Skip to content

Commit

Permalink
update(rules/sandbox): fix misleading name
Browse files Browse the repository at this point in the history
Signed-off-by: Luca Guerra <luca@guerra.sh>
  • Loading branch information
LucaGuerra authored and poiana committed Sep 20, 2023
1 parent d0b17a2 commit 6d3fcf0
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rules/falco-sandbox_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -1514,7 +1514,7 @@
- macro: user_known_k8s_client_container_parens
condition: (user_known_k8s_client_container)

- rule: The docker client is executed in a container
- rule: Kubernetes Client Tool Launched in Container
desc: >
Detect the execution of a Kubernetes client tool (like docker, kubectl, crictl) within a container, which is typically not expected behavior.
Although this rule targets container workloads, monitoring the use of tools like crictl on the host over interactive access could also be
Expand Down

0 comments on commit 6d3fcf0

Please sign in to comment.