Practical Cloud Native Security with Falco by Loris Degioanni and Leonardo Grasso

Author:Loris Degioanni and Leonardo Grasso
Language: eng
Format: epub
Publisher: O'Reilly Media, Inc.
Published: 2022-08-17T00:00:00+00:00

For example, suppose we extended the rule condition in our example by appending to it like this:

- rule: Text Editor Run by Root condition: or user.name = loris append: true

The full rule condition would become:

condition: editor_started and user.name=root or user.name = loris

This condition is clearly ambiguous. Will the rule trigger only whenever the user root or loris opens a text editor? Or will it trigger when root opens a text editor and when loris executes any command? To avoid such ambiguities, and to make your rules files more readable, you can use parentheses in the original conditions.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.