"node /jenkins/tools\" or"},{"line_number":374,"context_line":"         proc.cmdline startswith \"sh -c \u0027/usr/bin/node\u0027\" or"},{"line_number":375,"context_line":"         proc.cmdline startswith \"sh -c stty -a |\" or"},{"line_number":376,"context_line":"         proc.pcmdline startswith \"node /opt/nodejs/bin/yarn\" or"},{"line_number":377,"context_line":"         proc.pcmdline startswith \"node /usr/local/bin/yarn\" or"},{"line_number":378,"context_line":"         proc.pcmdline startswith \"node /root/.config/yarn\" or"},{"line_number":379,"context_line":"         proc.pcmdline startswith \"node /opt/yarn/bin/yarn.js\"))"},{"line_number":380,"context_line":"  - macro: httpd_writing_ssl_conf"},{"line_number":381,"context_line":"    condition: \u003e"},{"line_number":382,"context_line":"      (proc.pname\u003drun-httpd and"},{"line_number":383,"context_line":"       (proc.cmdline startswith \"sed -ri\" or proc.cmdline startswith \"sed -i\") and"},{"line_number":384,"context_line":"       (fd.name startswith /etc/httpd/conf.d/ or fd.name startswith /etc/httpd/conf))"},{"line_number":385,"context_line":"  - macro: userhelper_writing_etc_security"},{"line_number":386,"context_line":"    condition: (proc.name\u003duserhelper and fd.name startswith /etc/security)"},{"line_number":387,"context_line":"  - macro: parent_Xvfb_running_xkbcomp"},{"line_number":388,"context_line":"    condition: (proc.pname\u003dXvfb and proc.cmdline startswith \u0027sh -c \"/usr/bin/xkbcomp\"\u0027)"},{"line_number":389,"context_line":"  - macro: parent_nginx_running_serf"},{"line_number":390,"context_line":"    condition: (proc.pname\u003dnginx and proc.cmdline startswith \"sh -c serf\")"},{"line_number":391,"context_line":"  - macro: parent_node_running_npm"},{"line_number":392,"context_line":"    condition: (proc.pcmdline startswith \"node /usr/local/bin/npm\" or"},{"line_number":393,"context_line":"                proc.pcmdline startswith \"node /usr/local/nodejs/bin/npm\" or"},{"line_number":394,"context_line":"                proc.pcmdline startswith \"node /opt/rh/rh-nodejs6/root/usr/bin/npm\")"},{"line_number":395,"context_line":"  - macro: parent_java_running_sbt"},{"line_number":396,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains sbt-launch.jar)"},{"line_number":397,"context_line":"  - list: known_container_shell_spawn_cmdlines"},{"line_number":398,"context_line":"    items: []"},{"line_number":399,"context_line":"  - list: known_shell_spawn_binaries"},{"line_number":400,"context_line":"    items: []"},{"line_number":401,"context_line":"  - macro: ansible_running_python"},{"line_number":402,"context_line":"    condition: (proc.name in (python, pypy) and proc.cmdline contains ansible)"},{"line_number":403,"context_line":"  - macro: python_running_chef"},{"line_number":404,"context_line":"    condition: (proc.name\u003dpython and (proc.cmdline contains yum-dump.py or proc.cmdline\u003d\"python /usr/bin/chef-monitor.py\"))"},{"line_number":405,"context_line":"  - macro: python_running_denyhosts"},{"line_number":406,"context_line":"    condition: \u003e"},{"line_number":407,"context_line":"      (proc.name\u003dpython and"},{"line_number":408,"context_line":"      (proc.cmdline contains /usr/sbin/denyhosts or"},{"line_number":409,"context_line":"       proc.cmdline contains /usr/local/bin/denyhosts.py))"},{"line_number":410,"context_line":"  - macro: run_by_qualys"},{"line_number":411,"context_line":"    condition: \u003e"},{"line_number":412,"context_line":"      (proc.pname\u003dqualys-cloud-ag or"},{"line_number":413,"context_line":"       proc.aname[2]\u003dqualys-cloud-ag or"},{"line_number":414,"context_line":"       proc.aname[3]\u003dqualys-cloud-ag or"},{"line_number":415,"context_line":"       proc.aname[4]\u003dqualys-cloud-ag)"},{"line_number":416,"context_line":"  - macro: run_by_sumologic_securefiles"},{"line_number":417,"context_line":"    condition: \u003e"},{"line_number":418,"context_line":"      ((proc.cmdline\u003d\"usermod -a -G sumologic_collector\" or"},{"line_number":419,"context_line":"        proc.cmdline\u003d\"groupadd sumologic_collector\") and"},{"line_number":420,"context_line":"       (proc.pname\u003dsecureFiles.sh and proc.aname[2]\u003djava))"},{"line_number":421,"context_line":"  - macro: run_by_yum"},{"line_number":422,"context_line":"    condition: ((proc.pname\u003dsh and proc.aname[2]\u003dyum) or"},{"line_number":423,"context_line":"                (proc.aname[2]\u003dsh and proc.aname[3]\u003dyum))"},{"line_number":424,"context_line":"  - macro: run_by_ms_oms"},{"line_number":425,"context_line":"    condition: \u003e"},{"line_number":426,"context_line":"      (proc.aname[3] startswith omsagent- or"},{"line_number":427,"context_line":"       proc.aname[3] startswith scx-)"},{"line_number":428,"context_line":"  - macro: run_by_google_accounts_daemon"},{"line_number":429,"context_line":"    condition: \u003e"},{"line_number":430,"context_line":"      (proc.aname[1] startswith google_accounts or"},{"line_number":431,"context_line":"       proc.aname[2] startswith google_accounts)"},{"line_number":432,"context_line":"  - macro: run_by_chef"},{"line_number":433,"context_line":"    condition: (proc.aname[2]\u003dchef_command_wr or proc.aname[3]\u003dchef_command_wr or"},{"line_number":434,"context_line":"                proc.aname[2]\u003dchef-client or proc.aname[3]\u003dchef-client or"},{"line_number":435,"context_line":"                proc.name\u003dchef-client)"},{"line_number":436,"context_line":"  - macro: run_by_adclient"},{"line_number":437,"context_line":"    condition: (proc.aname[2]\u003dadclient or proc.aname[3]\u003dadclient or proc.aname[4]\u003dadclient)"},{"line_number":438,"context_line":"  - macro: run_by_centrify"},{"line_number":439,"context_line":"    condition: (proc.aname[2]\u003dcentrify or proc.aname[3]\u003dcentrify or proc.aname[4]\u003dcentrify)"},{"line_number":440,"context_line":"  - macro: run_by_puppet"},{"line_number":441,"context_line":"    condition: (proc.aname[2]\u003dpuppet or proc.aname[3]\u003dpuppet)"},{"line_number":442,"context_line":"  - macro: run_by_foreman"},{"line_number":443,"context_line":"    condition: \u003e"},{"line_number":444,"context_line":"      (user.name\u003dforeman and"},{"line_number":445,"context_line":"       (proc.pname in (rake, ruby, scl) and proc.aname[5] in (tfm-rake,tfm-ruby)) or"},{"line_number":446,"context_line":"       (proc.pname\u003dscl and proc.aname[2] in (tfm-rake,tfm-ruby)))"},{"line_number":447,"context_line":"  - macro: java_running_sdjagent"},{"line_number":448,"context_line":"    condition: proc.name\u003djava and proc.cmdline contains sdjagent.jar"},{"line_number":449,"context_line":"  - macro: kubelet_running_loopback"},{"line_number":450,"context_line":"    condition: (proc.pname\u003dkubelet and proc.name\u003dloopback)"},{"line_number":451,"context_line":"  - macro: python_mesos_marathon_scripting"},{"line_number":452,"context_line":"    condition: (proc.pcmdline startswith \"python3 /marathon-lb/marathon_lb.py\")"},{"line_number":453,"context_line":"  - macro: splunk_running_forwarder"},{"line_number":454,"context_line":"    condition: (proc.pname\u003dsplunkd and proc.cmdline startswith \"sh -c /opt/splunkforwarder\")"},{"line_number":455,"context_line":"  - macro: parent_supervise_running_multilog"},{"line_number":456,"context_line":"    condition: (proc.name\u003dmultilog and proc.pname\u003dsupervise)"},{"line_number":457,"context_line":"  - macro: supervise_writing_status"},{"line_number":458,"context_line":"    condition: (proc.name in (supervise,svc) and fd.name startswith \"/etc/sb/\")"},{"line_number":459,"context_line":"  - macro: pki_realm_writing_realms"},{"line_number":460,"context_line":"    condition: (proc.cmdline startswith \"bash /usr/local/lib/pki/pki-realm\" and fd.name startswith /etc/pki/realms)"},{"line_number":461,"context_line":"  - macro: htpasswd_writing_passwd"},{"line_number":462,"context_line":"    condition: (proc.name\u003dhtpasswd and fd.name\u003d/etc/nginx/.htpasswd)"},{"line_number":463,"context_line":"  - macro: lvprogs_writing_conf"},{"line_number":464,"context_line":"    condition: \u003e"},{"line_number":465,"context_line":"      (proc.name in (dmeventd,lvcreate,pvscan) and"},{"line_number":466,"context_line":"       (fd.name startswith /etc/lvm/archive or"},{"line_number":467,"context_line":"        fd.name startswith /etc/lvm/backup or"},{"line_number":468,"context_line":"        fd.name startswith /etc/lvm/cache))"},{"line_number":469,"context_line":"  - macro: ovsdb_writing_openvswitch"},{"line_number":470,"context_line":"    condition: (proc.name\u003dovsdb-server and fd.directory\u003d/etc/openvswitch)"},{"line_number":471,"context_line":"  - macro: perl_running_plesk"},{"line_number":472,"context_line":"    condition: (proc.cmdline startswith \"perl /opt/psa/admin/bin/plesk_agent_manager\" or"},{"line_number":473,"context_line":"                proc.pcmdline startswith \"perl /opt/psa/admin/bin/plesk_agent_manager\")"},{"line_number":474,"context_line":"  - macro: perl_running_updmap"},{"line_number":475,"context_line":"    condition: (proc.cmdline startswith \"perl /usr/bin/updmap\")"},{"line_number":476,"context_line":"  - macro: perl_running_centrifydc"},{"line_number":477,"context_line":"    condition: (proc.cmdline startswith \"perl /usr/share/centrifydc\")"},{"line_number":478,"context_line":"  - macro: parent_ucf_writing_conf"},{"line_number":479,"context_line":"    condition: (proc.pname\u003ducf and proc.aname[2]\u003dfrontend)"},{"line_number":480,"context_line":"  - macro: consul_template_writing_conf"},{"line_number":481,"context_line":"    condition: \u003e"},{"line_number":482,"context_line":"      ((proc.name\u003dconsul-template and fd.name startswith /etc/haproxy) or"},{"line_number":483,"context_line":"       (proc.name\u003dreload.sh and proc.aname[2]\u003dconsul-template and fd.name startswith /etc/ssl))"},{"line_number":484,"context_line":"  - macro: countly_writing_nginx_conf"},{"line_number":485,"context_line":"    condition: (proc.cmdline startswith \"nodejs /opt/countly/bin\" and fd.name startswith /etc/nginx)"},{"line_number":486,"context_line":"  - list: ms_oms_binaries"},{"line_number":487,"context_line":"    items: [omi.postinst, omsconfig.posti, scx.postinst, omsadmin.sh, omiagent]"},{"line_number":488,"context_line":"  - macro: ms_oms_writing_conf"},{"line_number":489,"context_line":"    condition: \u003e"},{"line_number":490,"context_line":"      ((proc.name in (omiagent,omsagent,in_heartbeat_r*,omsadmin.sh,PerformInventor)"},{"line_number":491,"context_line":"         or proc.pname in (ms_oms_binaries)"},{"line_number":492,"context_line":"         or proc.aname[2] in (ms_oms_binaries))"},{"line_number":493,"context_line":"       and (fd.name startswith /etc/opt/omi or fd.name startswith /etc/opt/microsoft/omsagent))"},{"line_number":494,"context_line":"  - macro: ms_scx_writing_conf"},{"line_number":495,"context_line":"    condition: (proc.name in (GetLinuxOS.sh) and fd.name startswith /etc/opt/microsoft/scx)"},{"line_number":496,"context_line":"  - macro: azure_scripts_writing_conf"},{"line_number":497,"context_line":"    condition: (proc.pname startswith \"bash /var/lib/waagent/\" and fd.name startswith /etc/azure)"},{"line_number":498,"context_line":"  - macro: azure_networkwatcher_writing_conf"},{"line_number":499,"context_line":"    condition: (proc.name in (NetworkWatcherA) and fd.name\u003d/etc/init.d/AzureNetworkWatcherAgent)"},{"line_number":500,"context_line":"  - macro: couchdb_writing_conf"},{"line_number":501,"context_line":"    condition: (proc.name\u003dbeam.smp and proc.cmdline contains couchdb and fd.name startswith /etc/couchdb)"},{"line_number":502,"context_line":"  - macro: update_texmf_writing_conf"},{"line_number":503,"context_line":"    condition: (proc.name\u003dupdate-texmf and fd.name startswith /etc/texmf)"},{"line_number":504,"context_line":"  - macro: slapadd_writing_conf"},{"line_number":505,"context_line":"    condition: (proc.name\u003dslapadd and fd.name startswith /etc/ldap)"},{"line_number":506,"context_line":"  - macro: openldap_writing_conf"},{"line_number":507,"context_line":"    condition: (proc.pname\u003drun-openldap.sh and fd.name startswith /etc/openldap)"},{"line_number":508,"context_line":"  - macro: ucpagent_writing_conf"},{"line_number":509,"context_line":"    condition: (proc.name\u003dapiserver and container.image startswith docker/ucp-agent and fd.name\u003d/etc/authorization_config.cfg)"},{"line_number":510,"context_line":"  - macro: iscsi_writing_conf"},{"line_number":511,"context_line":"    condition: (proc.name\u003discsiadm and fd.name startswith /etc/iscsi)"},{"line_number":512,"context_line":"  - macro: symantec_writing_conf"},{"line_number":513,"context_line":"    condition: \u003e"},{"line_number":514,"context_line":"      ((proc.name\u003dsymcfgd and fd.name startswith /etc/symantec) or"},{"line_number":515,"context_line":"       (proc.name\u003dnavdefutil and fd.name\u003d/etc/symc-defutils.conf))"},{"line_number":516,"context_line":"  - macro: liveupdate_writing_conf"},{"line_number":517,"context_line":"    condition: (proc.cmdline startswith \"java LiveUpdate\" and fd.name in (/etc/liveupdate.conf, /etc/Product.Catalog.JavaLiveUpdate))"},{"line_number":518,"context_line":"  - macro: sosreport_writing_files"},{"line_number":519,"context_line":"    condition: \u003e"},{"line_number":520,"context_line":"      (proc.name\u003durlgrabber-ext- and proc.aname[3]\u003dsosreport and"},{"line_number":521,"context_line":"       (fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb))"},{"line_number":522,"context_line":"  - macro: pkgmgmt_progs_writing_pki"},{"line_number":523,"context_line":"    condition: \u003e"},{"line_number":524,"context_line":"      (proc.name\u003durlgrabber-ext- and proc.pname in (yum, yum-cron, repoquery) and"},{"line_number":525,"context_line":"       (fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb))"},{"line_number":526,"context_line":"  - macro: update_ca_trust_writing_pki"},{"line_number":527,"context_line":"    condition: (proc.pname\u003dupdate-ca-trust and proc.name\u003dtrust and fd.name startswith /etc/pki)"},{"line_number":528,"context_line":"  - macro: brandbot_writing_os_release"},{"line_number":529,"context_line":"    condition: proc.name\u003dbrandbot and fd.name\u003d/etc/os-release"},{"line_number":530,"context_line":"  - macro: selinux_writing_conf"},{"line_number":531,"context_line":"    condition: (proc.name in (semodule,genhomedircon,sefcontext_comp) and fd.name startswith /etc/selinux)"},{"line_number":532,"context_line":"  - list: veritas_binaries"},{"line_number":533,"context_line":"    items: [vxconfigd, sfcache, vxclustadm, vxdctl, vxprint, vxdmpadm, vxdisk, vxdg, vxassist, vxtune]"},{"line_number":534,"context_line":"  - macro: veritas_driver_script"},{"line_number":535,"context_line":"    condition: (proc.cmdline startswith \"perl /opt/VRTSsfmh/bin/mh_driver.pl\")"},{"line_number":536,"context_line":"  - macro: veritas_progs"},{"line_number":537,"context_line":"    condition: (proc.name in (veritas_binaries) or veritas_driver_script)"},{"line_number":538,"context_line":"  - macro: veritas_writing_config"},{"line_number":539,"context_line":"    condition: (veritas_progs and (fd.name startswith /etc/vx or fd.name startswith /etc/opt/VRTS or fd.name startswith /etc/vom))"},{"line_number":540,"context_line":"  - macro: nginx_writing_conf"},{"line_number":541,"context_line":"    condition: (proc.name\u003dnginx and fd.name startswith /etc/nginx)"},{"line_number":542,"context_line":"  - macro: nginx_writing_certs"},{"line_number":543,"context_line":"    condition: \u003e"},{"line_number":544,"context_line":"      (((proc.name\u003dopenssl and proc.pname\u003dnginx-launch.sh) or proc.name\u003dnginx-launch.sh) and fd.name startswith /etc/nginx/certs)"},{"line_number":545,"context_line":"  - macro: chef_client_writing_conf"},{"line_number":546,"context_line":"    condition: (proc.pcmdline startswith \"chef-client /opt/gitlab\" and fd.name startswith /etc/gitlab)"},{"line_number":547,"context_line":"  - macro: centrify_writing_krb"},{"line_number":548,"context_line":"    condition: (proc.name in (adjoin,addns) and fd.name startswith /etc/krb5)"},{"line_number":549,"context_line":"  - macro: cockpit_writing_conf"},{"line_number":550,"context_line":"    condition: \u003e"},{"line_number":551,"context_line":"      ((proc.pname\u003dcockpit-kube-la or proc.aname[2]\u003dcockpit-kube-la)"},{"line_number":552,"context_line":"       and fd.name startswith /etc/cockpit)"},{"line_number":553,"context_line":"  - macro: ipsec_writing_conf"},{"line_number":554,"context_line":"    condition: (proc.name\u003dstart-ipsec.sh and fd.directory\u003d/etc/ipsec)"},{"line_number":555,"context_line":"  - macro: exe_running_docker_save"},{"line_number":556,"context_line":"    condition: (proc.cmdline startswith \"exe /var/lib/docker\" and proc.pname in (dockerd, docker))"},{"line_number":557,"context_line":"  - macro: sed_temporary_file"},{"line_number":558,"context_line":"    condition: (proc.name\u003dsed and fd.name startswith \"/etc/sed\")"},{"line_number":559,"context_line":"  - macro: python_running_get_pip"},{"line_number":560,"context_line":"    condition: (proc.cmdline startswith \"python get-pip.py\")"},{"line_number":561,"context_line":"  - macro: python_running_ms_oms"},{"line_number":562,"context_line":"    condition: (proc.cmdline startswith \"python /var/lib/waagent/\")"},{"line_number":563,"context_line":"  - macro: gugent_writing_guestagent_log"},{"line_number":564,"context_line":"    condition: (proc.name\u003dgugent and fd.name\u003dGuestAgent.log)"},{"line_number":565,"context_line":"  - macro: dse_writing_tmp"},{"line_number":566,"context_line":"    condition: (proc.name\u003ddse-entrypoint and fd.name\u003d/root/tmp__)"},{"line_number":567,"context_line":"  - macro: zap_writing_state"},{"line_number":568,"context_line":"    condition: (proc.name\u003djava and proc.cmdline contains \"jar /zap\" and fd.name startswith /root/.ZAP)"},{"line_number":569,"context_line":"  - macro: airflow_writing_state"},{"line_number":570,"context_line":"    condition: (proc.name\u003dairflow and fd.name startswith /root/airflow)"},{"line_number":571,"context_line":"  - macro: rpm_writing_root_rpmdb"},{"line_number":572,"context_line":"    condition: (proc.name\u003drpm and fd.directory\u003d/root/.rpmdb)"},{"line_number":573,"context_line":"  - macro: maven_writing_groovy"},{"line_number":574,"context_line":"    condition: (proc.name\u003djava and proc.cmdline contains \"classpath /usr/local/apache-maven\" and fd.name startswith /root/.groovy)"},{"line_number":575,"context_line":"  - rule: Write below binary dir"},{"line_number":576,"context_line":"    desc: an attempt to write to any file below a set of binary directories"},{"line_number":577,"context_line":"    condition: \u003e"},{"line_number":578,"context_line":"      bin_dir and evt.dir \u003d \u003c and open_write"},{"line_number":579,"context_line":"      and not package_mgmt_procs"},{"line_number":580,"context_line":"      and not exe_running_docker_save"},{"line_number":581,"context_line":"      and not python_running_get_pip"},{"line_number":582,"context_line":"      and not python_running_ms_oms"},{"line_number":583,"context_line":"    output: \u003e"},{"line_number":584,"context_line":"      File below a known binary directory opened for writing (user\u003d%user.name"},{"line_number":585,"context_line":"      command\u003d%proc.cmdline file\u003d%fd.name parent\u003d%proc.pname pcmdline\u003d%proc.pcmdline gparent\u003d%proc.aname[2])"},{"line_number":586,"context_line":"    priority: ERROR"},{"line_number":587,"context_line":"    tags: [filesystem]"},{"line_number":588,"context_line":"  - list: monitored_directories"},{"line_number":589,"context_line":"    items: [/boot, /lib, /lib64, /usr/lib, /usr/local/lib, /usr/local/sbin, /usr/local/bin, /root/.ssh, /etc/cardserver]"},{"line_number":590,"context_line":"  - macro: user_ssh_directory"},{"line_number":591,"context_line":"    condition: (fd.name startswith \u0027/home\u0027 and fd.name contains \u0027.ssh\u0027)"},{"line_number":592,"context_line":"  - macro: mkinitramfs_writing_boot"},{"line_number":593,"context_line":"    condition: (proc.pname in (mkinitramfs, update-initramf) and fd.directory\u003d/boot)"},{"line_number":594,"context_line":"  - macro: monitored_dir"},{"line_number":595,"context_line":"    condition: \u003e"},{"line_number":596,"context_line":"      (fd.directory in (monitored_directories)"},{"line_number":597,"context_line":"       or user_ssh_directory)"},{"line_number":598,"context_line":"      and not mkinitramfs_writing_boot"},{"line_number":599,"context_line":"  - rule: Write below monitored dir"},{"line_number":600,"context_line":"    desc: an attempt to write to any file below a set of binary directories"},{"line_number":601,"context_line":"    condition: \u003e"},{"line_number":602,"context_line":"      evt.dir \u003d \u003c and open_write and monitored_dir"},{"line_number":603,"context_line":"      and not package_mgmt_procs"},{"line_number":604,"context_line":"      and not coreos_write_ssh_dir"},{"line_number":605,"context_line":"      and not exe_running_docker_save"},{"line_number":606,"context_line":"      and not python_running_get_pip"},{"line_number":607,"context_line":"      and not python_running_ms_oms"},{"line_number":608,"context_line":"    output: \u003e"},{"line_number":609,"context_line":"      File below a monitored directory opened for writing (user\u003d%user.name"},{"line_number":610,"context_line":"      command\u003d%proc.cmdline file\u003d%fd.name parent\u003d%proc.pname pcmdline\u003d%proc.pcmdline gparent\u003d%proc.aname[2])"},{"line_number":611,"context_line":"    priority: ERROR"},{"line_number":612,"context_line":"    tags: [filesystem]"},{"line_number":613,"context_line":"  - list: safe_etc_dirs"},{"line_number":614,"context_line":"    items: [/etc/cassandra, /etc/ssl/certs/java, /etc/logstash, /etc/nginx/conf.d, /etc/container_environment, /etc/hrmconfig]"},{"line_number":615,"context_line":"  - macro: fluentd_writing_conf_files"},{"line_number":616,"context_line":"    condition: (proc.name\u003dstart-fluentd and fd.name in (/etc/fluent/fluent.conf, /etc/td-agent/td-agent.conf))"},{"line_number":617,"context_line":"  - macro: qualys_writing_conf_files"},{"line_number":618,"context_line":"    condition: (proc.name\u003dqualys-cloud-ag and fd.name\u003d/etc/qualys/cloud-agent/qagent-log.conf)"},{"line_number":619,"context_line":"  - macro: git_writing_nssdb"},{"line_number":620,"context_line":"    condition: (proc.name\u003dgit-remote-http and fd.directory\u003d/etc/pki/nssdb)"},{"line_number":621,"context_line":"  - macro: plesk_writing_keys"},{"line_number":622,"context_line":"    condition: (proc.name in (plesk_binaries) and fd.name startswith /etc/sw/keys)"},{"line_number":623,"context_line":"  - macro: plesk_install_writing_apache_conf"},{"line_number":624,"context_line":"    condition: (proc.cmdline startswith \"bash -hB /usr/lib/plesk-9.0/services/webserver.apache configure\""},{"line_number":625,"context_line":"                and fd.name\u003d\"/etc/apache2/apache2.conf.tmp\")"},{"line_number":626,"context_line":"  - macro: plesk_running_mktemp"},{"line_number":627,"context_line":"    condition: (proc.name\u003dmktemp and proc.aname[3] in (plesk_binaries))"},{"line_number":628,"context_line":"  - macro: networkmanager_writing_resolv_conf"},{"line_number":629,"context_line":"    condition: proc.aname[2]\u003dnm-dispatcher and fd.name\u003d/etc/resolv.conf"},{"line_number":630,"context_line":"  - macro: add_shell_writing_shells_tmp"},{"line_number":631,"context_line":"    condition: (proc.name\u003dadd-shell and fd.name\u003d/etc/shells.tmp)"},{"line_number":632,"context_line":"  - macro: duply_writing_exclude_files"},{"line_number":633,"context_line":"    condition: (proc.name\u003dtouch and proc.pcmdline startswith \"bash /usr/bin/duply\" and fd.name startswith \"/etc/duply\")"},{"line_number":634,"context_line":"  - macro: xmlcatalog_writing_files"},{"line_number":635,"context_line":"    condition: (proc.name\u003dupdate-xmlcatal and fd.directory\u003d/etc/xml)"},{"line_number":636,"context_line":"  - macro: datadog_writing_conf"},{"line_number":637,"context_line":"    condition: ((proc.cmdline startswith \"python /opt/datadog-agent\" or"},{"line_number":638,"context_line":"                 proc.cmdline startswith \"entrypoint.sh /entrypoint.sh datadog start\" or"},{"line_number":639,"context_line":"                 proc.cmdline startswith \"agent.py /opt/datadog-agent\")"},{"line_number":640,"context_line":"                and fd.name startswith \"/etc/dd-agent\")"},{"line_number":641,"context_line":"  - macro: curl_writing_pki_db"},{"line_number":642,"context_line":"    condition: (proc.name\u003dcurl and fd.directory\u003d/etc/pki/nssdb)"},{"line_number":643,"context_line":"  - macro: haproxy_writing_conf"},{"line_number":644,"context_line":"    condition: ((proc.name in (update-haproxy-,haproxy_reload.) or proc.pname in (update-haproxy-,haproxy_reload,haproxy_reload.))"