Kapil Sharma comments

Results 108 comments of


                                            Kapil Sharma

adding an event on triggering rule `disallowed ssh connection`

@leogr, as this rule is disabled by default, I enabled it [here](https://github.com/falcosecurity/rules/blob/main/rules/falco-deprecated_rules.yaml#L89). On event execution, the rule is triggered successfully, as shown in the terminal output below. ![Screenshot from 2024-03-27...

adding an event on triggering rule `disallowed ssh connection`

@leogr @FedeDP I have used `timeout` tag to reset connection after 1 second to complete event. Please review it again. Thank You!!

event on `update package repository`

/assign

adding an event on `unexpected_k8s_nodeport_connection`

@leogr @FedeDP This event triggered rule successfully ![WhatsApp Image 2024-04-05 at 07 48 01_80edadc9](https://github.com/falcosecurity/event-generator/assets/117383853/3a4bef1e-7918-41bf-97b3-e2eafec31988)

event on `packet socket created in container`

/assign

adding event on `Redirect stdout/stdin to network connection in container`

Hey @leogr and @FedeDP, just an attempt to redirect `Stdout` is enough to trigger the [rule](https://github.com/falcosecurity/rules/blob/main/rules/falco_rules.yaml#L1018). In this event: - Created a listener using the TCP protocol on the container's...

Kapil Sharma

adding an event on triggering rule `disallowed ssh connection`

adding an event on triggering rule `disallowed ssh connection`

event on `update package repository`

adding an event on `unexpected_k8s_nodeport_connection`

event on `packet socket created in container`

adding event on `Redirect stdout/stdin to network connection in container`

adding event on triggering this rule contact_ec2_instance_metadata_from_container

adding event on triggering this rule contact_ec2_instance_metadata_from_container

adding event on `unexpected k8s nodeport connection`

wip: adding new event of copying content of sensitive files