(the ./run and ./finish scripts), but the processes runsv can not\n# spawn shells.\n-
      rule: Run shell untrusted\n  desc: an attempt to spawn a shell below a non-shell
      application.  To make customizations, it's better
      to add images to\n# either privileged_images or falco_sensitive_mount_images.\n-
      list: trusted_images\n  items: []\n\n# NOTE: This macro is only provided for backwards
      compatibility with\n# older local falco rules files that may have been appending
      to\n# trusted_images. To make customizations, it's better to add containers to\n#
      user_trusted_containers, user_privileged_containers or user_sensitive_mount_containers.\n-
      macro: trusted_containers\n  condition: (container.image.repository in (trusted_images))\n\n#
      Add conditions to this macro (probably in a separate file,\n# overwriting this macro)
      to specify additional containers that are\n# trusted and therefore allowed to run
      privileged *and* with sensitive\n# mounts.\n#\n# Like trusted_images, this is deprecated
      in favor of\n# user_privileged_containers and user_sensitive_mount_containers and\n#
      is only provided for backwards compatibility.\n#\n# In this file, it just takes
      one of the images in trusted_containers\n# and repeats it.\n- macro: user_trusted_containers\n
      \ condition: (never_true)\n\n- list: sematext_images\n  items: [docker.io/sematext/sematext-agent-docker,
      docker.io/sematext/agent, docker.io/sematext/logagent,\n          registry.access.redhat.com/sematext/sematext-agent-docker,\n
      \         registry.access.redhat.com/sematext/agent,\n          registry.access.redhat.com/sematext/logagent]\n\n#
      These container images are allowed to run with --privileged\n- list: falco_privileged_images\n
      \ items: [\n    docker.io/calico/node,\n    docker.io/cloudnativelabs/kube-router,\n
      \   docker.io/docker/ucp-agent,\n    docker.io/falcosecurity/falco,\n    docker.io/mesosphere/mesos-slave,\n
      \   docker.io/rook/toolbox,\n    docker.io/sysdig/falco,\n    docker.io/sysdig/sysdig,\n
      \   falcosecurity/falco,\n    gcr.io/google_containers/kube-proxy,\n    gcr.io/google-containers/startup-script,\n
      \   gcr.io/projectcalico-org/node,\n    gke.gcr.io/kube-proxy,\n    gke.gcr.io/gke-metadata-server,\n
      \   gke.gcr.io/netd-amd64,\n    gcr.io/google-containers/prometheus-to-sd,\n    k8s.gcr.io/ip-masq-agent-amd64,\n
      \   k8s.gcr.io/kube-proxy,\n    k8s.gcr.io/prometheus-to-sd,\n    quay.io/calico/node,\n
      \   sysdig/falco,\n    sysdig/sysdig,\n    sematext_images\n    ]\n\n- macro: falco_privileged_containers\n
      \ condition: (openshift_image or\n              user_trusted_containers or\n              container.image.repository
      in (trusted_images) or\n              container.image.repository in (falco_privileged_images)
      or\n              container.image.repository startswith istio/proxy_ or\n              container.image.repository
      startswith quay.io/sysdig/)\n\n# Add conditions to this macro (probably in a separate
      file,\n# overwriting this macro) to specify additional containers that are\n# allowed
      to run privileged\n#\n# In this file, it just takes one of the images in falco_privileged_images\n#
      and repeats it.\n- macro: user_privileged_containers\n  condition: (never_true)\n\n-
      list: rancher_images\n  items: [\n    rancher/network-manager, rancher/dns, rancher/agent,\n
      \   rancher/lb-service-haproxy, rancher/metadata, rancher/healthcheck\n  ]\n\n#
      These container images are allowed to mount sensitive paths from the\n# host filesystem.\n-
      list: falco_sensitive_mount_images\n  items: [\n    docker.io/sysdig/falco, docker.io/sysdig/sysdig,
      sysdig/falco, sysdig/sysdig,\n    gcr.io/google_containers/hyperkube,\n    gcr.io/google_containers/kube-proxy,
      docker.io/calico/node,\n    docker.io/rook/toolbox, docker.io/cloudnativelabs/kube-router,
      docker.io/consul,\n    docker.io/datadog/docker-dd-agent, docker.io/datadog/agent,
      docker.io/docker/ucp-agent, docker.io/gliderlabs/logspout,\n    docker.io/netdata/netdata,
      docker.io/google/cadvisor, docker.io/prom/node-exporter,\n    amazon/amazon-ecs-agent\n
      \   ]\n\n- macro: falco_sensitive_mount_containers\n  condition: (user_trusted_containers
      or\n              container.image.repository in (trusted_images) or\n              container.image.repository
      in (falco_sensitive_mount_images) or\n              container.image.repository startswith
      quay.io/sysdig/)\n\n# These container images are allowed to run with hostnetwork=true\n-
      list: falco_hostnetwork_images\n  items: [\n    gcr.io/google-containers/prometheus-to-sd,\n
      \   gcr.io/projectcalico-org/typha,\n    gcr.io/projectcalico-org/node,\n    gke.gcr.io/gke-metadata-server,\n
      \   gke.gcr.io/kube-proxy,\n    gke.gcr.io/netd-amd64,\n    k8s.gcr.io/ip-masq-agent-amd64\n
      \   k8s.gcr.io/prometheus-to-sd,\n    ]\n\n# Add conditions to this macro (probably
      in a separate file,\n# overwriting this macro) to specify additional containers
      that are\n# allowed to perform sensitive mounts.\n#\n# In this file, it just takes
      one of the images in falco_sensitive_mount_images\n# and repeats it.\n- macro: user_sensitive_mount_containers\n
      \ condition: (never_true)\n\n- rule: Launch Privileged Container\n  desc: Detect
      the initial process started in a privileged container. Exceptions are made for known
      trusted images.\n  condition: >\n    container_started and container\n    and container.privileged=true\n
      \   and not falco_privileged_containers\n    and not user_privileged_containers\n
      \ output: Privileged container started (user=%user.name user_loginuid=%user.loginuid
      command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag)\n
      \ priority: INFO\n  tags: [container, cis, mitre_privilege_escalation, mitre_lateral_movement]\n\n#
      For now, only considering a full mount of /etc as\n# sensitive. Ideally, this would
      also consider all subdirectories\n# below /etc as well, but the globbing mechanism
      used by sysdig\n# doesn't allow exclusions of a full pattern, only single characters.\n-
      macro: sensitive_mount\n  condition: (container.mount.dest[/proc*] != \"N/A\" or\n
      \             container.mount.dest[/var/run/docker.sock] != \"N/A\" or\n              container.mount.dest[/var/run/crio/crio.sock]
      != \"N/A\" or\n              container.mount.dest[/var/lib/kubelet] != \"N/A\" or\n
      \             container.mount.dest[/var/lib/kubelet/pki] != \"N/A\" or\n              container.mount.dest[/]
      != \"N/A\" or\n              container.mount.dest[/home/admin] != \"N/A\" or\n              container.mount.dest[/etc]
      != \"N/A\" or\n              container.mount.dest[/etc/kubernetes] != \"N/A\" or\n
      \             container.mount.dest[/etc/kubernetes/manifests] != \"N/A\" or\n              container.mount.dest[/root*]
      != \"N/A\")\n\n# The steps libcontainer performs to set up the root program for
      a container are:\n# - clone + exec self to a program runc:[0:PARENT]\n# - clone
      a program runc:[1:CHILD] which sets up all the namespaces\n# - clone a second program
      runc:[2:INIT] + exec to the root program.\n#   The parent of runc:[2:INIT] is runc:0:PARENT]\n#
      As soon as 1:CHILD is created, 0:PARENT exits, so there's a race\n#   where at the
      time 2:INIT execs the root program, 0:PARENT might have\n#   already exited, or
      might still be around. So we handle both.\n# We also let runc:[1:CHILD] count as
      the parent process, which can occur\n# when we lose events and lose track of state.\n\n-
      macro: container_entrypoint\n  condition: (not proc.pname exists or proc.pname in
      (runc:[0:PARENT], runc:[1:CHILD], runc, docker-runc, exe, docker-runc-cur))\n\n-
      rule: Launch Sensitive Mount Container\n  desc: >\n    Detect the initial process
      started by a container that has a mount from a sensitive host directory\n    (i.e.