},{"line_number":645,"context_line":"                 and (fd.name\u003d/etc/openvpn/client.map or fd.name startswith /etc/haproxy))"},{"line_number":646,"context_line":"  - macro: java_writing_conf"},{"line_number":647,"context_line":"    condition: (proc.name\u003djava and fd.name\u003d/etc/.java/.systemPrefs/.system.lock)"},{"line_number":648,"context_line":"  - macro: rabbitmq_writing_conf"},{"line_number":649,"context_line":"    condition: (proc.name\u003drabbitmq-server and fd.directory\u003d/etc/rabbitmq)"},{"line_number":650,"context_line":"  - macro: rook_writing_conf"},{"line_number":651,"context_line":"    condition: (proc.name\u003dtoolbox.sh and container.image startswith rook/toolbox"},{"line_number":652,"context_line":"                and fd.directory\u003d/etc/ceph)"},{"line_number":653,"context_line":"  - macro: httpd_writing_conf_logs"},{"line_number":654,"context_line":"    condition: (proc.name\u003dhttpd and fd.name startswith /etc/httpd/)"},{"line_number":655,"context_line":"  - macro: mysql_writing_conf"},{"line_number":656,"context_line":"    condition: \u003e"},{"line_number":657,"context_line":"      ((proc.name in (start-mysql.sh, run-mysqld) or proc.pname\u003dstart-mysql.sh) and"},{"line_number":658,"context_line":"       (fd.name startswith /etc/mysql or fd.directory\u003d/etc/my.cnf.d))"},{"line_number":659,"context_line":"  - macro: redis_writing_conf"},{"line_number":660,"context_line":"    condition: \u003e"},{"line_number":661,"context_line":"      (proc.name in (run-redis, redis-launcher.) and fd.name\u003d/etc/redis.conf or fd.name startswith /etc/redis)"},{"line_number":662,"context_line":"  - macro: openvpn_writing_conf"},{"line_number":663,"context_line":"    condition: (proc.name in (openvpn,openvpn-entrypo) and fd.name startswith /etc/openvpn)"},{"line_number":664,"context_line":"  - macro: php_handlers_writing_conf"},{"line_number":665,"context_line":"    condition: (proc.name\u003dphp_handlers_co and fd.name\u003d/etc/psa/php_versions.json)"},{"line_number":666,"context_line":"  - macro: sed_writing_temp_file"},{"line_number":667,"context_line":"    condition: \u003e"},{"line_number":668,"context_line":"      ((proc.aname[3]\u003dcron_start.sh and fd.name startswith /etc/security/sed) or"},{"line_number":669,"context_line":"       (proc.name\u003dsed and (fd.name startswith /etc/apt/sources.list.d/sed or"},{"line_number":670,"context_line":"                           fd.name startswith /etc/apt/sed or"},{"line_number":671,"context_line":"                           fd.name startswith /etc/apt/apt.conf.d/sed)))"},{"line_number":672,"context_line":"  - macro: cron_start_writing_pam_env"},{"line_number":673,"context_line":"    condition: (proc.cmdline\u003d\"bash /usr/sbin/start-cron\" and fd.name\u003d/etc/security/pam_env.conf)"},{"line_number":674,"context_line":"  - macro: dpkg_scripting"},{"line_number":675,"context_line":"    condition: (proc.aname[2] in (dpkg-reconfigur, dpkg-preconfigu))"},{"line_number":676,"context_line":"  - macro: user_known_write_etc_conditions"},{"line_number":677,"context_line":"    condition: proc.name\u003dconfd"},{"line_number":678,"context_line":"  - macro: write_etc_common"},{"line_number":679,"context_line":"    condition: \u003e"},{"line_number":680,"context_line":"      etc_dir and evt.dir \u003d \u003c and open_write"},{"line_number":681,"context_line":"      and proc_name_exists"},{"line_number":682,"context_line":"      and not proc.name in (passwd_binaries, shadowutils_binaries, sysdigcloud_binaries,"},{"line_number":683,"context_line":"                            package_mgmt_binaries, ssl_mgmt_binaries, dhcp_binaries,"},{"line_number":684,"context_line":"                            dev_creation_binaries, shell_mgmt_binaries,"},{"line_number":685,"context_line":"                            mail_config_binaries,"},{"line_number":686,"context_line":"                            sshkit_script_binaries,"},{"line_number":687,"context_line":"                            ldconfig.real, ldconfig, confd, gpg, insserv,"},{"line_number":688,"context_line":"                            apparmor_parser, update-mime, tzdata.config, tzdata.postinst,"},{"line_number":689,"context_line":"                            systemd, systemd-machine, systemd-sysuser,"},{"line_number":690,"context_line":"                            debconf-show, rollerd, bind9.postinst, sv,"},{"line_number":691,"context_line":"                            gen_resolvconf., update-ca-certi, certbot, runsv,"},{"line_number":692,"context_line":"                            qualys-cloud-ag, locales.postins, nomachine_binaries,"},{"line_number":693,"context_line":"                            adclient, certutil, crlutil, pam-auth-update, parallels_insta,"},{"line_number":694,"context_line":"                            openshift-launc, update-rc.d)"},{"line_number":695,"context_line":"      and not proc.pname in (sysdigcloud_binaries, mail_config_binaries, hddtemp.postins, sshkit_script_binaries, locales.postins, deb_binaries, dhcp_binaries)"},{"line_number":696,"context_line":"      and not fd.name pmatch (safe_etc_dirs)"},{"line_number":697,"context_line":"      and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json, /etc/motd, /etc/motd.svc)"},{"line_number":698,"context_line":"      and not sed_temporary_file"},{"line_number":699,"context_line":"      and not exe_running_docker_save"},{"line_number":700,"context_line":"      and not ansible_running_python"},{"line_number":701,"context_line":"      and not python_running_denyhosts"},{"line_number":702,"context_line":"      and not fluentd_writing_conf_files"},{"line_number":703,"context_line":"      and not user_known_write_etc_conditions"},{"line_number":704,"context_line":"      and not run_by_centrify"},{"line_number":705,"context_line":"      and not run_by_adclient"},{"line_number":706,"context_line":"      and not qualys_writing_conf_files"},{"line_number":707,"context_line":"      and not git_writing_nssdb"},{"line_number":708,"context_line":"      and not plesk_writing_keys"},{"line_number":709,"context_line":"      and not plesk_install_writing_apache_conf"},{"line_number":710,"context_line":"      and not plesk_running_mktemp"},{"line_number":711,"context_line":"      and not networkmanager_writing_resolv_conf"},{"line_number":712,"context_line":"      and not run_by_chef"},{"line_number":713,"context_line":"      and not add_shell_writing_shells_tmp"},{"line_number":714,"context_line":"      and not duply_writing_exclude_files"},{"line_number":715,"context_line":"      and not xmlcatalog_writing_files"},{"line_number":716,"context_line":"      and not parent_supervise_running_multilog"},{"line_number":717,"context_line":"      and not supervise_writing_status"},{"line_number":718,"context_line":"      and not pki_realm_writing_realms"},{"line_number":719,"context_line":"      and not htpasswd_writing_passwd"},{"line_number":720,"context_line":"      and not lvprogs_writing_conf"},{"line_number":721,"context_line":"      and not ovsdb_writing_openvswitch"},{"line_number":722,"context_line":"      and not datadog_writing_conf"},{"line_number":723,"context_line":"      and not curl_writing_pki_db"},{"line_number":724,"context_line":"      and not haproxy_writing_conf"},{"line_number":725,"context_line":"      and not java_writing_conf"},{"line_number":726,"context_line":"      and not dpkg_scripting"},{"line_number":727,"context_line":"      and not parent_ucf_writing_conf"},{"line_number":728,"context_line":"      and not rabbitmq_writing_conf"},{"line_number":729,"context_line":"      and not rook_writing_conf"},{"line_number":730,"context_line":"      and not php_handlers_writing_conf"},{"line_number":731,"context_line":"      and not sed_writing_temp_file"},{"line_number":732,"context_line":"      and not cron_start_writing_pam_env"},{"line_number":733,"context_line":"      and not httpd_writing_conf_logs"},{"line_number":734,"context_line":"      and not mysql_writing_conf"},{"line_number":735,"context_line":"      and not openvpn_writing_conf"},{"line_number":736,"context_line":"      and not consul_template_writing_conf"},{"line_number":737,"context_line":"      and not countly_writing_nginx_conf"},{"line_number":738,"context_line":"      and not ms_oms_writing_conf"},{"line_number":739,"context_line":"      and not ms_scx_writing_conf"},{"line_number":740,"context_line":"      and not azure_scripts_writing_conf"},{"line_number":741,"context_line":"      and not azure_networkwatcher_writing_conf"},{"line_number":742,"context_line":"      and not couchdb_writing_conf"},{"line_number":743,"context_line":"      and not update_texmf_writing_conf"},{"line_number":744,"context_line":"      and not slapadd_writing_conf"},{"line_number":745,"context_line":"      and not symantec_writing_conf"},{"line_number":746,"context_line":"      and not liveupdate_writing_conf"},{"line_number":747,"context_line":"      and not sosreport_writing_files"},{"line_number":748,"context_line":"      and not selinux_writing_conf"},{"line_number":749,"context_line":"      and not veritas_writing_config"},{"line_number":750,"context_line":"      and not nginx_writing_conf"},{"line_number":751,"context_line":"      and not nginx_writing_certs"},{"line_number":752,"context_line":"      and not chef_client_writing_conf"},{"line_number":753,"context_line":"      and not centrify_writing_krb"},{"line_number":754,"context_line":"      and not cockpit_writing_conf"},{"line_number":755,"context_line":"      and not ipsec_writing_conf"},{"line_number":756,"context_line":"      and not httpd_writing_ssl_conf"},{"line_number":757,"context_line":"      and not userhelper_writing_etc_security"},{"line_number":758,"context_line":"      and not pkgmgmt_progs_writing_pki"},{"line_number":759,"context_line":"      and not update_ca_trust_writing_pki"},{"line_number":760,"context_line":"      and not brandbot_writing_os_release"},{"line_number":761,"context_line":"      and not redis_writing_conf"},{"line_number":762,"context_line":"      and not openldap_writing_conf"},{"line_number":763,"context_line":"      and not ucpagent_writing_conf"},{"line_number":764,"context_line":"      and not iscsi_writing_conf"},{"line_number":765,"context_line":"  - rule: Write below etc"},{"line_number":766,"context_line":"    desc: an attempt to write to any file below /etc"},{"line_number":767,"context_line":"    condition: write_etc_common"},{"line_number":768,"context_line":"    output: \"File below /etc opened for writing (user\u003d%user.name command\u003d%proc.cmdline parent\u003d%proc.pname pcmdline\u003d%proc.pcmdline file\u003d%fd.name program\u003d%proc.name gparent\u003d%proc.aname[2] ggparent\u003d%proc.aname[3] gggparent\u003d%proc.aname[4])\""},{"line_number":769,"context_line":"    priority: ERROR"},{"line_number":770,"context_line":"    tags: [filesystem]"},{"line_number":771,"context_line":"  - list: known_root_files"},{"line_number":772,"context_line":"    items: [/root/.monit.state, /root/.auth_tokens, /root/.bash_history, /root/.ash_history, /root/.aws/credentials,"},{"line_number":773,"context_line":"            /root/.viminfo.tmp, /root/.lesshst, /root/.bzr.log, /root/.gitconfig.lock, /root/.babel.json, /root/.localstack,"},{"line_number":774,"context_line":"            /root/.node_repl_history, /root/.mongorc.js, /root/.dbshell, /root/.augeas/history, /root/.rnd, /root/.wget-hsts]"},{"line_number":775,"context_line":"  - list: known_root_directories"},{"line_number":776,"context_line":"    items: [/root/.oracle_jre_usage, /root/.ssh, /root/.subversion, /root/.nami]"},{"line_number":777,"context_line":"  - macro: known_root_conditions"},{"line_number":778,"context_line":"    condition: (fd.name startswith /root/orcexec."},{"line_number":779,"context_line":"                or fd.name startswith /root/.m2"},{"line_number":780,"context_line":"                or fd.name startswith /root/.npm"},{"line_number":781,"context_line":"                or fd.name startswith /root/.pki"},{"line_number":782,"context_line":"                or fd.name startswith /root/.ivy2"},{"line_number":783,"context_line":"                or fd.name startswith /root/.config/Cypress"},{"line_number":784,"context_line":"                or fd.name startswith /root/.config/pulse"},{"line_number":785,"context_line":"                or fd.name startswith /root/.config/configstore"},{"line_number":786,"context_line":"                or fd.name startswith /root/jenkins/workspace"},{"line_number":787,"context_line":"                or fd.name startswith /root/.jenkins"},{"line_number":788,"context_line":"                or fd.name startswith /root/.cache"},{"line_number":789,"context_line":"                or fd.name startswith /root/.sbt"},{"line_number":790,"context_line":"                or fd.name startswith /root/.java"},{"line_number":791,"context_line":"                or fd.name startswith /root/.glide"},{"line_number":792,"context_line":"                or fd.name startswith /root/.sonar"},{"line_number":793,"context_line":"                or fd.name startswith /root/.v8flag"},{"line_number":794,"context_line":"                or fd.name startswith /root/infaagent"},{"line_number":795,"context_line":"                or fd.name startswith /root/.local/lib/python"},{"line_number":796,"context_line":"                or fd.name startswith /root/.pm2"},{"line_number":797,"context_line":"                or fd.name startswith /root/.gnupg"},{"line_number":798,"context_line":"                or fd.name startswith /root/.pgpass"},{"line_number":799,"context_line":"                or fd.name startswith /root/.theano"},{"line_number":800,"context_line":"                or fd.name startswith /root/.gradle"},{"line_number":801,"context_line":"                or fd.name startswith /root/.android"},{"line_number":802,"context_line":"                or fd.name startswith /root/.ansible"},{"line_number":803,"context_line":"                or fd.name startswith /root/.crashlytics"},{"line_number":804,"context_line":"                or fd.name startswith /root/.dbus"},{"line_number":805,"context_line":"                or fd.name startswith /root/.composer"},{"line_number":806,"context_line":"                or fd.name startswith /root/.gconf"},{"line_number":807,"context_line":"                or fd.name startswith /root/.nv"},{"line_number":808,"context_line":"                or fd.name startswith /root/.local/share/jupyter"},{"line_number":809,"context_line":"                or fd.name startswith /root/oradiag_root"},{"line_number":810,"context_line":"                or fd.name startswith /root/workspace"},{"line_number":811,"context_line":"                or fd.name startswith /root/jvm"},{"line_number":812,"context_line":"                or fd.name startswith /root/.node-gyp)"},{"line_number":813,"context_line":"  - rule: Write below root"},{"line_number":814,"context_line":"    desc: an attempt to write to any file directly below / or /root"},{"line_number":815,"context_line":"    condition: \u003e"},{"line_number":816,"context_line":"      root_dir and evt.dir \u003d \u003c and open_write"},{"line_number":817,"context_line":"      and not fd.name in (known_root_files)"},{"line_number":818,"context_line":"      and not fd.directory in (known_root_directories)"},{"line_number":819,"context_line":"      and not exe_running_docker_save"},{"line_number":820,"context_line":"      and not gugent_writing_guestagent_log"},{"line_number":821,"context_line":"      and not dse_writing_tmp"},{"line_number":822,"context_line":"      and not zap_writing_state"},{"line_number":823,"context_line":"      and not airflow_writing_state"},{"line_number":824,"context_line":"      and not rpm_writing_root_rpmdb"},{"line_number":825,"context_line":"      and not maven_writing_groovy"},{"line_number":826,"context_line":"      and not known_root_conditions"},{"line_number":827,"context_line":"    output: \"File below / or /root opened for writing (user\u003d%user.name command\u003d%proc.cmdline parent\u003d%proc.pname file\u003d%fd.name program\u003d%proc.name)\""},{"line_number":828,"context_line":"    priority: ERROR"},{"line_number":829,"context_line":"    tags: [filesystem]"},{"line_number":830,"context_line":"  - macro: cmp_cp_by_passwd"},{"line_number":831,"context_line":"    condition: proc.name in (cmp, cp) and proc.pname in (passwd, run-parts)"},{"line_number":832,"context_line":"  - rule: Read sensitive file trusted after startup"},{"line_number":833,"context_line":"    desc: \u003e"},{"line_number":834,"context_line":"      an attempt to read any sensitive file (e.g. files containing user/password/authentication"},{"line_number":835,"context_line":"      information) by a trusted program after startup. Trusted programs might read these files"},{"line_number":836,"context_line":"      at startup to load initial state, but not afterwards."