Clémence Saussez

Falco v0.31.0: <NA> output for %user.name, %user.loginuid (and %user.uid)

23

Metadatas are empty for %user.name %user.loginuid %user.uid in a rule detecting SSH connections. Also at the first occurrence, proc.cmdline is empty, then not rule lies in `falco_local_rules.yaml` macros are the...

Send an event when suspending / resuming resource

1

It would be very useful to receive notifications when a `tk suspend` or `tk resume` have been triggered, containing the resource name.