Leonardo Grasso comments

Results 453 comments of


Leonardo Grasso

cleanup(docker): avoid linking /lib/modules to /host/lib/modules at docker image creation time

> > Since /lib/modules is only required to build the driver, why not put this logic inside falco-driver-loader? (or am I missing something?) > > We can probably do this...

[WIP] update(rules): ehanced rules tagging for inventory / threat modeling

cc @darryk10 @Kaizhe

[WIP] update(rules): ehanced rules tagging for inventory / threat modeling

> Hi @incertum amazing work! Both inventory and the Mitre TTP mapping is really helpful to understand the coverage. My suggestion is to generate the mitre coverage map with the...

Documentation: Falco <-> libs versioning (more details)

Hey @h20220025 PR https://github.com/falcosecurity/falco/pull/2205 has already addressed this issue in an excellent way! @incertum :pray: If you think there's more to add, feel free to open a PR. /close

Falco starts but nothing happens

Hey folks, Is this still an issue?

Falco starts but nothing happens

> Yes, I'm still having issues, can I contact you by slack? Sure. I'll be happy to help. Just consider that we are currently very busy with the upcoming release.

fix mount detection in falco_rules.yaml

/milestone 0.35.0

fix mount detection in falco_rules.yaml

/close

Add rule to detect bypass by symlink files

/milestone 0.35.0

Add rule to detect bypass by symlink files

> Could you migrate this PR to https://github.com/falcosecurity/rules, please? > > Thanks Hey @hi120ki Rules files have been moved to https://github.com/falcosecurity/rules. Please, reopen this PR there :pray: /close