},{"line_number":837,"context_line":"    condition: sensitive_files and open_read and server_procs and not proc_is_new and proc.name!\u003d\"sshd\""},{"line_number":838,"context_line":"    output: \u003e"},{"line_number":839,"context_line":"      Sensitive file opened for reading by trusted program after startup (user\u003d%user.name"},{"line_number":840,"context_line":"      command\u003d%proc.cmdline parent\u003d%proc.pname file\u003d%fd.name parent\u003d%proc.pname gparent\u003d%proc.aname[2])"},{"line_number":841,"context_line":"    priority: WARNING"},{"line_number":842,"context_line":"    tags: [filesystem]"},{"line_number":843,"context_line":"  - list: read_sensitive_file_binaries"},{"line_number":844,"context_line":"    items: ["},{"line_number":845,"context_line":"      iptables, ps, lsb_release, check-new-relea, dumpe2fs, accounts-daemon, sshd,"},{"line_number":846,"context_line":"      vsftpd, systemd, mysql_install_d, psql, screen, debconf-show, sa-update,"},{"line_number":847,"context_line":"      pam-auth-update, pam-config, /usr/sbin/spamd, polkit-agent-he, lsattr, file, sosreport,"},{"line_number":848,"context_line":"      scxcimservera, adclient, rtvscand, cockpit-session, userhelper, ossec-syscheckd"},{"line_number":849,"context_line":"      ]"},{"line_number":850,"context_line":"  - macro: user_read_sensitive_file_conditions"},{"line_number":851,"context_line":"    condition: cmp_cp_by_passwd"},{"line_number":852,"context_line":"  - rule: Read sensitive file untrusted"},{"line_number":853,"context_line":"    desc: \u003e"},{"line_number":854,"context_line":"      an attempt to read any sensitive file (e.g. files containing user/password/authentication"},{"line_number":855,"context_line":"      information). Exceptions are made for known trusted programs."},{"line_number":856,"context_line":"    condition: \u003e"},{"line_number":857,"context_line":"      sensitive_files and open_read"},{"line_number":858,"context_line":"      and proc_name_exists"},{"line_number":859,"context_line":"      and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries,"},{"line_number":860,"context_line":"       cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries,"},{"line_number":861,"context_line":"       vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries,"},{"line_number":862,"context_line":"       in.proftpd, mandb, salt-minion, postgres_mgmt_binaries)"},{"line_number":863,"context_line":"      and not cmp_cp_by_passwd"},{"line_number":864,"context_line":"      and not ansible_running_python"},{"line_number":865,"context_line":"      and not proc.cmdline contains /usr/bin/mandb"},{"line_number":866,"context_line":"      and not run_by_qualys"},{"line_number":867,"context_line":"      and not run_by_chef"},{"line_number":868,"context_line":"      and not user_read_sensitive_file_conditions"},{"line_number":869,"context_line":"      and not perl_running_plesk"},{"line_number":870,"context_line":"      and not perl_running_updmap"},{"line_number":871,"context_line":"      and not veritas_driver_script"},{"line_number":872,"context_line":"      and not perl_running_centrifydc"},{"line_number":873,"context_line":"    output: \u003e"},{"line_number":874,"context_line":"      Sensitive file opened for reading by non-trusted program (user\u003d%user.name program\u003d%proc.name"},{"line_number":875,"context_line":"      command\u003d%proc.cmdline file\u003d%fd.name parent\u003d%proc.pname gparent\u003d%proc.aname[2] ggparent\u003d%proc.aname[3] gggparent\u003d%proc.aname[4])"},{"line_number":876,"context_line":"    priority: WARNING"},{"line_number":877,"context_line":"    tags: [filesystem]"},{"line_number":878,"context_line":"  - rule: Write below rpm database"},{"line_number":879,"context_line":"    desc: an attempt to write to the rpm database by any non-rpm related program"},{"line_number":880,"context_line":"    condition: fd.name startswith /var/lib/rpm and open_write and not rpm_procs and not ansible_running_python and not python_running_chef"},{"line_number":881,"context_line":"    output: \"Rpm database opened for writing by a non-rpm program (command\u003d%proc.cmdline file\u003d%fd.name parent\u003d%proc.pname pcmdline\u003d%proc.pcmdline)\""},{"line_number":882,"context_line":"    priority: ERROR"},{"line_number":883,"context_line":"    tags: [filesystem, software_mgmt]"},{"line_number":884,"context_line":"  - macro: postgres_running_wal_e"},{"line_number":885,"context_line":"    condition: (proc.pname\u003dpostgres and proc.cmdline startswith \"sh -c envdir /etc/wal-e.d/env /usr/local/bin/wal-e\")"},{"line_number":886,"context_line":"  - macro: redis_running_prepost_scripts"},{"line_number":887,"context_line":"    condition: (proc.aname[2]\u003dredis-server and (proc.cmdline contains \"redis-server.post-up.d\" or proc.cmdline contains \"redis-server.pre-up.d\"))"},{"line_number":888,"context_line":"  - macro: rabbitmq_running_scripts"},{"line_number":889,"context_line":"    condition: \u003e"},{"line_number":890,"context_line":"      (proc.pname\u003dbeam.smp and"},{"line_number":891,"context_line":"      (proc.cmdline startswith \"sh -c exec ps\" or"},{"line_number":892,"context_line":"       proc.cmdline startswith \"sh -c exec inet_gethost\" or"},{"line_number":893,"context_line":"       proc.cmdline\u003d \"sh -s unix:cmd\" or"},{"line_number":894,"context_line":"       proc.cmdline\u003d \"sh -c exec /bin/sh -s unix:cmd 2\u003e\u00261\"))"},{"line_number":895,"context_line":"  - macro: rabbitmqctl_running_scripts"},{"line_number":896,"context_line":"    condition: (proc.aname[2]\u003drabbitmqctl and proc.cmdline startswith \"sh -c \")"},{"line_number":897,"context_line":"  - macro: run_by_appdynamics"},{"line_number":898,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline startswith \"java -jar -Dappdynamics\")"},{"line_number":899,"context_line":"  - rule: DB program spawned process"},{"line_number":900,"context_line":"    desc: \u003e"},{"line_number":901,"context_line":"      a database-server related program spawned a new process other than itself."},{"line_number":902,"context_line":"      This shouldn\\\u0027t occur and is a follow on from some SQL injection attacks."},{"line_number":903,"context_line":"    condition: \u003e"},{"line_number":904,"context_line":"      proc.pname in (db_server_binaries)"},{"line_number":905,"context_line":"      and spawned_process"},{"line_number":906,"context_line":"      and not proc.name in (db_server_binaries)"},{"line_number":907,"context_line":"      and not postgres_running_wal_e"},{"line_number":908,"context_line":"    output: \u003e"},{"line_number":909,"context_line":"      Database-related program spawned process other than itself (user\u003d%user.name"},{"line_number":910,"context_line":"      program\u003d%proc.cmdline parent\u003d%proc.pname)"},{"line_number":911,"context_line":"    priority: NOTICE"},{"line_number":912,"context_line":"    tags: [process, database]"},{"line_number":913,"context_line":"  - rule: Modify binary dirs"},{"line_number":914,"context_line":"    desc: an attempt to modify any file below a set of binary directories."},{"line_number":915,"context_line":"    condition: (bin_dir_rename) and modify and not package_mgmt_procs and not exe_running_docker_save"},{"line_number":916,"context_line":"    output: \u003e"},{"line_number":917,"context_line":"      File below known binary directory renamed/removed (user\u003d%user.name command\u003d%proc.cmdline"},{"line_number":918,"context_line":"      pcmdline\u003d%proc.pcmdline operation\u003d%evt.type file\u003d%fd.name %evt.args)"},{"line_number":919,"context_line":"    priority: ERROR"},{"line_number":920,"context_line":"    tags: [filesystem]"},{"line_number":921,"context_line":"  - rule: Mkdir binary dirs"},{"line_number":922,"context_line":"    desc: an attempt to create a directory below a set of binary directories."},{"line_number":923,"context_line":"    condition: mkdir and bin_dir_mkdir and not package_mgmt_procs"},{"line_number":924,"context_line":"    output: \u003e"},{"line_number":925,"context_line":"      Directory below known binary directory created (user\u003d%user.name"},{"line_number":926,"context_line":"      command\u003d%proc.cmdline directory\u003d%evt.arg.path)"},{"line_number":927,"context_line":"    priority: ERROR"},{"line_number":928,"context_line":"    tags: [filesystem]"},{"line_number":929,"context_line":"  - list: user_known_change_thread_namespace_binaries"},{"line_number":930,"context_line":"    items: []"},{"line_number":931,"context_line":"  - rule: Change thread namespace"},{"line_number":932,"context_line":"    desc: \u003e"},{"line_number":933,"context_line":"      an attempt to change a program/thread\\\u0027s namespace (commonly done"},{"line_number":934,"context_line":"      as a part of creating a container) by calling setns."},{"line_number":935,"context_line":"    condition: \u003e"},{"line_number":936,"context_line":"      evt.type \u003d setns"},{"line_number":937,"context_line":"      and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, sysdig, nsenter)"},{"line_number":938,"context_line":"      and not proc.name in (user_known_change_thread_namespace_binaries)"},{"line_number":939,"context_line":"      and not proc.name startswith \"runc:\""},{"line_number":940,"context_line":"      and not proc.pname in (sysdigcloud_binaries)"},{"line_number":941,"context_line":"      and not java_running_sdjagent"},{"line_number":942,"context_line":"      and not kubelet_running_loopback"},{"line_number":943,"context_line":"    output: \u003e"},{"line_number":944,"context_line":"      Namespace change (setns) by unexpected program (user\u003d%user.name command\u003d%proc.cmdline"},{"line_number":945,"context_line":"      parent\u003d%proc.pname %container.info)"},{"line_number":946,"context_line":"    priority: NOTICE"},{"line_number":947,"context_line":"    tags: [process]"},{"line_number":948,"context_line":"  - list: protected_shell_spawning_binaries"},{"line_number":949,"context_line":"    items: ["},{"line_number":950,"context_line":"      http_server_binaries, db_server_binaries, nosql_server_binaries, mail_binaries,"},{"line_number":951,"context_line":"      fluentd, flanneld, splunkd, consul, smbd, runsv, PM2"},{"line_number":952,"context_line":"      ]"},{"line_number":953,"context_line":"  - macro: parent_java_running_zookeeper"},{"line_number":954,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains org.apache.zookeeper.server)"},{"line_number":955,"context_line":"  - macro: parent_java_running_kafka"},{"line_number":956,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains kafka.Kafka)"},{"line_number":957,"context_line":"  - macro: parent_java_running_elasticsearch"},{"line_number":958,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains org.elasticsearch.bootstrap.Elasticsearch)"},{"line_number":959,"context_line":"  - macro: parent_java_running_activemq"},{"line_number":960,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains activemq.jar)"},{"line_number":961,"context_line":"  - macro: parent_java_running_cassandra"},{"line_number":962,"context_line":"    condition: (proc.pname\u003djava and (proc.pcmdline contains \"-Dcassandra.config.loader\" or proc.pcmdline contains org.apache.cassandra.service.CassandraDaemon))"},{"line_number":963,"context_line":"  - macro: parent_java_running_jboss_wildfly"},{"line_number":964,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains org.jboss)"},{"line_number":965,"context_line":"  - macro: parent_java_running_glassfish"},{"line_number":966,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains com.sun.enterprise.glassfish)"},{"line_number":967,"context_line":"  - macro: parent_java_running_hadoop"},{"line_number":968,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains org.apache.hadoop)"},{"line_number":969,"context_line":"  - macro: parent_java_running_datastax"},{"line_number":970,"context_line":"    condition: (proc.pname\u003djava and proc.pcmdline contains com.datastax)"},{"line_number":971,"context_line":"  - macro: nginx_starting_nginx"},{"line_number":972,"context_line":"    condition: (proc.pname\u003dnginx and proc.cmdline contains \"/usr/sbin/nginx -c /etc/nginx/nginx.conf\")"},{"line_number":973,"context_line":"  - macro: nginx_running_aws_s3_cp"},{"line_number":974,"context_line":"    