Skip to content

Commit

Permalink
fix: Missing % in "Unexpected UDP Traffic" output rule
Browse files Browse the repository at this point in the history
Signed-off-by: Damien DELPORTE <[email protected]>
  • Loading branch information
DamienDelporte authored and poiana committed Jun 6, 2024
1 parent df963b6 commit 36f4320
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rules/falco-incubating_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -747,7 +747,7 @@
inbound_outbound
and fd.l4proto=udp
and not expected_udp_traffic
output: Unexpected UDP Traffic Seen (connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)
output: Unexpected UDP Traffic Seen (connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)
priority: NOTICE
tags: [maturity_incubating, host, container, network, mitre_exfiltration, TA0011]

Expand Down

0 comments on commit 36f4320

Please sign in to comment.