      /proc). Exceptions are made for known trusted images.\n  condition: >\n    container_started
      and container\n    and sensitive_mount\n    and not falco_sensitive_mount_containers\n
      \   and not user_sensitive_mount_containers\n  output: Container with sensitive
      mount started (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline
      %container.info image=%container.image.repository:%container.image.tag mounts=%container.mounts)\n
      \ priority: INFO\n  tags: [container, cis, mitre_lateral_movement]\n\n# In a local/user
      rules file, you could override this macro to\n# explicitly enumerate the container
      images that you want to run in\n# your environment. In this main falco rules file,
      there isn't any way\n# to know all the containers that can run, so any container
      is\n# allowed, by using a filter that is guaranteed to evaluate to true.\n# In the
      overridden macro, the condition would look something like\n# (container.image.repository
      = vendor/container-1 or\n# container.image.repository = vendor/container-2 or ...)\n\n-
      macro: allowed_containers\n  condition: (container.id exists)\n\n- rule: Launch
      Disallowed Container\n  desc: >\n    Detect the initial process started by a container
      that is not in a list of allowed containers.\n  condition: container_started and
      container and not allowed_containers\n  output: Container started and not in allowed
      list (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline %container.info
      image=%container.image.repository:%container.image.tag)\n  priority: WARNING\n  tags:
      [container, mitre_lateral_movement]\n\n- macro: user_known_system_user_login\n  condition:
      (never_true)\n\n# Anything run interactively by root\n# - condition: evt.type !=
      switch and user.name = root and proc.name != sshd and interactive\n#  output: \"Interactive
      root (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)\"\n#  priority:
      WARNING\n\n- rule: System user interactive\n  desc: an attempt to run interactive
      commands by a system (i.e. non-login) user\n  condition: spawned_process and system_users
      and interactive and not user_known_system_user_login\n  output: \"System user ran
      an interactive command (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline
      container_id=%container.id image=%container.image.repository)\"\n  priority: INFO\n
      \ tags: [users, mitre_remote_access_tools]\n\n# In some cases, a shell is expected
      to be run in a container. For example, configuration\n# management software may
      do this, which is expected.\n- macro: user_expected_terminal_shell_in_container_conditions\n
      \ condition: (never_true)\n\n- rule: Terminal shell in container\n  desc: A shell
      was used as the entrypoint/exec point into a container with an attached terminal.\n
      \ condition: >\n    spawned_process and container\n    and shell_procs and proc.tty
      != 0\n    and container_entrypoint\n    and not user_expected_terminal_shell_in_container_conditions\n
      \ output: >\n    A shell was spawned in a container with an attached terminal (user=%user.name
      user_loginuid=%user.loginuid %container.info\n    shell=%proc.name parent=%proc.pname
      cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository)\n
      \ priority: NOTICE\n  tags: [container, shell, mitre_execution]\n\n# For some container
      types (mesos), there isn't a container image to\n# work with, and the container
      name is autogenerated, so there isn't\n# any stable aspect of the software to work
      with. In this case, we\n# fall back to allowing certain command lines.\n\n- list:
      known_shell_spawn_cmdlines\n  items: [\n    '\"sh -c uname -p 2> /dev/null\"',\n
      \   '\"sh -c uname -s 2>&1\"',\n    '\"sh -c uname -r 2>&1\"',\n    '\"sh -c uname
      -v 2>&1\"',\n    '\"sh -c uname -a 2>&1\"',\n    '\"sh -c ruby -v 2>&1\"',\n    '\"sh
      -c getconf CLK_TCK\"',\n    '\"sh -c getconf PAGESIZE\"',\n    '\"sh -c LC_ALL=C
      LANG=C /sbin/ldconfig -p 2>/dev/null\"',\n    '\"sh -c LANG=C /sbin/ldconfig -p
      2>/dev/null\"',\n    '\"sh -c /sbin/ldconfig -p 2>/dev/null\"',\n    '\"sh -c stty
      -a 2>/dev/null\"',\n    '\"sh -c stty -a < /dev/tty\"',\n    '\"sh -c stty -g <
      /dev/tty\"',\n    '\"sh -c node index.js\"',\n    '\"sh -c node index\"',\n    '\"sh
      -c node ./src/start.js\"',\n    '\"sh -c node app.js\"',\n    '\"sh -c node -e \\\"require(''nan'')\\\"\"',\n
      \   '\"sh -c node -e \\\"require(''nan'')\\\")\"',\n    '\"sh -c node $NODE_DEBUG_OPTION
      index.js \"',\n    '\"sh -c crontab -l 2\"',\n    '\"sh -c lsb_release -a\"',\n
      \   '\"sh -c lsb_release -is 2>/dev/null\"',\n    '\"sh -c whoami\"',\n    '\"sh
      -c node_modules/.bin/bower-installer\"',\n    '\"sh -c /bin/hostname -f 2> /dev/null\"',\n
      \   '\"sh -c locale -a\"',\n    '\"sh -c  -t -i\"',\n    '\"sh -c openssl version\"',\n
      \   '\"bash -c id -Gn kafadmin\"',\n    '\"sh -c /bin/sh -c ''date +%%s''\"'\n    ]\n\n#
      This list allows for easy additions to the set of commands allowed\n# to run shells
      in containers without having to without having to copy\n# and override the entire
      run shell in container macro. Once\n# https://github.com/draios/falco/issues/255
      is fixed this will be a\n# bit easier, as someone could append of any of the existing
      lists.\n- list: user_known_shell_spawn_binaries\n  items: []\n\n# This macro allows
      for easy additions to the set of commands allowed\n# to run shells in containers
      without having to override the entire\n# rule. Its default value is an expression
      that always is false, which\n# becomes true when the \"not ...\" in the rule is
      applied.\n- macro: user_shell_container_exclusions\n  condition: (never_true)\n\n-
      macro: login_doing_dns_lookup\n  condition: (proc.name=login and fd.l4proto=udp
      and fd.sport=53)\n\n# sockfamily ip is to exclude certain processes (like 'groups')
      that communicate on unix-domain sockets\n# systemd can listen on ports to launch
      things like sshd on demand\n- rule: System procs network activity\n  desc: any network
      activity performed by system binaries that are not expected to send or receive any
      network traffic\n  condition: >\n    (fd.sockfamily = ip and (system_procs or proc.name
      in (shell_binaries)))\n    and (inbound_outbound)\n    and not proc.name in (known_system_procs_network_activity_binaries)\n
      \   and not login_doing_dns_lookup\n    and not user_expected_system_procs_network_activity_conditions\n
      \ output: >\n    Known system binary sent/received network traffic\n    (user=%user.name
      user_loginuid=%user.loginuid command=%proc.cmdline connection=%fd.name container_id=%container.id
      image=%container.image.repository)\n  priority: NOTICE\n  tags: [network, mitre_exfiltration]\n\n#
      This list allows easily whitelisting system proc names that are\n# expected to communicate
      on the network.\n- list: known_system_procs_network_activity_binaries\n  items:
      [systemd, hostid, id]\n\n# This macro allows specifying conditions under which a
      system binary\n# is allowed to communicate on the network. For instance, only specific\n#
      proc.cmdline values could be allowed to be more granular in what is\n# allowed.\n-