condition: (proc.pname\u003dnginx and proc.cmdline startswith \"sh -c /usr/local/bin/aws s3 cp\")"},{"line_number":975,"context_line":"  - macro: consul_running_net_scripts"},{"line_number":976,"context_line":"    condition: (proc.pname\u003dconsul and (proc.cmdline startswith \"sh -c curl\" or proc.cmdline startswith \"sh -c nc\"))"},{"line_number":977,"context_line":"  - macro: consul_running_alert_checks"},{"line_number":978,"context_line":"    condition: (proc.pname\u003dconsul and proc.cmdline startswith \"sh -c /bin/consul-alerts\")"},{"line_number":979,"context_line":"  - macro: serf_script"},{"line_number":980,"context_line":"    condition: (proc.cmdline startswith \"sh -c serf\")"},{"line_number":981,"context_line":"  - macro: check_process_status"},{"line_number":982,"context_line":"    condition: (proc.cmdline startswith \"sh -c kill -0 \")"},{"line_number":983,"context_line":"  - macro: possibly_node_in_container"},{"line_number":984,"context_line":"    condition: (never_true and (proc.pname\u003dnode and proc.aname[3]\u003ddocker-containe))"},{"line_number":985,"context_line":"  - macro: possibly_parent_java_running_tomcat"},{"line_number":986,"context_line":"    condition: (never_true and proc.pname\u003djava and proc.pcmdline contains org.apache.catalina.startup.Bootstrap)"},{"line_number":987,"context_line":"  - macro: protected_shell_spawner"},{"line_number":988,"context_line":"    condition: \u003e"},{"line_number":989,"context_line":"      (proc.aname in (protected_shell_spawning_binaries)"},{"line_number":990,"context_line":"      or parent_java_running_zookeeper"},{"line_number":991,"context_line":"      or parent_java_running_kafka"},{"line_number":992,"context_line":"      or parent_java_running_elasticsearch"},{"line_number":993,"context_line":"      or parent_java_running_activemq"},{"line_number":994,"context_line":"      or parent_java_running_cassandra"},{"line_number":995,"context_line":"      or parent_java_running_jboss_wildfly"},{"line_number":996,"context_line":"      or parent_java_running_glassfish"},{"line_number":997,"context_line":"      or parent_java_running_hadoop"},{"line_number":998,"context_line":"      or parent_java_running_datastax"},{"line_number":999,"context_line":"      or possibly_parent_java_running_tomcat"},{"line_number":1000,"context_line":"      or possibly_node_in_container)"},{"line_number":1001,"context_line":"  - list: mesos_shell_binaries"},{"line_number":1002,"context_line":"    items: [mesos-docker-ex, mesos-slave, mesos-health-ch]"},{"line_number":1003,"context_line":"  - rule: Run shell untrusted"},{"line_number":1004,"context_line":"    desc: an attempt to spawn a shell below a non-shell application. Specific applications are monitored."},{"line_number":1005,"context_line":"    condition: \u003e"},{"line_number":1006,"context_line":"      spawned_process"},{"line_number":1007,"context_line":"      and shell_procs"},{"line_number":1008,"context_line":"      and proc.pname exists"},{"line_number":1009,"context_line":"      and protected_shell_spawner"},{"line_number":1010,"context_line":"      and not proc.pname in (shell_binaries, gitlab_binaries, cron_binaries, user_known_shell_spawn_binaries,"},{"line_number":1011,"context_line":"                             needrestart_binaries,"},{"line_number":1012,"context_line":"                             mesos_shell_binaries,"},{"line_number":1013,"context_line":"                             erl_child_setup, exechealthz,"},{"line_number":1014,"context_line":"                             PM2, PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf,"},{"line_number":1015,"context_line":"                             lb-controller, nvidia-installe, runsv, statsite, erlexec)"},{"line_number":1016,"context_line":"      and not proc.cmdline in (known_shell_spawn_cmdlines)"},{"line_number":1017,"context_line":"      and not proc.aname in (unicorn_launche)"},{"line_number":1018,"context_line":"      and not consul_running_net_scripts"},{"line_number":1019,"context_line":"      and not consul_running_alert_checks"},{"line_number":1020,"context_line":"      and not nginx_starting_nginx"},{"line_number":1021,"context_line":"      and not nginx_running_aws_s3_cp"},{"line_number":1022,"context_line":"      and not run_by_package_mgmt_binaries"},{"line_number":1023,"context_line":"      and not serf_script"},{"line_number":1024,"context_line":"      and not check_process_status"},{"line_number":1025,"context_line":"      and not run_by_foreman"},{"line_number":1026,"context_line":"      and not python_mesos_marathon_scripting"},{"line_number":1027,"context_line":"      and not splunk_running_forwarder"},{"line_number":1028,"context_line":"      and not postgres_running_wal_e"},{"line_number":1029,"context_line":"      and not redis_running_prepost_scripts"},{"line_number":1030,"context_line":"      and not rabbitmq_running_scripts"},{"line_number":1031,"context_line":"      and not rabbitmqctl_running_scripts"},{"line_number":1032,"context_line":"      and not run_by_appdynamics"},{"line_number":1033,"context_line":"      and not user_shell_container_exclusions"},{"line_number":1034,"context_line":"    output: \u003e"},{"line_number":1035,"context_line":"      Shell spawned by untrusted binary (user\u003d%user.name shell\u003d%proc.name parent\u003d%proc.pname"},{"line_number":1036,"context_line":"      cmdline\u003d%proc.cmdline pcmdline\u003d%proc.pcmdline gparent\u003d%proc.aname[2] ggparent\u003d%proc.aname[3]"},{"line_number":1037,"context_line":"      aname[4]\u003d%proc.aname[4] aname[5]\u003d%proc.aname[5] aname[6]\u003d%proc.aname[6] aname[7]\u003d%proc.aname[7])"},{"line_number":1038,"context_line":"    priority: DEBUG"},{"line_number":1039,"context_line":"    tags: [shell]"},{"line_number":1040,"context_line":"  - macro: trusted_containers"},{"line_number":1041,"context_line":"    condition: (container.image startswith sysdig/agent or"},{"line_number":1042,"context_line":"                (container.image startswith sysdig/falco and"},{"line_number":1043,"context_line":"                 not container.image startswith sysdig/falco-event-generator) or"},{"line_number":1044,"context_line":"                container.image startswith quay.io/sysdig or"},{"line_number":1045,"context_line":"                container.image startswith sysdig/sysdig or"},{"line_number":1046,"context_line":"                container.image startswith gcr.io/google_containers/hyperkube or"},{"line_number":1047,"context_line":"                container.image startswith quay.io/coreos/flannel or"},{"line_number":1048,"context_line":"                container.image startswith gcr.io/google_containers/kube-proxy or"},{"line_number":1049,"context_line":"                container.image startswith calico/node or"},{"line_number":1050,"context_line":"                container.image startswith rook/toolbox or"},{"line_number":1051,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/logging-fluentd or"},{"line_number":1052,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/logging-elasticsearch or"},{"line_number":1053,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/metrics-cassandra or"},{"line_number":1054,"context_line":"                container.image startswith openshift3/ose-sti-builder or"},{"line_number":1055,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/ose-sti-builder or"},{"line_number":1056,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/ose-docker-builder or"},{"line_number":1057,"context_line":"                container.image startswith registry.access.redhat.com/openshift3/image-inspector or"},{"line_number":1058,"context_line":"                container.image startswith cloudnativelabs/kube-router or"},{"line_number":1059,"context_line":"                container.image startswith \"consul:\" or"},{"line_number":1060,"context_line":"                container.image startswith mesosphere/mesos-slave or"},{"line_number":1061,"context_line":"                container.image startswith istio/proxy_ or"},{"line_number":1062,"context_line":"                container.image startswith datadog/docker-dd-agent or"},{"line_number":1063,"context_line":"                container.image startswith datadog/agent or"},{"line_number":1064,"context_line":"                container.image startswith docker/ucp-agent or"},{"line_number":1065,"context_line":"                container.image startswith gliderlabs/logspout)"},{"line_number":1066,"context_line":"  - macro: user_trusted_containers"},{"line_number":1067,"context_line":"    condition: (container.image startswith sysdig/agent)"},{"line_number":1068,"context_line":"  - macro: user_sensitive_mount_containers"},{"line_number":1069,"context_line":"    condition: (container.image startswith sysdig/agent)"},{"line_number":1070,"context_line":"  - rule: Launch Privileged Container"},{"line_number":1071,"context_line":"    desc: Detect the initial process started in a privileged container. Exceptions are made for known trusted images."},{"line_number":1072,"context_line":"    condition: \u003e"},{"line_number":1073,"context_line":"      evt.type\u003dexecve and proc.vpid\u003d1 and container"},{"line_number":1074,"context_line":"      and container.privileged\u003dtrue"},{"line_number":1075,"context_line":"      and not trusted_containers"},{"line_number":1076,"context_line":"      and not user_trusted_containers"},{"line_number":1077,"context_line":"    output: Privileged container started (user\u003d%user.name command\u003d%proc.cmdline %container.info image\u003d%container.image)"},{"line_number":1078,"context_line":"    priority: INFO"},{"line_number":1079,"context_line":"    tags: [container, cis]"},{"line_number":1080,"context_line":"  - macro: sensitive_mount"},{"line_number":1081,"context_line":"    condition: (container.mount.dest[/proc*] !\u003d \"N/A\" or"},{"line_number":1082,"context_line":"                container.mount.dest[/var/run/docker.sock] !\u003d \"N/A\" or"},{"line_number":1083,"context_line":"                container.mount.dest[/] !\u003d \"N/A\" or"},{"line_number":1084,"context_line":"                container.mount.dest[/etc] !\u003d \"N/A\" or"},{"line_number":1085,"context_line":"                container.mount.dest[/root*] !\u003d \"N/A\")"},{"line_number":1086,"context_line":"  - macro: container_entrypoint"},{"line_number":1087,"context_line":"    condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], docker-runc, exe))"},{"line_number":1088,"context_line":"  - rule: Launch Sensitive Mount Container"},{"line_number":1089,"context_line":"    desc: \u003e"},{"line_number":1090,"context_line":"      Detect the initial process started by a container that has a mount from a sensitive host directory"},{"line_number":1091,"context_line":"      (i.e. /proc). Exceptions are made for known trusted images."},{"line_number":1092,"context_line":"    condition: \u003e"},{"line_number":1093,"context_line":"      evt.type\u003dexecve and proc.vpid\u003d1 and container"},{"line_number":1094,"context_line":"      and sensitive_mount"},{"line_number":1095,"context_line":"      and not trusted_containers"},{"line_number":1096,"context_line":"      and not user_sensitive_mount_containers"},{"line_number":1097,"context_line":"    output: Container with sensitive mount started (user\u003d%user.name command\u003d%proc.cmdline %container.info image\u003d%container.image mounts\u003d%container.mounts)"},{"line_number":1098,"context_line":"    priority: INFO"},{"line_number":1099,"context_line":"    tags: [container, cis]"},{"line_number":1100,"context_line":"  - macro: allowed_containers"},{"line_number":1101,"context_line":"    condition: (proc.vpid\u003d1)"},{"line_number":1102,"context_line":"  - rule: Launch Disallowed Container"},{"line_number":1103,"context_line":"    desc: \u003e"},{"line_number":1104,"context_line":"      Detect the initial process started by a container that is not in a list of allowed containers."},{"line_number":1105,"context_line":"    condition: evt.type\u003dexecve and proc.vpid\u003d1 and container and not allowed_containers"},{"line_number":1106,"context_line":"    output: Container started and not in allowed list (user\u003d%user.name command\u003d%proc.cmdline %container.info image\u003d%container.image)"},{"line_number":1107,"context_line":"    priority: WARNING"},{"line_number":1108,"context_line":"    tags: [container]"},{"line_number":1109,"context_line":"  - rule: System user interactive"},{"line_number":1110,"context_line":"    desc: an attempt to run interactive commands by a system (i.e. non-login) user"},{"line_number":1111,"context_line":"    condition: spawned_process and system_users and interactive"},{"line_number":1112,"context_line":"    output: \"System user ran an interactive command (user\u003d%user.name command\u003d%proc.cmdline)\""},{"line_number":1113,"context_line":"    priority: INFO"},{"line_number":1114,"context_line":"    tags: [users]"},{"line_number":1115,"context_line":"  - rule: Terminal shell in container"},{"line_number":1116,"context_line":"    desc: A shell was used as the entrypoint/exec point into a container with an attached terminal."},{"line_number":1117,"context_line":"    condition: \u003e"},{"line_number":1118,"context_line":"      spawned_process and container"},{"line_number":1119,"context_line":"      and shell_procs and proc.tty !