Federico Di Pierro

/milestone 0.42.0

CI build-dev is failing because it uses yaml-cpp from the system that is too old and does not support `as`: https://github.com/jbeder/yaml-cpp/pull/932 I think we should actually enforce the bundle yaml-cpp...

Example rule output with: ```yaml static_fields: foo: bar foo2: ${HOME} ``` :point_down: ``` 11:01:07.833224783: Notice A shell was spawned in a container with an attached terminal | evt_type=execve user=root user_uid=0...

Relevant PRs have been merged in libs master; once https://github.com/falcosecurity/falco/pull/3592 is merged i will rebase this one and get it ready.

Hi @yzewei ! it seems you are hitting a verifier issue; are you using libs from master?

/milestone TBD

Yes it would be great, thanks!