      macro: user_expected_system_procs_network_activity_conditions\n  condition: (never_true)\n\n#
      When filled in, this should look something like:\n# (proc.env contains \"HTTP_PROXY=http://my.http.proxy.com
      \")\n# The trailing space is intentional so avoid matching on prefixes of\n# the
      actual proxy.\n- macro: allowed_ssh_proxy_env\n  condition: (always_true)\n\n- list:
      http_proxy_binaries\n  items: [curl, wget]\n\n- macro: http_proxy_procs\n  condition:
      (proc.name in (http_proxy_binaries))\n\n- rule: Program run with disallowed http
      proxy env\n  desc: An attempt to run a program with a disallowed HTTP_PROXY environment
      variable\n  condition: >\n    spawned_process and\n    http_proxy_procs and\n    not
      allowed_ssh_proxy_env and\n    proc.env icontains HTTP_PROXY\n  output: >\n    Program
      run with disallowed HTTP_PROXY environment variable\n    (user=%user.name user_loginuid=%user.loginuid
      command=%proc.cmdline env=%proc.env parent=%proc.pname container_id=%container.id
      image=%container.image.repository)\n  priority: NOTICE\n  tags: [host, users]\n\n#
      In some environments, any attempt by a interpreted program (perl,\n# python, ruby,
      etc) to listen for incoming connections or perform\n# outgoing connections might
      be suspicious. These rules are not\n# enabled by default, but you can modify the
      following macros to\n# enable them.\n\n- macro: consider_interpreted_inbound\n  condition:
      (never_true)\n\n- macro: consider_interpreted_outbound\n  condition: (never_true)\n\n-
      rule: Interpreted procs inbound network activity\n  desc: Any inbound network activity
      performed by any interpreted program (perl, python, ruby, etc.)\n  condition: >\n
      \   (inbound and consider_interpreted_inbound\n     and interpreted_procs)\n  output:
      >\n    Interpreted program received/listened for network traffic\n    (user=%user.name
      user_loginuid=%user.loginuid command=%proc.cmdline connection=%fd.name container_id=%container.id
      image=%container.image.repository)\n  priority: NOTICE\n  tags: [network, mitre_exfiltration]\n\n-
      rule: Interpreted procs outbound network activity\n  desc: Any outbound network
      activity performed by any interpreted program (perl, python, ruby, etc.)\n  condition:
      >\n    (outbound and consider_interpreted_outbound\n     and interpreted_procs)\n
      \ output: >\n    Interpreted program performed outgoing network connection\n    (user=%user.name
      user_loginuid=%user.loginuid command=%proc.cmdline connection=%fd.name container_id=%container.id
      image=%container.image.repository)\n  priority: NOTICE\n  tags: [network, mitre_exfiltration]\n\n-
      list: openvpn_udp_ports\n  items: [1194, 1197, 1198, 8080, 9201]\n\n- list: l2tp_udp_ports\n
      \ items: [500, 1701, 4500, 10000]\n\n- list: statsd_ports\n  items: [8125]\n\n-
      list: ntp_ports\n  items: [123]\n\n# Some applications will connect a udp socket
      to an address only to\n# test connectivity. Assuming the udp connect works, they
      will follow\n# up with a tcp connect that actually sends/receives data.\n#\n# With
      that in mind, we listed a few commonly seen ports here to avoid\n# some false positives.
      In addition, we make the main rule opt-in, so\n# it's disabled by default.\n\n-
      list: test_connect_ports\n  items: [0, 9, 80, 3306]\n\n- macro: do_unexpected_udp_check\n
      \ condition: (never_true)\n\n- list: expected_udp_ports\n  items: [53, openvpn_udp_ports,
      l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports]\n\n- macro: expected_udp_traffic\n
      \ condition: fd.port in (expected_udp_ports)\n\n- rule: Unexpected UDP Traffic\n
      \ desc: UDP traffic not on port 53 (DNS) or other commonly used ports\n  condition:
      (inbound_outbound) and do_unexpected_udp_check and fd.l4proto=udp and not expected_udp_traffic\n
      \ output: >\n    Unexpected UDP Traffic Seen\n    (user=%user.name user_loginuid=%user.loginuid
      command=%proc.cmdline connection=%fd.name proto=%fd.l4proto evt=%evt.type %evt.args
      container_id=%container.id image=%container.image.repository)\n  priority: NOTICE\n
      \ tags: [network, mitre_exfiltration]\n\n# With the current restriction on system
      calls handled by falco\n# (e.g. excluding read/write/sendto/recvfrom/etc, this rule
      won't\n# trigger).\n# - rule: Ssh error in syslog\n#   desc: any ssh errors (failed
      logins, disconnects, ...) sent to syslog\n#   condition: syslog and ssh_error_message
      and evt.dir = <\n#   output: \"sshd sent error message to syslog (error=%evt.buffer)\"\n#
      \  priority: WARNING\n\n- macro: somebody_becoming_themself\n  condition: ((user.name=nobody
      and evt.arg.uid=nobody) or\n              (user.name=www-data and evt.arg.uid=www-data)
      or\n              (user.name=_apt and evt.arg.uid=_apt) or\n              (user.name=postfix
      and evt.arg.uid=postfix) or\n              (user.name=pki-agent and evt.arg.uid=pki-agent)
      or\n              (user.name=pki-acme and evt.arg.uid=pki-acme) or\n              (user.name=nfsnobody
      and evt.arg.uid=nfsnobody) or\n              (user.name=postgres and evt.arg.uid=postgres))\n\n-
      macro: nrpe_becoming_nagios\n  condition: (proc.name=nrpe and evt.arg.uid=nagios)\n\n#
      In containers, the user name might be for a uid that exists in the\n# container
      but not on the host. (See\n# https://github.com/draios/sysdig/issues/954). So in
      that case, allow\n# a setuid.\n- macro: known_user_in_container\n  condition: (container
      and user.name != \"N/A\")\n\n# Add conditions to this macro (probably in a separate
      file,\n# overwriting this macro) to allow for specific combinations of\n# programs
      changing users by calling setuid.\n#\n# In this file, it just takes one of the condition
      in the base macro\n# and repeats it.\n- macro: user_known_non_sudo_setuid_conditions\n
      \ condition: user.name=root\n\n# sshd, mail programs attempt to setuid to root even
      when running as non-root. Excluding here to avoid meaningless FPs\n- rule: Non sudo
      setuid\n  desc: >\n    an attempt to change users by calling setuid. sudo/su are
      excluded. users \"root\" and \"nobody\"\n    suing to itself are also excluded,
      as setuid calls typically involve dropping privileges.\n  condition: >\n    evt.type=setuid
      and evt.dir=>\n    and (known_user_in_container or not container)\n    and not user.name=root\n
      \   and not somebody_becoming_themself\n    and not proc.name in (known_setuid_binaries,
      userexec_binaries, mail_binaries, docker_binaries,\n                          nomachine_binaries)\n
      \   and not proc.name startswith \"runc:\"\n    and not java_running_sdjagent\n
      \   and not nrpe_becoming_nagios\n    and not user_known_non_sudo_setuid_conditions\n
      \ output: >\n    Unexpected setuid call by non-sudo, non-root program (user=%user.name
      user_loginuid=%user.loginuid cur_uid=%user.uid parent=%proc.pname\n    command=%proc.cmdline
      uid=%evt.arg.uid container_id=%container.id image=%container.image.repository)\n
      \ priority: NOTICE\n  tags: [users, mitre_privilege_escalation]\n\n- macro: user_known_user_management_activities\n
      \ condition: (never_true)\n\n- rule: User mgmt binaries\n  desc: >\n    activity
      by any programs that can manage users, passwords, or permissions. sudo and su are