\u003d 0"},{"line_number":1120,"context_line":"      and container_entrypoint"},{"line_number":1121,"context_line":"    output: \u003e"},{"line_number":1122,"context_line":"      A shell was spawned in a container with an attached terminal (user\u003d%user.name %container.info"},{"line_number":1123,"context_line":"      shell\u003d%proc.name parent\u003d%proc.pname cmdline\u003d%proc.cmdline terminal\u003d%proc.tty)"},{"line_number":1124,"context_line":"    priority: NOTICE"},{"line_number":1125,"context_line":"    tags: [container, shell]"},{"line_number":1126,"context_line":"  - list: known_shell_spawn_cmdlines"},{"line_number":1127,"context_line":"    items: ["},{"line_number":1128,"context_line":"      \u0027\"sh -c uname -p 2\u003e /dev/null\"\u0027,"},{"line_number":1129,"context_line":"      \u0027\"sh -c uname -s 2\u003e\u00261\"\u0027,"},{"line_number":1130,"context_line":"      \u0027\"sh -c uname -r 2\u003e\u00261\"\u0027,"},{"line_number":1131,"context_line":"      \u0027\"sh -c uname -v 2\u003e\u00261\"\u0027,"},{"line_number":1132,"context_line":"      \u0027\"sh -c uname -a 2\u003e\u00261\"\u0027,"},{"line_number":1133,"context_line":"      \u0027\"sh -c ruby -v 2\u003e\u00261\"\u0027,"},{"line_number":1134,"context_line":"      \u0027\"sh -c getconf CLK_TCK\"\u0027,"},{"line_number":1135,"context_line":"      \u0027\"sh -c getconf PAGESIZE\"\u0027,"},{"line_number":1136,"context_line":"      \u0027\"sh -c LC_ALL\u003dC LANG\u003dC /sbin/ldconfig -p 2\u003e/dev/null\"\u0027,"},{"line_number":1137,"context_line":"      \u0027\"sh -c LANG\u003dC /sbin/ldconfig -p 2\u003e/dev/null\"\u0027,"},{"line_number":1138,"context_line":"      \u0027\"sh -c /sbin/ldconfig -p 2\u003e/dev/null\"\u0027,"},{"line_number":1139,"context_line":"      \u0027\"sh -c stty -a 2\u003e/dev/null\"\u0027,"},{"line_number":1140,"context_line":"      \u0027\"sh -c stty -a \u003c /dev/tty\"\u0027,"},{"line_number":1141,"context_line":"      \u0027\"sh -c stty -g \u003c /dev/tty\"\u0027,"},{"line_number":1142,"context_line":"      \u0027\"sh -c node index.js\"\u0027,"},{"line_number":1143,"context_line":"      \u0027\"sh -c node index\"\u0027,"},{"line_number":1144,"context_line":"      \u0027\"sh -c node ./src/start.js\"\u0027,"},{"line_number":1145,"context_line":"      \u0027\"sh -c node app.js\"\u0027,"},{"line_number":1146,"context_line":"      \u0027\"sh -c node -e \\\"require(\u0027\u0027nan\u0027\u0027)\\\"\"\u0027,"},{"line_number":1147,"context_line":"      \u0027\"sh -c node -e \\\"require(\u0027\u0027nan\u0027\u0027)\\\")\"\u0027,"},{"line_number":1148,"context_line":"      \u0027\"sh -c node $NODE_DEBUG_OPTION index.js \"\u0027,"},{"line_number":1149,"context_line":"      \u0027\"sh -c crontab -l 2\"\u0027,"},{"line_number":1150,"context_line":"      \u0027\"sh -c lsb_release -a\"\u0027,"},{"line_number":1151,"context_line":"      \u0027\"sh -c lsb_release -is 2\u003e/dev/null\"\u0027,"},{"line_number":1152,"context_line":"      \u0027\"sh -c whoami\"\u0027,"},{"line_number":1153,"context_line":"      \u0027\"sh -c node_modules/.bin/bower-installer\"\u0027,"},{"line_number":1154,"context_line":"      \u0027\"sh -c /bin/hostname -f 2\u003e /dev/null\"\u0027,"},{"line_number":1155,"context_line":"      \u0027\"sh -c locale -a\"\u0027,"},{"line_number":1156,"context_line":"      \u0027\"sh -c  -t -i\"\u0027,"},{"line_number":1157,"context_line":"      \u0027\"sh -c openssl version\"\u0027,"},{"line_number":1158,"context_line":"      \u0027\"bash -c id -Gn kafadmin\"\u0027,"},{"line_number":1159,"context_line":"      \u0027\"sh -c /bin/sh -c \u0027\u0027date +%%s\u0027\u0027\"\u0027"},{"line_number":1160,"context_line":"      ]"},{"line_number":1161,"context_line":"  - list: user_known_shell_spawn_binaries"},{"line_number":1162,"context_line":"    items: []"},{"line_number":1163,"context_line":"  - macro: user_shell_container_exclusions"},{"line_number":1164,"context_line":"    condition: (never_true)"},{"line_number":1165,"context_line":"  - macro: login_doing_dns_lookup"},{"line_number":1166,"context_line":"    condition: (proc.name\u003dlogin and fd.l4proto\u003dudp and fd.sport\u003d53)"},{"line_number":1167,"context_line":"  - rule: System procs network activity"},{"line_number":1168,"context_line":"    desc: any network activity performed by system binaries that are not expected to send or receive any network traffic"},{"line_number":1169,"context_line":"    condition: \u003e"},{"line_number":1170,"context_line":"      (fd.sockfamily \u003d ip and system_procs)"},{"line_number":1171,"context_line":"      and (inbound_outbound)"},{"line_number":1172,"context_line":"      and not proc.name in (systemd, hostid, id)"},{"line_number":1173,"context_line":"      and not login_doing_dns_lookup"},{"line_number":1174,"context_line":"    output: \u003e"},{"line_number":1175,"context_line":"      Known system binary sent/received network traffic"},{"line_number":1176,"context_line":"      (user\u003d%user.name command\u003d%proc.cmdline connection\u003d%fd.name)"},{"line_number":1177,"context_line":"    priority: NOTICE"},{"line_number":1178,"context_line":"    tags: [network]"},{"line_number":1179,"context_line":"  - list: openvpn_udp_ports"},{"line_number":1180,"context_line":"    items: [1194, 1197, 1198, 8080, 9201]"},{"line_number":1181,"context_line":"  - list: l2tp_udp_ports"},{"line_number":1182,"context_line":"    items: [500, 1701, 4500, 10000]"},{"line_number":1183,"context_line":"  - list: statsd_ports"},{"line_number":1184,"context_line":"    items: [8125]"},{"line_number":1185,"context_line":"  - list: ntp_ports"},{"line_number":1186,"context_line":"    items: [123]"},{"line_number":1187,"context_line":"  - list: test_connect_ports"},{"line_number":1188,"context_line":"    items: [0, 9, 80, 3306]"},{"line_number":1189,"context_line":"  - macro: do_unexpected_udp_check"},{"line_number":1190,"context_line":"    condition: (never_true)"},{"line_number":1191,"context_line":"  - list: expected_udp_ports"},{"line_number":1192,"context_line":"    items: [53, openvpn_udp_ports, l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports]"},{"line_number":1193,"context_line":"  - macro: expected_udp_traffic"},{"line_number":1194,"context_line":"    condition: fd.port in (expected_udp_ports)"},{"line_number":1195,"context_line":"  - rule: Unexpected UDP Traffic"},{"line_number":1196,"context_line":"    desc: UDP traffic not on port 53 (DNS) or other commonly used ports"},{"line_number":1197,"context_line":"    condition: (inbound_outbound) and do_unexpected_udp_check and fd.l4proto\u003dudp and not expected_udp_traffic"},{"line_number":1198,"context_line":"    output: \u003e"},{"line_number":1199,"context_line":"      Unexpected UDP Traffic Seen"},{"line_number":1200,"context_line":"      (user\u003d%user.name command\u003d%proc.cmdline connection\u003d%fd.name proto\u003d%fd.l4proto evt\u003d%evt.type %evt.args)"},{"line_number":1201,"context_line":"    priority: NOTICE"},{"line_number":1202,"context_line":"    tags: [network]"},{"line_number":1203,"context_line":"  - macro: somebody_becoming_themself"},{"line_number":1204,"context_line":"    condition: ((user.name\u003dnobody and evt.arg.uid\u003dnobody) or"},{"line_number":1205,"context_line":"                (user.name\u003dwww-data and evt.arg.uid\u003dwww-data) or"},{"line_number":1206,"context_line":"                (user.name\u003d_apt and evt.arg.uid\u003d_apt) or"},{"line_number":1207,"context_line":"                (user.name\u003dpostfix and evt.arg.uid\u003dpostfix) or"},{"line_number":1208,"context_line":"                (user.name\u003dpki-agent and evt.arg.uid\u003dpki-agent) or"},{"line_number":1209,"context_line":"                (user.name\u003dpki-acme and evt.arg.uid\u003dpki-acme) or"},{"line_number":1210,"context_line":"                (user.name\u003dnfsnobody and evt.arg.uid\u003dnfsnobody) or"},{"line_number":1211,"context_line":"                (user.name\u003dpostgres and evt.arg.uid\u003dpostgres))"},{"line_number":1212,"context_line":"  - macro: nrpe_becoming_nagios"},{"line_number":1213,"context_line":"    condition: (proc.name\u003dnrpe and evt.arg.uid\u003dnagios)"},{"line_number":1214,"context_line":"  - macro: known_user_in_container"},{"line_number":1215,"context_line":"    condition: (container and user.name !\u003d \"N/A\")"},{"line_number":1216,"context_line":"  - rule: Non sudo setuid"},{"line_number":1217,"context_line":"    desc: \u003e"},{"line_number":1218,"context_line":"      an attempt to change users by calling setuid. sudo/su are excluded. users \"root\" and \"nobody\""},{"line_number":1219,"context_line":"      suing to itself are also excluded, as setuid calls typically involve dropping privileges."},{"line_number":1220,"context_line":"    condition: \u003e"},{"line_number":1221,"context_line":"      evt.type\u003dsetuid and evt.dir\u003d\u003e"},{"line_number":1222,"context_line":"      and (known_user_in_container or not container)"},{"line_number":1223,"context_line":"      and not user.name\u003droot and not somebody_becoming_themself"},{"line_number":1224,"context_line":"      and not proc.name in (known_setuid_binaries, userexec_binaries, mail_binaries, docker_binaries,"},{"line_number":1225,"context_line":"                            nomachine_binaries)"},{"line_number":1226,"context_line":"      and not java_running_sdjagent"},{"line_number":1227,"context_line":"      and not nrpe_becoming_nagios"},{"line_number":1228,"context_line":"    output: \u003e"},{"line_number":1229,"context_line":"      Unexpected setuid call by non-sudo, non-root program (user\u003d%user.name cur_uid\u003d%user.uid parent\u003d%proc.pname"},{"line_number":1230,"context_line":"      command\u003d%proc.cmdline uid\u003d%evt.arg.uid)"},{"line_number":1231,"context_line":"    priority: NOTICE"},{"line_number":1232,"context_line":"    tags: [users]"},{"line_number":1233,"context_line":"  - rule: User mgmt binaries"},{"line_number":1234,"context_line":"    desc: \u003e"},{"line_number":1235,"context_line":"      activity by any programs that can manage users, passwords, or permissions. sudo and su are excluded."},{"line_number":1236,"context_line":"      Activity in containers is also excluded--some containers create custom users on top"},{"line_number":1237,"context_line":"      of a base linux distribution at startup."},{"line_number":1238,"context_line":"      Some innocuous commandlines that don\u0027t actually change anything are excluded."},{"line_number":1239,"context_line":"    condition: \u003e"},{"line_number":1240,"context_line":"      spawned_process and proc.name in (user_mgmt_binaries) and"},{"line_number":1241,"context_line":"      not proc.name in (su, sudo, lastlog, nologin, unix_chkpwd) and not container and"},{"line_number":1242,"context_line":"      not proc.pname in (cron_binaries, systemd, systemd.postins, udev.postinst, run-parts) and"},{"line_number":1243,"context_line":"      not proc.cmdline startswith \"passwd -S\" and"},{"line_number":1244,"context_line":"      not proc.cmdline startswith \"useradd -D\" and"},{"line_number":1245,"context_line":"      not proc.cmdline startswith \"systemd --version\" and"},{"line_number":1246,"context_line":"      not run_by_qualys and"},{"line_number":1247,"context_line":"      not run_by_sumologic_securefiles and"},{"line_number":1248,"context_line":"      not run_by_yum and"},{"line_number":1249,"context_line":"      not run_by_ms_oms and"},{"line_number":1250,"context_line":"      not run_by_google_accounts_daemon"},{"line_number":1251,"context_line":"    output: \u003e"},{"line_number":1252,"context_line":"      User management binary command run outside of container"},{"line_number":1253,"context_line":"      (user\u003d%user.name command\u003d%proc.cmdline parent\u003d%proc.pname gparent\u003d%proc.aname[2] ggparent\u003d%proc.aname[3] gggparent\u003d%proc.aname[4])"},{"line_number":1254,"context_line":"    priority: NOTICE"},{"line_number":1255,"context_line":"    tags: [host, users]"},{"line_number":1256,"context_line":"  - list: allowed_dev_files"},{"line_number":1257,"context_line":"    items: ["},{"line_number":1258,"context_line":"      /dev/null, /dev/stdin, /dev/stdout, /dev/stderr,"},{"line_number":1259,"context_line":"      /dev/random, /dev/urandom, /dev/console, /dev/kmsg"},{"line_number":1260,"context_line":"      ]"},{"line_number":1261,"context_line":"  - rule: Create files below dev"},{"line_number":1262,"context_line":"    desc: creating any files below /dev other than known programs that manage devices. Some rootkits hide files in /dev."