You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: website/docs/r/sysdig_secure_rule_falco.md
+45-11Lines changed: 45 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,16 +16,42 @@ Creates a Sysdig Secure Falco Rule.
16
16
17
17
```hcl
18
18
resource "sysdig_secure_rule_falco" "example" {
19
-
name = "Terminal shell in container" // ID
19
+
name = "Terminal shell in container" // ID
20
20
description = "A shell was used as the entrypoint/exec point into a container with an attached terminal."
21
-
tags = ["container", "shell", "mitre_execution"]
21
+
tags = ["container", "shell", "mitre_execution"]
22
22
23
23
condition = "spawned_process and container and shell_procs and proc.tty != 0 and container_entrypoint"
24
-
output = "A shell was spawned in a container with an attached terminal (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository)"
25
-
priority = "notice"
26
-
source = "syscall" // syscall or k8s_audit
24
+
output = "A shell was spawned in a container with an attached terminal (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository)"
25
+
priority = "notice"
26
+
source = "syscall" // syscall or k8s_audit
27
+
28
+
29
+
exceptions {
30
+
name = "proc_names"
31
+
fields = ["proc.name"]
32
+
comps = ["in"]
33
+
values = jsonencode(["python", "python2", "python3"]) # If only one element is provided, do not specify it a list of lists.
34
+
}
35
+
36
+
exceptions {
37
+
name = "container_proc_name"
38
+
fields = ["container.id", "proc.name"]
39
+
comps = ["=", "in"]
40
+
values = jsonencode([ # If more than one element is provided, you need to specify a list of lists.
@@ -35,17 +61,25 @@ The following arguments are supported:
35
61
*`name` - (Required) The name of the Secure rule. It must be unique.
36
62
*`description` - (Optional) The description of Secure rule. By default is empty.
37
63
*`tags` - (Optional) A list of tags for this rule.
38
-
39
-
- - -
40
-
41
-
### Conditions
42
-
43
64
*`condition` - (Required) A [Falco condition](https://falco.org/docs/rules/) is simply a Boolean predicate on Sysdig events expressed using the Sysdig [filter syntax](http://www.sysdig.org/wiki/sysdig-user-guide/#filtering) and macro terms.
44
65
*`output` - (Optional) Add additional information to each Falco notification's output. Required if append is false.
45
66
*`priority` - (Optional) The priority of the Falco rule. It can be: "emergency", "alert", "critical", "error", "warning", "notice", "info" or "debug". By default is "warning".
46
67
*`source` - (Optional) The source of the event. It can be either "syscall", "k8s_audit" or "aws_cloudtrail". Required if append is false.
68
+
*`exceptions` - (Optional) The exceptions key is a list of identifier plus list of tuples of filtercheck fields. See below for details.
47
69
*`append` - (Optional) This indicates that the rule being created appends the condition to an existing Sysdig-provided rule. By default this is false. Appending to user-created rules is not supported by the API.
48
70
71
+
### Exceptions
72
+
73
+
Starting in 0.28.0, Falco supports an optional exceptions property to rules. The exceptions key is a list of identifier plus list of tuples of filtercheck fields.
74
+
For more information about the syntax of the exceptions, check the [official Falco documentation](https://falco.org/docs/rules/exceptions/).
75
+
76
+
Supported fields for exceptions:
77
+
78
+
*`name` - (Required) The name of the exception. Only used to provide a handy name, and to potentially link together values in a later rule that has `append = true`.
79
+
*`fields` - (Required) Contains one or more fields that will extract a value from the syscall/k8s_audit events.
80
+
*`comps` - (Required) Contains comparison operators that align 1-1 with the items in the fields property.
81
+
*`values` - (Required) Contains tuples of values. Each item in the tuple should align 1-1 with the corresponding field and comparison operator. Since the value can be a string, a list of strings or a list of a list of strings, the value of this field must be supplied in JSON format. You can use the default `jsonencode` function to provide this value. See the usage example on the top.
82
+
49
83
## Attributes Reference
50
84
51
85
In addition to all arguments above, the following attributes are exported:
0 commit comments