      excluded.\n    Activity in containers is also excluded--some containers create custom
      users on top\n    of a base linux distribution at startup.\n    Some innocuous commandlines
      that don't actually change anything are excluded.\n  condition: >\n    spawned_process
      and proc.name in (user_mgmt_binaries) and\n    not proc.name in (su, sudo, lastlog,
      nologin, unix_chkpwd) and not container and\n    not proc.pname in (cron_binaries,
      systemd, systemd.postins, udev.postinst, run-parts) and\n    not proc.cmdline startswith
      \"passwd -S\" and\n    not proc.cmdline startswith \"useradd -D\" and\n    not proc.cmdline
      startswith \"systemd --version\" and\n    not run_by_qualys and\n    not run_by_sumologic_securefiles
      and\n    not run_by_yum and\n    not run_by_ms_oms and\n    not run_by_google_accounts_daemon
      and\n    not user_known_user_management_activities\n  output: >\n    User management
      binary command run outside of container\n    (user=%user.name user_loginuid=%user.loginuid
      command=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3]
      gggparent=%proc.aname[4])\n  priority: NOTICE\n  tags: [host, users, mitre_persistence]\n\n-
      list: allowed_dev_files\n  items: [\n    /dev/null, /dev/stdin, /dev/stdout, /dev/stderr,\n
      \   /dev/random, /dev/urandom, /dev/console, /dev/kmsg\n    ]\n\n- macro: user_known_create_files_below_dev_activities\n
      \ condition: (never_true)\n\n# (we may need to add additional checks against false
      positives, see:\n# https://bugs.launchpad.net/ubuntu/+source/rkhunter/+bug/86153)\n-
      rule: Create files below dev\n  desc: creating any files below /dev other than known
      programs that manage devices. Some rootkits hide files in /dev.\n  condition: >\n
      \   fd.directory = /dev and\n    (evt.type = creat or ((evt.type = open or evt.type
      = openat) and evt.arg.flags contains O_CREAT))\n    and not proc.name in (dev_creation_binaries)\n
      \   and not fd.name in (allowed_dev_files)\n    and not fd.name startswith /dev/tty\n
      \   and not user_known_create_files_below_dev_activities\n  output: \"File created
      below /dev by untrusted program (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline
      file=%fd.name container_id=%container.id image=%container.image.repository)\"\n
      \ priority: ERROR\n  tags: [filesystem, mitre_persistence]\n\n\n# In a local/user
      rules file, you could override this macro to\n# explicitly enumerate the container
      images that you want to allow\n# access to EC2 metadata. In this main falco rules
      file, there isn't\n# any way to know all the containers that should have access,
      so any\n# container is alllowed, by repeating the \"container\" macro. In the\n#
      overridden macro, the condition would look something like\n# (container.image.repository
      = vendor/container-1 or\n# container.image.repository = vendor/container-2 or ...)\n-
      macro: ec2_metadata_containers\n  condition: container\n\n# On EC2 instances, <IP_ADDRESS>
      is a special IP used to fetch\n# metadata about the instance. It may be desirable
      to prevent access\n# to this IP from containers.\n- rule: Contact EC2 Instance Metadata
      Service From Container\n  desc: Detect attempts to contact the EC2 Instance Metadata
      Service from a container\n  condition: outbound and fd.sip=\"<IP_ADDRESS>\" and
      container and not ec2_metadata_containers\n  output: Outbound connection to EC2
      instance metadata service (command=%proc.cmdline connection=%fd.name %container.info
      image=%container.image.repository:%container.image.tag)\n  priority: NOTICE\n  tags:
      [network, aws, container, mitre_discovery]\n\n\n# This rule is not enabled by default,
      since this rule is for cloud environment(GCP, AWS and Azure) only.\n# If you want
      to enable this rule, overwrite the first macro,\n# And you can filter the container
      that you want to allow access to metadata by overwriting the second macro.\n- macro:
      consider_metadata_access\n  condition: (never_true)\n\n- macro: user_known_metadata_access\n
      \ condition: (k8s.ns.name = \"kube-system\")\n\n# On GCP, AWS and Azure, <IP_ADDRESS>
      is a special IP used to fetch\n# metadata about the instance. The metadata could
      be used to get credentials by attackers.\n- rule: Contact cloud metadata service
      from container\n  desc: Detect attempts to contact the Cloud Instance Metadata Service
      from a container\n  condition: outbound and fd.sip=\"<IP_ADDRESS>\" and container
      and consider_metadata_access and not user_known_metadata_access\n  output: Outbound
      connection to cloud instance metadata service (command=%proc.cmdline connection=%fd.name
      %container.info image=%container.image.repository:%container.image.tag)\n  priority:
      NOTICE\n  tags: [network, container, mitre_discovery]\n\n\n# In a local/user rules
      file, list the namespace or container images that are\n# allowed to contact the
      K8s API Server from within a container. This\n# might cover cases where the K8s
      infrastructure itself is running\n# within a container.\n- macro: k8s_containers\n
      \ condition: >\n    (container.image.repository in (gcr.io/google_containers/hyperkube-amd64,\n
      \    gcr.io/google_containers/kube2sky, docker.io/sysdig/falco,\n     docker.io/sysdig/sysdig,
      docker.io/falcosecurity/falco,\n     sysdig/falco, sysdig/sysdig, falcosecurity/falco)
      or (k8s.ns.name = \"kube-system\"))\n\n- macro: k8s_api_server\n  condition: (fd.sip.name=\"kubernetes.default.svc.cluster.local\")\n\n-
      macro: user_known_contact_k8s_api_server_activities\n  condition: (never_true)\n\n-
      rule: Contact K8S API Server From Container\n  desc: Detect attempts to contact
      the K8S API Server from a container\n  condition: >\n    evt.type=connect and evt.dir=<
      and \n    (fd.typechar=4 or fd.typechar=6) and\n    container and \n    not k8s_containers
      and\n    k8s_api_server and\n    not user_known_contact_k8s_api_server_activities\n
      \ output: Unexpected connection to K8s API Server from container (command=%proc.cmdline
      %container.info image=%container.image.repository:%container.image.tag connection=%fd.name)\n
      \ priority: NOTICE\n  tags: [network, k8s, container, mitre_discovery]\n\n# In a
      local/user rules file, list the container images that are\n# allowed to contact
      NodePort services from within a container. This\n# might cover cases where the K8s
      infrastructure itself is running\n# within a container.\n#\n# By default, all containers
      are allowed to contact NodePort services.\n- macro: nodeport_containers\n  condition:
      container\n\n- rule: Unexpected K8s NodePort Connection\n  desc: Detect attempts
      to use K8s NodePorts from a container\n  condition: (inbound_outbound) and fd.sport
      >= 30000 and fd.sport <= 32767 and container and not nodeport_containers\n  output:
      Unexpected K8s NodePort Connection (command=%proc.cmdline connection=%fd.name container_id=%container.id
      image=%container.image.repository)\n  priority: NOTICE\n  tags: [network, k8s, container,
      mitre_port_knocking]\n\n- list: network_tool_binaries\n  items: [nc, ncat, nmap,
      dig, tcpdump, tshark, ngrep, telnet, mitmproxy, socat, zmap]\n\n- macro: network_tool_procs\n