},{"line_number":1263,"context_line":"    condition: \u003e"},{"line_number":1264,"context_line":"      fd.directory \u003d /dev and"},{"line_number":1265,"context_line":"      (evt.type \u003d creat or (evt.type \u003d open and evt.arg.flags contains O_CREAT))"},{"line_number":1266,"context_line":"      and not proc.name in (dev_creation_binaries)"},{"line_number":1267,"context_line":"      and not fd.name in (allowed_dev_files)"},{"line_number":1268,"context_line":"      and not fd.name startswith /dev/tty"},{"line_number":1269,"context_line":"    output: \"File created below /dev by untrusted program (user\u003d%user.name command\u003d%proc.cmdline file\u003d%fd.name)\""},{"line_number":1270,"context_line":"    priority: ERROR"},{"line_number":1271,"context_line":"    tags: [filesystem]"},{"line_number":1272,"context_line":"  - macro: ec2_metadata_containers"},{"line_number":1273,"context_line":"    condition: container"},{"line_number":1274,"context_line":"  - rule: Contact EC2 Instance Metadata Service From Container"},{"line_number":1275,"context_line":"    desc: Detect attempts to contact the EC2 Instance Metadata Service from a container"},{"line_number":1276,"context_line":"    condition: outbound and fd.sip\u003d\"169.254.169.254\" and container and not ec2_metadata_containers"},{"line_number":1277,"context_line":"    output: Outbound connection to EC2 instance metadata service (command\u003d%proc.cmdline connection\u003d%fd.name %container.info image\u003d%container.image)"},{"line_number":1278,"context_line":"    priority: NOTICE"},{"line_number":1279,"context_line":"    tags: [network, aws, container]"},{"line_number":1280,"context_line":"  - macro: k8s_api_server"},{"line_number":1281,"context_line":"    condition: (fd.sip\u003d\"1.2.3.4\" and fd.sport\u003d8080)"},{"line_number":1282,"context_line":"  - macro: k8s_containers"},{"line_number":1283,"context_line":"    condition: \u003e"},{"line_number":1284,"context_line":"      (container.image startswith gcr.io/google_containers/hyperkube-amd64 or"},{"line_number":1285,"context_line":"       container.image startswith gcr.io/google_containers/kube2sky or"},{"line_number":1286,"context_line":"       container.image startswith sysdig/agent or"},{"line_number":1287,"context_line":"       container.image startswith sysdig/falco or"},{"line_number":1288,"context_line":"       container.image startswith sysdig/sysdig)"},{"line_number":1289,"context_line":"  - rule: Contact K8S API Server From Container"},{"line_number":1290,"context_line":"    desc: Detect attempts to contact the K8S API Server from a container"},{"line_number":1291,"context_line":"    condition: outbound and k8s_api_server and container and not k8s_containers"},{"line_number":1292,"context_line":"    output: Unexpected connection to K8s API Server from container (command\u003d%proc.cmdline %container.info image\u003d%container.image connection\u003d%fd.name)"},{"line_number":1293,"context_line":"    priority: NOTICE"},{"line_number":1294,"context_line":"    tags: [network, k8s, container]"},{"line_number":1295,"context_line":"  - macro: nodeport_containers"},{"line_number":1296,"context_line":"    condition: container"},{"line_number":1297,"context_line":"  - rule: Unexpected K8s NodePort Connection"},{"line_number":1298,"context_line":"    desc: Detect attempts to use K8s NodePorts from a container"},{"line_number":1299,"context_line":"    condition: (inbound_outbound) and fd.sport \u003e\u003d 30000 and fd.sport \u003c\u003d 32767 and container and not nodeport_containers"},{"line_number":1300,"context_line":"    output: Unexpected K8s NodePort Connection (command\u003d%proc.cmdline connection\u003d%fd.name)"},{"line_number":1301,"context_line":"    priority: NOTICE"},{"line_number":1302,"context_line":"    tags: [network, k8s, container]"},{"line_number":1303,"context_line":""},{"line_number":1304,"context_line":"falco_rules_local: |"},{"line_number":1305,"context_line":"####################"},{"line_number":1306,"context_line":"# Your custom rules!"},{"line_number":1307,"context_line":"####################"},{"line_number":1308,"context_line":""},{"line_number":1309,"context_line":"# Add new rules, like this one"},{"line_number":1310,"context_line":"# - rule: The program \"sudo\" is run in a container"},{"line_number":1311,"context_line":"#   desc: An event will trigger every time you run sudo in a container"},{"line_number":1312,"context_line":"#   condition: evt.type \u003d execve and evt.dir\u003d\u003c and container.id !\u003d host and proc.name \u003d sudo"},{"line_number":1313,"context_line":"#   output: \"Sudo run in container (user\u003d%user.name %container.info parent\u003d%proc.pname cmdline\u003d%proc.cmdline)\""},{"line_number":1314,"context_line":"#   priority: ERROR"},{"line_number":1315,"context_line":"#   tags: [users, container]"},{"line_number":1316,"context_line":""},{"line_number":1317,"context_line":"# Or override/append to any rule, macro, or list from the Default Rules"},{"line_number":1318,"context_line":"customRules: {}"},{"line_number":1319,"context_line":"  # Although Falco comes with a nice default rule set for detecting weird"},{"line_number":1320,"context_line":"  # behavior in containers, our users are going to customize the run-time"},{"line_number":1321,"context_line":"  # security rule sets or policies for the specific container images and"},{"line_number":1322,"context_line":"  # applications they run. This feature can be handled in this section."},{"line_number":1323,"context_line":"  #"},{"line_number":1324,"context_line":"  # Example:"},{"line_number":1325,"context_line":"  #"},{"line_number":1326,"context_line":"  # rules-traefik.yaml: |-"},{"line_number":1327,"context_line":"  #   [ rule body ]"},{"line_number":1328,"context_line":""},{"line_number":1329,"context_line":"# Allow falco to run on Kubernetes 1.6 masters."},{"line_number":1330,"context_line":"tolerations:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_a983b755","line":1327,"range":{"start_line":42,"start_character":0,"end_line":1327,"end_character":19},"in_reply_to":"3f79a3b5_4399a96a","updated":"2018-09-05 20:35:45.000000000","message":"Done","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"3c85bed88821d3a6c8f87661e870a66e5b865027","unresolved":false,"context_lines":[{"line_number":1348,"context_line":"        - endpoint: internal"},{"line_number":1349,"context_line":"          service: local_image_registry"},{"line_number":1350,"context_line":""},{"line_number":1351,"context_line":"manifests:"},{"line_number":1352,"context_line":"  falco: true"},{"line_number":1353,"context_line":"  configmap: true"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_63b705da","line":1353,"range":{"start_line":1351,"start_character":0,"end_line":1353,"end_character":17},"updated":"2018-09-05 15:15:28.000000000","message":"this should include all the templates within the chart.","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"d6de112dda745c88c8b730231f5bacb0aa5fa068","unresolved":false,"context_lines":[{"line_number":1348,"context_line":"        - endpoint: internal"},{"line_number":1349,"context_line":"          service: local_image_registry"},{"line_number":1350,"context_line":""},{"line_number":1351,"context_line":"manifests:"},{"line_number":1352,"context_line":"  falco: true"},{"line_number":1353,"context_line":"  configmap: true"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_c9887372","line":1353,"range":{"start_line":1351,"start_character":0,"end_line":1353,"end_character":17},"in_reply_to":"3f79a3b5_63b705da","updated":"2018-09-05 20:35:45.000000000","message":"Done","commit_id":"e88e531ca8466de8471205eaa3a547aeb69b1f11"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  pull_policy: IfNotPresent"},{"line_number":17,"context_line":"  tags:"},{"line_number":18,"context_line":"    dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1"},{"line_number":19,"context_line":"    falco_img: sysdig/falco:latest"},{"line_number":20,"context_line":"    image_repo_sync: docker.io/docker:17.07.0"},{"line_number":21,"context_line":"  local_registry:"},{"line_number":22,"context_line":"    active: false"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_179b4b73","line":19,"range":{"start_line":19,"start_character":28,"end_line":19,"end_character":34},"updated":"2018-09-26 13:42:58.000000000","message":"This needs to be a reliable tag, not latest","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  pull_policy: IfNotPresent"},{"line_number":17,"context_line":"  tags:"},{"line_number":18,"context_line":"    dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1"},{"line_number":19,"context_line":"    falco_img: sysdig/falco:latest"},{"line_number":20,"context_line":"    image_repo_sync: docker.io/docker:17.07.0"},{"line_number":21,"context_line":"  local_registry:"},{"line_number":22,"context_line":"    active: false"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_77c71f67","line":19,"range":{"start_line":19,"start_character":4,"end_line":19,"end_character":13},"updated":"2018-09-26 13:42:58.000000000","message":"falco","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  pull_policy: IfNotPresent"},{"line_number":17,"context_line":"  tags:"},{"line_number":18,"context_line":"    dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1"},{"line_number":19,"context_line":"    falco_img: sysdig/falco:latest"},{"line_number":20,"context_line":"    image_repo_sync: docker.io/docker:17.07.0"},{"line_number":21,"context_line":"  local_registry:"},{"line_number":22,"context_line":"    active: false"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_4dcdb65c","line":19,"range":{"start_line":19,"start_character":28,"end_line":19,"end_character":34},"in_reply_to":"3f79a3b5_179b4b73","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  pull_policy: IfNotPresent"},{"line_number":17,"context_line":"  tags:"},{"line_number":18,"context_line":"    dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1"},{"line_number":19,"context_line":"    falco_img: sysdig/falco:latest"},{"line_number":20,"context_line":"    image_repo_sync: docker.io/docker:17.07.0"},{"line_number":21,"context_line":"  local_registry:"},{"line_number":22,"context_line":"    active: false"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_6dc8b24c","line":19,"range":{"start_line":19,"start_character":4,"end_line":19,"end_character":13},"in_reply_to":"3f79a3b5_77c71f67","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"pod:"},{"line_number":29,"context_line":"  resources:"},{"line_number":30,"context_line":"    enabled: false"},{"line_number":31,"context_line":"    falco:"},{"line_number":32,"context_line":"      requests:"},{"line_number":33,"context_line":"        memory: \"128Mi\""},{"line_number":34,"context_line":"        cpu: \"20m\""},{"line_number":35,"context_line":"      limits:"},{"line_number":36,"context_line":"        memory: \"128Mi\""},{"line_number":37,"context_line":"        cpu: \"30m\""},{"line_number":38,"context_line":"  lifecycle:"},{"line_number":39,"context_line":"    upgrades:"},{"line_number":40,"context_line":"      daemonsets:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_b7837703","line":37,"range":{"start_line":29,"start_character":0,"end_line":37,"end_character":18},"updated":"2018-09-26 13:42:58.000000000","message":"This will need an entry for the image repo sync job","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"pod:"},{"line_number":29,"context_line":"  resources:"},{"line_number":30,"context_line":"    enabled: false"},{"line_number":31,"context_line":"    falco:"},{"line_number":32,"context_line":"      requests:"},{"line_number":33,"context_line":"        memory: \"128Mi\""},{"line_number":34,"context_line":"        cpu: \"20m\""},{"line_number":35,"context_line":"      limits:"},{"line_number":36,"context_line":"        memory: \"128Mi\""},{"line_number":37,"context_line":"        cpu: \"30m\""},{"line_number":38,"context_line":"  lifecycle:"},{"line_number":39,"context_line":"    upgrades:"},{"line_number":40,"context_line":"      daemonsets:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_28faa8b9","line":37,"range":{"start_line":29,"start_character":0,"end_line":37,"end_character":18},"in_reply_to":"3f79a3b5_b7837703","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  config:"},{"line_number":49,"context_line":"    # The location of the rules file(s). This can contain one or more paths to"},{"line_number":50,"context_line":"    # separate rules files."},{"line_number":51,"context_line":"    rules_file:"},{"line_number":52,"context_line":"      - /etc/falco/falco_rules.yaml"},{"line_number":53,"context_line":"      - /etc/falco/falco_rules.local.yaml"},{"line_number":54,"context_line":"      - /etc/falco/rules.d"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    # Whether to output events in json or text"},{"line_number":57,"context_line":"    json_output: false"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_7775df32","line":54,"range":{"start_line":51,"start_character":0,"end_line":54,"end_character":26},"updated":"2018-09-26 13:42:58.000000000","message":"can we handle this like Prometheus? https://github.com/openstack/openstack-helm-infra/blob/master/prometheus/templates/configmap-etc.yaml#L20-L29","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  config:"},{"line_number":49,"context_line":"    # The location of the rules file(s). This can contain one or more paths to"},{"line_number":50,"context_line":"    # separate rules files."},{"line_number":51,"context_line":"    rules_file:"},{"line_number":52,"context_line":"      - /etc/falco/falco_rules.yaml"},{"line_number":53,"context_line":"      - /etc/falco/falco_rules.local.yaml"},{"line_number":54,"context_line":"      - /etc/falco/rules.d"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    # Whether to output events in json or text"},{"line_number":57,"context_line":"    json_output: false"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_57453c6e","line":54,"range":{"start_line":51,"start_character":0,"end_line":54,"end_character":26},"in_reply_to":"3f79a3b5_7775df32","updated":"2018-09-26 20:40:43.000000000","message":"As discussed, we will do this as follow on.","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":1333,"context_line":"    #   [ rule body ]"},{"line_number":1334,"context_line":""},{"line_number":1335,"context_line":"# Allow falco to run on Kubernetes 1.6 masters."},{"line_number":1336,"context_line":"tolerations:"},{"line_number":1337,"context_line":"  - effect: NoSchedule"},{"line_number":1338,"context_line":"    key: node-role.kubernetes.io/master"},{"line_number":1339,"context_line":""},{"line_number":1340,"context_line":"dependencies:"},{"line_number":1341,"context_line":"  dynamic:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_376f6761","line":1338,"range":{"start_line":1336,"start_character":0,"end_line":1338,"end_character":39},"updated":"2018-09-26 13:42:58.000000000","message":"Should be moved under the pod: top level key","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":1333,"context_line":"    #   [ rule body ]"},{"line_number":1334,"context_line":""},{"line_number":1335,"context_line":"# Allow falco to run on Kubernetes 1.6 masters."