      \ condition: (proc.name in (network_tool_binaries))\n\n# In a local/user rules file,
      create a condition that matches legitimate uses\n# of a package management process
      inside a container.\n#\n# For example:\n# - macro: user_known_package_manager_in_container\n#
      \  condition: proc.cmdline=\"dpkg -l\"\n- macro: user_known_package_manager_in_container\n
      \ condition: (never_true)\n\n# Container is supposed to be immutable. Package management
      should be done in building the image.\n- rule: Launch Package Management Process
      in Container\n  desc: Package management process ran inside container\n  condition:
      >\n    spawned_process\n    and container\n    and user.name != \"_apt\"\n    and
      package_mgmt_procs\n    and not package_mgmt_ancestor_procs\n    and not user_known_package_manager_in_container\n
      \ output: >\n    Package management process launched in container (user=%user.name
      user_loginuid=%user.loginuid\n    command=%proc.cmdline container_id=%container.id
      container_name=%container.name image=%container.image.repository:%container.image.tag)\n
      \ priority: ERROR\n  tags: [process, mitre_persistence]\n\n- rule: Netcat Remote
      Code Execution in Container\n  desc: Netcat Program runs inside container that allows
      remote code execution\n  condition: >\n    spawned_process and container and\n    ((proc.name
      = \"nc\" and (proc.args contains \"-e\" or proc.args contains \"-c\")) or\n     (proc.name
      = \"ncat\" and (proc.args contains \"--sh-exec\" or proc.args contains \"--exec\"
      or proc.args contains \"-e \"\n                              or proc.args contains
      \"-c \" or proc.args contains \"--lua-exec\"))\n    )\n  output: >\n    Netcat runs
      inside container that allows remote code execution (user=%user.name user_loginuid=%user.loginuid\n
      \   command=%proc.cmdline container_id=%container.id container_name=%container.name
      image=%container.image.repository:%container.image.tag)\n  priority: WARNING\n  tags:
      [network, process, mitre_execution]\n\n- macro: user_known_network_tool_activities\n
      \ condition: (never_true)\n\n- rule: Launch Suspicious Network Tool in Container\n
      \ desc: Detect network tools launched inside container\n  condition: >\n    spawned_process
      and container and network_tool_procs and not user_known_network_tool_activities\n
      \ output: >\n    Network tool launched in container (user=%user.name user_loginuid=%user.loginuid
      command=%proc.cmdline parent_process=%proc.pname\n    container_id=%container.id
      container_name=%container.name image=%container.image.repository:%container.image.tag)\n
      \ priority: NOTICE\n  tags: [network, process, mitre_discovery, mitre_exfiltration]\n\n#
      This rule is not enabled by default, as there are legitimate use\n# cases for these
      tools on hosts. If you want to enable it, modify the\n# following macro.\n- macro:
      consider_network_tools_on_host\n  condition: (never_true)\n\n- rule: Launch Suspicious
      Network Tool on Host\n  desc: Detect network tools launched on the host\n  condition:
      >\n    spawned_process and\n    not container and\n    consider_network_tools_on_host
      and\n    network_tool_procs and\n    not user_known_network_tool_activities\n  output:
      >\n    Network tool launched on host (user=%user.name user_loginuid=%user.loginuid
      command=%proc.cmdline parent_process=%proc.pname)\n  priority: NOTICE\n  tags: [network,
      process, mitre_discovery, mitre_exfiltration]\n\n- list: grep_binaries\n  items:
      [grep, egrep, fgrep]\n\n- macro: grep_commands\n  condition: (proc.name in (grep_binaries))\n\n#
      a less restrictive search for things that might be passwords/ssh/user etc.\n- macro:
      grep_more\n  condition: (never_true)\n\n- macro: private_key_or_password\n  condition:
      >\n    (proc.args icontains \"BEGIN PRIVATE\" or\n     proc.args icontains \"BEGIN
      RSA PRIVATE\" or\n     proc.args icontains \"BEGIN DSA PRIVATE\" or\n     proc.args
      icontains \"BEGIN EC PRIVATE\" or\n     (grep_more and\n      (proc.args icontains
      \" pass \" or\n       proc.args icontains \" ssh \" or\n       proc.args icontains
      \" user \"))\n    )\n\n- rule: Search Private Keys or Passwords\n  desc: >\n    Detect
      grep private keys or passwords activity.\n  condition: >\n    (spawned_process and\n
      \    ((grep_commands and private_key_or_password) or\n      (proc.name = \"find\"
      and (proc.args contains \"id_rsa\" or proc.args contains \"id_dsa\")))\n    )\n
      \ output: >\n    Grep private keys or passwords activities found\n    (user=%user.name
      user_loginuid=%user.loginuid command=%proc.cmdline container_id=%container.id container_name=%container.name\n
      \   image=%container.image.repository:%container.image.tag)\n  priority:\n    WARNING\n
      \ tags: [process, mitre_credential_access]\n\n- list: log_directories\n  items:
      [/var/log, /dev/log]\n\n- list: log_files\n  items: [syslog, auth.log, secure, kern.log,
      cron, user.log, dpkg.log, last.log, yum.log, access_log, mysql.log, mysqld.log]\n\n-
      macro: access_log_files\n  condition: (fd.directory in (log_directories) or fd.filename
      in (log_files))\n\n# a placeholder for whitelist log files that could be cleared.
      Recommend the macro as (fd.name startswith \"/var/log/app1*\")\n- macro: allowed_clear_log_files\n
      \ condition: (never_true)\n\n- macro: trusted_logging_images\n  condition: (container.image.repository
      endswith \"splunk/fluentd-hec\" or\n              container.image.repository endswith
      \"fluent/fluentd-kubernetes-daemonset\" or\n              container.image.repository
      endswith \"openshift3/ose-logging-fluentd\" or\n              container.image.repository
      endswith \"containernetworking/azure-npm\")\n\n- rule: Clear Log Activities\n  desc:
      Detect clearing of critical log files\n  condition: >\n    open_write and\n    access_log_files
      and\n    evt.arg.flags contains \"O_TRUNC\" and\n    not trusted_logging_images
      and\n    not allowed_clear_log_files\n  output: >\n    Log files were tampered (user=%user.name
      user_loginuid=%user.loginuid command=%proc.cmdline file=%fd.name container_id=%container.id
      image=%container.image.repository)\n  priority:\n    WARNING\n  tags: [file, mitre_defense_evasion]\n\n-
      list: data_remove_commands\n  items: [shred, mkfs, mke2fs]\n\n- macro: clear_data_procs\n
      \ condition: (proc.name in (data_remove_commands))\n\n- macro: user_known_remove_data_activities\n
      \ condition: (never_true)\n\n- rule: Remove Bulk Data from Disk\n  desc: Detect
      process running to clear bulk data from disk\n  condition: spawned_process and clear_data_procs
      and not user_known_remove_data_activities\n  output: >\n    Bulk data has been removed
      from disk (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline file=%fd.name
      container_id=%container.id image=%container.image.repository)\n  priority:\n    WARNING\n
      \ tags: [process, mitre_persistence]\n\n- macro: modify_shell_history\n  condition:
      >\n    (modify and (\n      evt.arg.name contains \"bash_history\" or\n      evt.arg.name
      contains \"zsh_history\" or\n      evt.arg.name contains \"fish_read_history\" or\n
      \     evt.arg.name endswith \"fish_history\" or\n      evt.arg.oldpath contains
      \"bash_history\" or\n      evt.arg.oldpath contains \"zsh_history\" or\n      evt.arg.oldpath
      contains \"fish_read_history\" or\n      evt.arg.oldpath endswith \"fish_history\"
      or\n      evt.arg.path contains \"bash_history\" or\n      evt.arg.path contains
      \"zsh_history\" or\n      evt.arg.path contains \"fish_read_history\" or\n      evt.arg.path
      endswith \"fish_history\"))\n\n- macro: truncate_shell_history\n  condition: >\n
      \   (open_write and (\n      fd.name contains \"bash_history\" or\n      fd.name
      contains \"zsh_history\" or\n      fd.name contains \"fish_read_history\" or\n      fd.name
      endswith \"fish_history\") and evt.arg.flags contains \"O_TRUNC\")\n\n- macro: var_lib_docker_filepath\n
      \ condition: (evt.arg.name startswith /var/lib/docker or fd.name startswith /var/lib/docker)\n\n-
      rule: Delete or rename shell history\n  desc: Detect shell history deletion\n  condition:
      >\n    (modify_shell_history or truncate_shell_history) and\n       not var_lib_docker_filepath
      and\n       not proc.name in (docker_binaries)\n  output: >\n    Shell history had
      been deleted or renamed (user=%user.name user_loginuid=%user.loginuid type=%evt.type
      command=%proc.cmdline fd.name=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath=%evt.arg.oldpath
      %container.info)\n  priority:\n    WARNING\n  tags: [process, mitre_defense_evasion]\n\n#
      This rule is deprecated and will/should never be triggered. Keep it here for backport
      compatibility.\n# Rule Delete or rename shell history is the preferred rule to use
      now.\n- rule: Delete Bash History\n  desc: Detect bash history deletion\n  condition:
      >\n    ((spawned_process and proc.name in (shred, rm, mv) and proc.args contains
      \"bash_history\") or\n     (open_write and fd.name contains \"bash_history\" and
      evt.arg.flags contains \"O_TRUNC\"))\n  output: >\n    Shell history had been deleted
      or renamed (user=%user.name user_loginuid=%user.loginuid type=%evt.type command=%proc.cmdline
      fd.name=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath=%evt.arg.oldpath
      %container.info)\n  priority:\n    WARNING\n  tags: [process, mitre_defense_evasion]\n\n-
      macro: consider_all_chmods\n  condition: (always_true)\n\n- list: user_known_chmod_applications\n
      \ items: [hyperkube, kubelet]\n\n# This macro should be overridden in user rules
      as needed. This is useful if a given application\n# should not be ignored alltogether
      with the user_known_chmod_applications list, but only in\n# specific conditions.\n-
      macro: user_known_set_setuid_or_setgid_bit_conditions\n  condition: (never_true)\n\n-
      rule: Set Setuid or Setgid bit\n  desc: >\n    When the setuid or setgid bits are
      set for an application,\n    this means that the application will run with the privileges
      of the owning user or group respectively.\n    Detect setuid or setgid bits set
      via chmod\n  condition: >\n    consider_all_chmods and chmod and (evt.arg.mode contains
      \"S_ISUID\" or evt.arg.mode contains \"S_ISGID\")\n    and not proc.name in (user_known_chmod_applications)\n
      \   and not exe_running_docker_save\n    and not user_known_set_setuid_or_setgid_bit_conditions\n
      \ output: >\n    Setuid or setgid bit is set via chmod (fd=%evt.arg.fd filename=%evt.arg.filename
      mode=%evt.arg.mode user=%user.name user_loginuid=%user.loginuid process=%proc.name\n
      \   command=%proc.cmdline container_id=%container.id container_name=%container.name
      image=%container.image.repository:%container.image.tag)\n  priority:\n    NOTICE\n
      \ tags: [process, mitre_persistence]\n\n- list: exclude_hidden_directories\n  items:
      [/root/.cassandra]\n\n# To use this rule, you should modify consider_hidden_file_creation.\n-
      macro: consider_hidden_file_creation\n  condition: (never_true)\n\n- macro: user_known_create_hidden_file_activities\n
      \ condition: (never_true)\n\n- rule: Create Hidden Files or Directories\n  desc:
      Detect hidden files or directories created\n  condition: >\n    ((modify and evt.arg.newpath
      contains \"/.\") or\n     (mkdir and evt.arg.path contains \"/.\") or\n     (open_write
      and evt.arg.flags contains \"O_CREAT\" and fd.name contains \"/.\" and not fd.name
      pmatch (exclude_hidden_directories))) and\n    consider_hidden_file_creation and\n
      \   not user_known_create_hidden_file_activities\n  output: >\n    Hidden file or
      directory created (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline\n
      \   file=%fd.name newpath=%evt.arg.newpath container_id=%container.id container_name=%container.name
      image=%container.image.repository:%container.image.tag)\n  priority:\n    NOTICE\n
      \ tags: [file, mitre_persistence]\n\n- list: remote_file_copy_binaries\n  items:
      [rsync, scp, sftp, dcp]\n\n- macro: remote_file_copy_procs\n  condition: (proc.name
      in (remote_file_copy_binaries))\n\n- rule: Launch Remote File Copy Tools in Container\n
      \ desc: Detect remote file copy tools launched in container\n  condition: >\n    spawned_process
      and container and remote_file_copy_procs\n  output: >\n    Remote file copy tool
      launched in container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline
      parent_process=%proc.pname\n    container_id=%container.id container_name=%container.name
      image=%container.image.repository:%container.image.tag)\n  priority: NOTICE\n  tags:
      [network, process, mitre_lateral_movement, mitre_exfiltration]\n\n- rule: Create
      Symlink Over Sensitive Files\n  desc: Detect symlink created over sensitive files\n
      \ condition: >\n    create_symlink and\n    (evt.arg.target in (sensitive_file_names)
      or evt.arg.target in (sensitive_directory_names))\n  output: >\n    Symlinks created
      over senstivie files (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline
      target=%evt.arg.target linkpath=%evt.arg.linkpath parent_process=%proc.pname)\n
      \ priority: NOTICE\n  tags: [file, mitre_exfiltration]\n\n- list: miner_ports\n
      \ items: [\n        25, 3333, 3334, 3335, 3336, 3357, 4444,\n        5555, 5556,
      5588, 5730, 6099, 6666, 7777,\n        7778, 8000, 8001, 8008, 8080, 8118, 8333,\n
      \       8888, 8899, 9332, 9999, 14433, 14444,\n        45560, 45700\n    ]\n\n-
      list: miner_domains\n  items: [\n      \"asia1.ethpool.org\",\"ca.minexmr.com\",\n
      \     \"cn.stratum.slushpool.com\",\"de.minexmr.com\",\n      \"eth-ar.dwarfpool.com\",\"eth-asia.dwarfpool.com\",\n
      \     \"eth-asia1.nanopool.org\",\"eth-au.dwarfpool.com\",\n      \"eth-au1.nanopool.org\",\"eth-br.dwarfpool.com\",\n
      \     \"eth-cn.dwarfpool.com\",\"eth-cn2.dwarfpool.com\",\n      \"eth-eu.dwarfpool.com\",\"eth-eu1.nanopool.org\",\n
      \     \"eth-eu2.nanopool.org\",\"eth-hk.dwarfpool.com\",\n      \"eth-jp1.nanopool.org\",\"eth-ru.dwarfpool.com\",\n
      \     \"eth-ru2.dwarfpool.com\",\"eth-sg.dwarfpool.com\",\n      \"eth-us-east1.nanopool.org\",\"eth-us-west1.nanopool.org\",\n
      \     \"eth-us.dwarfpool.com\",\"eth-us2.dwarfpool.com\",\n      \"eu.stratum.slushpool.com\",\"eu1.ethermine.org\",\n
      \     \"eu1.ethpool.org\",\"fr.minexmr.com\",\n      \"mine.moneropool.com\",\"mine.xmrpool.net\",\n
      \     \"pool.minexmr.com\",\"pool.monero.hashvault.pro\",\n      \"pool.supportxmr.com\",\"sg.minexmr.com\",\n