},{"line_number":1336,"context_line":"tolerations:"},{"line_number":1337,"context_line":"  - effect: NoSchedule"},{"line_number":1338,"context_line":"    key: node-role.kubernetes.io/master"},{"line_number":1339,"context_line":""},{"line_number":1340,"context_line":"dependencies:"},{"line_number":1341,"context_line":"  dynamic:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_4d693624","line":1338,"range":{"start_line":1336,"start_character":0,"end_line":1338,"end_character":39},"in_reply_to":"3f79a3b5_376f6761","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":1355,"context_line":"          service: local_image_registry"},{"line_number":1356,"context_line":""},{"line_number":1357,"context_line":"manifests:"},{"line_number":1358,"context_line":"  deployment_falco: true"},{"line_number":1359,"context_line":"  configmap: true"},{"line_number":1360,"context_line":"  custom_rules: false"},{"line_number":1361,"context_line":"  configmap_bin: true"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_d78b9314","line":1358,"range":{"start_line":1358,"start_character":2,"end_line":1358,"end_character":18},"updated":"2018-09-26 13:42:58.000000000","message":"daemonset","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":1355,"context_line":"          service: local_image_registry"},{"line_number":1356,"context_line":""},{"line_number":1357,"context_line":"manifests:"},{"line_number":1358,"context_line":"  deployment_falco: true"},{"line_number":1359,"context_line":"  configmap: true"},{"line_number":1360,"context_line":"  custom_rules: false"},{"line_number":1361,"context_line":"  configmap_bin: true"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_0d733e18","line":1358,"range":{"start_line":1358,"start_character":2,"end_line":1358,"end_character":18},"in_reply_to":"3f79a3b5_d78b9314","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":1356,"context_line":""},{"line_number":1357,"context_line":"manifests:"},{"line_number":1358,"context_line":"  deployment_falco: true"},{"line_number":1359,"context_line":"  configmap: true"},{"line_number":1360,"context_line":"  custom_rules: false"},{"line_number":1361,"context_line":"  configmap_bin: true"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_579f8350","line":1359,"range":{"start_line":1359,"start_character":2,"end_line":1359,"end_character":11},"updated":"2018-09-26 13:42:58.000000000","message":"configmap_etc","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":1356,"context_line":""},{"line_number":1357,"context_line":"manifests:"},{"line_number":1358,"context_line":"  deployment_falco: true"},{"line_number":1359,"context_line":"  configmap: true"},{"line_number":1360,"context_line":"  custom_rules: false"},{"line_number":1361,"context_line":"  configmap_bin: true"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_cd5ea678","line":1359,"range":{"start_line":1359,"start_character":2,"end_line":1359,"end_character":11},"in_reply_to":"3f79a3b5_579f8350","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":1357,"context_line":"manifests:"},{"line_number":1358,"context_line":"  deployment_falco: true"},{"line_number":1359,"context_line":"  configmap: true"},{"line_number":1360,"context_line":"  custom_rules: false"},{"line_number":1361,"context_line":"  configmap_bin: true"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_779abf60","line":1360,"range":{"start_line":1360,"start_character":2,"end_line":1360,"end_character":14},"updated":"2018-09-26 13:42:58.000000000","message":"configmap_custom_rules","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":1357,"context_line":"manifests:"},{"line_number":1358,"context_line":"  deployment_falco: true"},{"line_number":1359,"context_line":"  configmap: true"},{"line_number":1360,"context_line":"  custom_rules: false"},{"line_number":1361,"context_line":"  configmap_bin: true"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_ed61223a","line":1360,"range":{"start_line":1360,"start_character":2,"end_line":1360,"end_character":14},"in_reply_to":"3f79a3b5_779abf60","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"035cf888c7d91f0a3fdab3b34c1b04199dfcf2a5","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  pull_policy: IfNotPresent"},{"line_number":17,"context_line":"  tags:"},{"line_number":18,"context_line":"    dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1"},{"line_number":19,"context_line":"    falco: sysdig/falco:0.12.1"},{"line_number":20,"context_line":"    image_repo_sync: docker.io/docker:17.07.0"},{"line_number":21,"context_line":"  local_registry:"},{"line_number":22,"context_line":"    active: false"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_7a792df9","line":19,"range":{"start_line":19,"start_character":11,"end_line":19,"end_character":30},"updated":"2018-09-27 12:51:48.000000000","message":"Sorry I missed this too. Can we prefix this with the appropriate registry? (quay.io or docker.io, assume)","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"8ff29fc7fadf521afc1ea767fce761984a1f0eb2","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  pull_policy: IfNotPresent"},{"line_number":17,"context_line":"  tags:"},{"line_number":18,"context_line":"    dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1"},{"line_number":19,"context_line":"    falco: sysdig/falco:0.12.1"},{"line_number":20,"context_line":"    image_repo_sync: docker.io/docker:17.07.0"},{"line_number":21,"context_line":"  local_registry:"},{"line_number":22,"context_line":"    active: false"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_0ae788e5","line":19,"range":{"start_line":19,"start_character":11,"end_line":19,"end_character":30},"in_reply_to":"3f79a3b5_7a792df9","updated":"2018-09-27 16:33:02.000000000","message":"Done","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"},{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"035cf888c7d91f0a3fdab3b34c1b04199dfcf2a5","unresolved":false,"context_lines":[{"line_number":1351,"context_line":"    common:"},{"line_number":1352,"context_line":"      local_image_registry:"},{"line_number":1353,"context_line":"        jobs:"},{"line_number":1354,"context_line":"          - k8sksauth-image-repo-sync"},{"line_number":1355,"context_line":"        services:"},{"line_number":1356,"context_line":"          - endpoint: node"},{"line_number":1357,"context_line":"            service: local_image_registry"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f79a3b5_5a5f9174","line":1354,"range":{"start_line":1354,"start_character":12,"end_line":1354,"end_character":21},"updated":"2018-09-27 12:51:48.000000000","message":"this should be falco-image-repo-sync","commit_id":"676dde9bd4b78f740b2d05ba4a5e23fcb0f206d1"}],"playbooks/osh-infra-dev-deploy-ceph.yaml":[{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        chdir: \"{{ zuul.project.src_dir }}\""},{"line_number":31,"context_line":"      environment:"},{"line_number":32,"context_line":"        zuul_site_mirror_fqdn: \"{{ zuul_site_mirror_fqdn }}\""},{"line_number":33,"context_line":"    - name: Deploy Falco"},{"line_number":34,"context_line":"      shell: |"},{"line_number":35,"context_line":"        set -xe;"},{"line_number":36,"context_line":"        ./tools/deployment/developer/ceph/025-falco.sh"},{"line_number":37,"context_line":"      args:"},{"line_number":38,"context_line":"        chdir: \"{{ zuul.project.src_dir }}\""},{"line_number":39,"context_line":"    - name: Deploy Registry NFS, Redis, and Docker Registry"},{"line_number":40,"context_line":"      shell: |"},{"line_number":41,"context_line":"        set -xe;"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_d7b4f3d6","line":38,"range":{"start_line":33,"start_character":0,"end_line":38,"end_character":43},"updated":"2018-09-26 13:42:58.000000000","message":"Let\u0027s remove this from the dev-deploy gates, as they\u0027re hitting the limits of what we can support currently","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        chdir: \"{{ zuul.project.src_dir }}\""},{"line_number":31,"context_line":"      environment:"},{"line_number":32,"context_line":"        zuul_site_mirror_fqdn: \"{{ zuul_site_mirror_fqdn }}\""},{"line_number":33,"context_line":"    - name: Deploy Falco"},{"line_number":34,"context_line":"      shell: |"},{"line_number":35,"context_line":"        set -xe;"},{"line_number":36,"context_line":"        ./tools/deployment/developer/ceph/025-falco.sh"},{"line_number":37,"context_line":"      args:"},{"line_number":38,"context_line":"        chdir: \"{{ zuul.project.src_dir }}\""},{"line_number":39,"context_line":"    - name: Deploy Registry NFS, Redis, and Docker Registry"},{"line_number":40,"context_line":"      shell: |"},{"line_number":41,"context_line":"        set -xe;"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3f79a3b5_b7bb700d","line":38,"range":{"start_line":33,"start_character":0,"end_line":38,"end_character":43},"in_reply_to":"3f79a3b5_d7b4f3d6","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"}],"tools/deployment/developer/common/025-falco.sh":[{"author":{"_account_id":17591,"name":"Steve Wilkerson","email":"wilkers.steve@gmail.com","username":"srwilkers"},"change_message_id":"6f119fc73df765519b3cf127057d437b3675325e","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"# Copyright 2017 The Openstack-Helm Authors."},{"line_number":4,"context_line":"#"},{"line_number":5,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":6,"context_line":"#    not use this file except in compliance with the License. You may obtain"},{"line_number":7,"context_line":"#    a copy of the License at"},{"line_number":8,"context_line":"#"},{"line_number":9,"context_line":"#         http://www.apache.org/licenses/LICENSE-2.0"},{"line_number":10,"context_line":"#"},{"line_number":11,"context_line":"#    Unless required by applicable law or agreed to in writing, software"},{"line_number":12,"context_line":"#    distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT"},{"line_number":13,"context_line":"#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the"},{"line_number":14,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":15,"context_line":"#    under the License."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"set -xe"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"#NOTE: Lint and package chart"},{"line_number":20,"context_line":"make falco"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"#NOTE: Deploy command"},{"line_number":23,"context_line":"helm upgrade --install falco ./falco \\"},{"line_number":24,"context_line":"    --namespace\u003dkube-system"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"#NOTE: Wait for deploy"},{"line_number":27,"context_line":"./tools/deployment/common/wait-for-pods.sh kube-system"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"#NOTE: Validate Deployment info"},{"line_number":30,"context_line":"helm status falco"}],"source_content_type":"text/x-sh","patch_set":8,"id":"3f79a3b5_b7b137e3","line":30,"range":{"start_line":1,"start_character":0,"end_line":30,"end_character":17},"updated":"2018-09-26 13:42:58.000000000","message":"Lets remove this from the developer gates.","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"354f349457d70e29a58849701981c1e423a5d10a","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"# Copyright 2017 The Openstack-Helm Authors."},{"line_number":4,"context_line":"#"},{"line_number":5,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":6,"context_line":"#    not use this file except in compliance with the License. You may obtain"},{"line_number":7,"context_line":"#    a copy of the License at"},{"line_number":8,"context_line":"#"},{"line_number":9,"context_line":"#         http://www.apache.org/licenses/LICENSE-2.0"},{"line_number":10,"context_line":"#"},{"line_number":11,"context_line":"#    Unless required by applicable law or agreed to in writing, software"},{"line_number":12,"context_line":"#    distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT"},{"line_number":13,"context_line":"#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the"},{"line_number":14,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":15,"context_line":"#    under the License."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"set -xe"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"#NOTE: Lint and package chart"},{"line_number":20,"context_line":"make falco"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"#NOTE: Deploy command"},{"line_number":23,"context_line":"helm upgrade --install falco ./falco \\"},{"line_number":24,"context_line":"    --namespace\u003dkube-system"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"#NOTE: Wait for deploy"},{"line_number":27,"context_line":"./tools/deployment/common/wait-for-pods.sh kube-system"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"#NOTE: Validate Deployment info"},{"line_number":30,"context_line":"helm status falco"}],"source_content_type":"text/x-sh","patch_set":8,"id":"3f79a3b5_17c3443b","line":30,"range":{"start_line":1,"start_character":0,"end_line":30,"end_character":17},"in_reply_to":"3f79a3b5_b7b137e3","updated":"2018-09-26 20:40:43.000000000","message":"Done","commit_id":"17747d4fbbdfefa5170c4c3d52285d09d91044bf"}]}