      \     \"sg.stratum.slushpool.com\",\"stratum-eth.antpool.com\",\n      \"stratum-ltc.antpool.com\",\"stratum-zec.antpool.com\",\n
      \     \"stratum.antpool.com\",\"us-east.stratum.slushpool.com\",\n      \"us1.ethermine.org\",\"us1.ethpool.org\",\n
      \     \"us2.ethermine.org\",\"us2.ethpool.org\",\n      \"xmr-asia1.nanopool.org\",\"xmr-au1.nanopool.org\",\n
      \     \"xmr-eu1.nanopool.org\",\"xmr-eu2.nanopool.org\",\n      \"xmr-jp1.nanopool.org\",\"xmr-us-east1.nanopool.org\",\n
      \     \"xmr-us-west1.nanopool.org\",\"xmr.crypto-pool.fr\",\n      \"xmr.pool.minergate.com\"\n
      \     ]\n\n- list: https_miner_domains\n  items: [\n    \"ca.minexmr.com\",\n    \"cn.stratum.slushpool.com\",\n
      \   \"de.minexmr.com\",\n    \"fr.minexmr.com\",\n    \"mine.moneropool.com\",\n
      \   \"mine.xmrpool.net\",\n    \"pool.minexmr.com\",\n    \"sg.minexmr.com\",\n
      \   \"stratum-eth.antpool.com\",\n    \"stratum-ltc.antpool.com\",\n    \"stratum-zec.antpool.com\",\n
      \   \"stratum.antpool.com\",\n    \"xmr.crypto-pool.fr\"\n  ]\n\n- list: http_miner_domains\n
      \ items: [\n    \"ca.minexmr.com\",\n    \"de.minexmr.com\",\n    \"fr.minexmr.com\",\n
      \   \"mine.moneropool.com\",\n    \"mine.xmrpool.net\",\n    \"pool.minexmr.com\",\n
      \   \"sg.minexmr.com\",\n    \"xmr.crypto-pool.fr\"\n  ]\n\n# Add rule based on
      crypto mining IOCs\n- macro: minerpool_https\n  condition: (fd.sport=\"443\" and
      fd.sip.name in (https_miner_domains))\n\n- macro: minerpool_http\n  condition: (fd.sport=\"80\"
      and fd.sip.name in (http_miner_domains))\n\n- macro: minerpool_other\n  condition:
      (fd.sport in (miner_ports) and fd.sip.name in (miner_domains))\n\n- macro: net_miner_pool\n
      \ condition: (evt.type in (sendto, sendmsg) and evt.dir=< and (fd.net != \"<IP_ADDRESS>/8\"
      and not fd.snet in (rfc_1918_addresses)) and ((minerpool_http) or (minerpool_https)
      or (minerpool_other)))\n\n- macro: trusted_images_query_miner_domain_dns\n  condition:
      (container.image.repository in (docker.io/falcosecurity/falco, falcosecurity/falco))\n
      \ append: false\n\n# The rule is disabled by default.\n# Note: falco will send DNS
      request to resolve miner pool domain which may trigger alerts in your environment.\n-
      rule: Detect outbound connections to common miner pool ports\n  desc: Miners typically
      connect to miner pools on common ports.\n  condition: net_miner_pool and not trusted_images_query_miner_domain_dns\n
      \ enabled: false\n  output: Outbound connection to IP/Port flagged by cryptoioc.ch
      (command=%proc.cmdline port=%fd.rport ip=%fd.rip container=%container.info image=%container.image.repository)\n
      \ priority: CRITICAL\n  tags: [network, mitre_execution]\n\n- rule: Detect crypto
      miners using the Stratum protocol\n  desc: Miners typically specify the mining pool
      to connect to with a URI that begins with 'stratum+tcp'\n  condition: spawned_process
      and proc.cmdline contains \"stratum+tcp\"\n  output: Possible miner running (command=%proc.cmdline
      container=%container.info image=%container.image.repository)\n  priority: CRITICAL\n
      \ tags: [process, mitre_execution]\n\n- list: k8s_client_binaries\n  items: [docker,
      kubectl, crictl]\n\n# Whitelist for known docker client binaries run inside container\n#
      - k8s.gcr.io/fluentd-gcp-scaler in GCP/GKE\n- macro: user_known_k8s_client_container\n
      \ condition: >\n    (k8s.ns.name=\"kube-system\" and container.image.repository=k8s.gcr.io/fluentd-gcp-scaler)
      or\n    container.image.repository=mcr.microsoft.com/aks/hcp/hcp-tunnel-front\n\n-
      macro: user_known_k8s_client_container_parens\n  condition: (user_known_k8s_client_container)\n\n-
      rule: The docker client is executed in a container\n  desc: Detect a k8s client
      tool executed inside a container\n  condition: spawned_process and container and
      not user_known_k8s_client_container_parens and proc.name in (k8s_client_binaries)\n
      \ output: \"Docker or kubernetes client executed in container (user=%user.name user_loginuid=%user.loginuid
      %container.info parent=%proc.pname cmdline=%proc.cmdline image=%container.image.repository:%container.image.tag)\"\n
      \ priority: WARNING\n  tags: [container, mitre_execution]\n\n\n# This rule is enabled
      by default. \n# If you want to disable it, modify the following macro.\n- macro:
      consider_packet_socket_communication\n  condition: (always_true)\n\n- list: user_known_packet_socket_binaries\n
      \ items: []\n\n- rule: Packet socket created in container\n  desc: Detect new packet
      socket at the device driver (OSI Layer 2) level in a container. Packet socket could
      be used for ARP Spoofing and privilege escalation(CVE-2020-14386) by attacker.\n
      \ condition: evt.type=socket and evt.arg[0]=AF_PACKET and consider_packet_socket_communication
      and container and not proc.name in (user_known_packet_socket_binaries)\n  output:
      Packet socket was created in a container (user=%user.name user_loginuid=%user.loginuid
      command=%proc.cmdline socket_info=%evt.args container_id=%container.id container_name=%container.name
      image=%container.image.repository:%container.image.tag)\n  priority: NOTICE\n  tags:
      [network, mitre_discovery]\n\n# Change to (always_true) to enable rule 'Network
      connection outside local subnet'\n- macro: enabled_rule_network_only_subnet\n  condition:
      (never_true)\n\n# Images that are allowed to have outbound traffic\n- list: images_allow_network_outside_subnet\n
      \ items: []\n\n# Namespaces where the rule is enforce\n- list: namespace_scope_network_only_subnet\n
      \ items: []\n\n- macro: network_local_subnet\n  condition: >\n    fd.rnet in (rfc_1918_addresses)
      or\n    fd.ip = \"<IP_ADDRESS>\" or\n    fd.net = \"<IP_ADDRESS>/8\"\n\n# # How to test:\n#
      # Change macro enabled_rule_network_only_subnet to condition: always_true\n# # Add
      'default' to namespace_scope_network_only_subnet\n# # Run:\n# kubectl run --generator=run-pod/v1
      -n default -i --tty busybox --image=busybox --rm -- wget google.com -O /var/google.html\n#
      # Check logs running\n\n- rule: Network Connection outside Local Subnet\n  desc:
      Detect traffic to image outside local subnet.\n  condition: >\n    enabled_rule_network_only_subnet
      and\n    inbound_outbound and\n    container and\n    not network_local_subnet and\n
      \   k8s.ns.name in (namespace_scope_network_only_subnet)\n  output: >\n    Network
      connection outside local subnet\n    (command=%proc.cmdline connection=%fd.name
      user=%user.name user_loginuid=%user.loginuid container_id=%container.id\n     image=%container.image.repository
      namespace=%k8s.ns.name\n     fd.rip.name=%fd.rip.name fd.lip.name=%fd.lip.name fd.cip.name=%fd.cip.name
      fd.sip.name=%fd.sip.name)\n  priority: WARNING\n  tags: [network]\n\n- macro: allowed_port\n
      \ condition: (never_true)\n\n- list: allowed_image\n  items: [] # add image to monitor,
      i.e.: bitnami/nginx\n\n- list: authorized_server_binaries\n  items: []  # add binary
      to allow, i.e.: nginx\n\n- list: authorized_server_port\n  items: [] # add port
      to allow, i.e.: 80\n\n# # How to test:\n# kubectl run --image=nginx nginx-app --port=80
      --env=\"DOMAIN=cluster\"\n# kubectl expose deployment nginx-app --port=80 --name=nginx-http
      --type=LoadBalancer\n# # On minikube:\n# minikube service nginx-http\n# # On general
      K8s:\n# kubectl get services\n# kubectl cluster-info\n# # Visit the Nginx service
      and port, should not fire.\n# # Change rule to different port, then different process
      name, and test again that it fires.\n\n- rule: Outbound or Inbound Traffic not to
      Authorized Server Process and Port\n  desc: Detect traffic that is not to authorized
      server process and port.\n  condition: >\n    allowed_port and\n    inbound_outbound
      and\n    container and\n    container.image.repository in (allowed_image) and\n
      \   not proc.name in (authorized_server_binary) and\n    not fd.sport in (authorized_server_port)\n
      \ output: >\n    Network connection outside authorized port and binary\n    (command=%proc.cmdline
      connection=%fd.name user=%user.name user_loginuid=%user.loginuid container_id=%container.id\n
      \   image=%container.image.repository)\n  priority: WARNING\n  tags: [network]\n\n-
      macro: user_known_stand_streams_redirect_activities\n  condition: (never_true)\n\n-
      rule: Redirect STDOUT/STDIN to Network Connection in Container\n  desc: Detect redirecting
      stdout/stdin to network connection in container (potential reverse shell).\n  condition:
      evt.type=dup and evt.dir=> and container and fd.num in (0, 1, 2) and fd.type in
      (\"ipv4\", \"ipv6\") and not user_known_stand_streams_redirect_activities\n  output:
      >\n    Redirect stdout/stdin to network connection (user=%user.name user_loginuid=%user.loginuid
      %container.info process=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty
      container_id=%container.id image=%container.image.repository fd.name=%fd.name fd.num=%fd.num
      fd.type=%fd.type fd.sip=%fd.sip)\n  priority: WARNING\n\n# The two Container Drift
      rules below will fire when a new executable is created in a container.\n# There
      are two ways to create executables - file is created with execution permissions
      or permissions change of existing file.\n# We will use a new sysdig filter, is_open_exec,
      to find all files creations with execution permission, and will trace all chmods
      in a container.\n# The use case we are targeting here is an attempt to execute code
      that was not shipped as part of a container (drift) -\n# an activity that might
      be malicious or non-compliant.\n# Two things to pay attention to:\n#   1) In most
      cases, 'docker cp' will not be identified, but the assumption is that if an attacker
      gained access to the container runtime daemon, they are already privileged\n#   2)
      Drift rules will be noisy in environments in which containers are built (e.g. docker
      build)\n# These two rules are not enabled by default. Use `never_true` in macro
      condition to enable them.\n\n- macro: user_known_container_drift_activities\n  condition:
      (always_true)\n\n- rule: Container Drift Detected (chmod)\n  desc: New executable
      created in a container due to chmod\n  condition: >\n    chmod and\n    consider_all_chmods
      and\n    container and\n    not runc_writing_exec_fifo and\n    not runc_writing_var_lib_docker
      and\n    not user_known_container_drift_activities and\n    evt.rawres>=0 and\n
      \   ((evt.arg.mode contains \"S_IXUSR\") or\n    (evt.arg.mode contains \"S_IXGRP\")
      or\n    (evt.arg.mode contains \"S_IXOTH\"))\n  output: Drift detected (chmod),
      new executable created in a container (user=%user.name user_loginuid=%user.loginuid
      command=%proc.cmdline filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode
      event=%evt.type)\n  priority: ERROR\n\n# ****************************************************************************\n#
      * \"Container Drift Detected (open+create)\" requires FALCO_ENGINE_VERSION 6 *\n#
      ****************************************************************************\n-
      rule: Container Drift Detected (open+create)\n  desc: New executable created in
      a container due to open+create\n  condition: >\n    evt.type in (open,openat,creat)
      and\n    evt.is_open_exec=true and\n    container and\n    not runc_writing_exec_fifo
      and\n    not runc_writing_var_lib_docker and\n    not user_known_container_drift_activities
      and\n    evt.rawres>=0\n  output: Drift detected (open+create), new executable created
      in a container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline
      filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode event=%evt.type)\n
      \ priority: ERROR\n\n\n# Application rules have moved to application_rules.yaml.
      Please look\n# there if you want to enable them by adding to\n# falco_rules.local.yaml.\n"
    k8s_audit_rules.yaml: "#\n# Copyright (C) 2019 The Falco Authors.\n#\n#\n# Licensed
      under the Apache License, Version 2.0 (the \"License\");\n# you may not use this
      file except in compliance with the License.\n# You may obtain a copy of the License
      at\n#\n#     http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by
      applicable law or agreed to in writing, software\n# distributed under the License
      is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY
      KIND, either express or implied.\n# See the License for the specific language governing
      permissions and\n# limitations under the License.\n#\n- required_engine_version:
      2\n\n# Like always_true/always_false, but works with k8s audit events\n- macro:
      k8s_audit_always_true\n  condition: (jevt.rawtime exists)\n\n- macro: k8s_audit_never_true\n
      \ condition: (jevt.rawtime=0)\n\n# Generally only consider audit events once the
      response has completed\n- list: k8s_audit_stages\n  items: [\"ResponseComplete\"]\n\n#
      Generally exclude users starting with \"system:\"\n- macro: non_system_user\n  condition:
      (not ka.user.name startswith \"system:\")\n\n# This macro selects the set of Audit
      Events used by the below rules.\n- macro: kevt\n  condition: (jevt.value[/stage]
      in (k8s_audit_stages))\n\n- macro: kevt_started\n  condition: (jevt.value[/stage]=ResponseStarted)\n\n#
      If you wish to restrict activity to a specific set of users, override/append to
      this list.\n# users created by kops are included\n- list: vertical_pod_autoscaler_users\n
      \ items: [\"vpa-recommender\", \"vpa-updater\"]\n\n- list: allowed_k8s_users\n  items:
      [\n    \"minikube\", \"minikube-user\", \"kubelet\", \"kops\", \"admin\", \"kube\",
      \"kube-proxy\", \"kube-apiserver-healthcheck\",\n    \"kubernetes-admin\",\n    vertical_pod_autoscaler_users,\n
      \   cluster-autoscaler,\n    \"system:addon-manager\"\n    ]\n\n- rule: Disallowed
      K8s User\n  desc: Detect any k8s operation by users outside of an allowed set of
      users.\n  condition: kevt and non_system_user and not ka.user.name in (allowed_k8s_users)\n
      \ output: K8s Operation performed by user not in allowed list of users (user=%ka.user.name
      target=%ka.target.name/%ka.target.resource verb=%ka.verb uri=%ka.uri resp=%ka.response.code)\n
      \ priority: WARNING\n  source: k8s_audit\n  tags: [k8s]\n\n# In a local/user rules
      file, you could override this macro to\n# explicitly enumerate the container images
      that you want to run in\n# your environment. In this main falco rules file, there
      isn't any way\n# to know all the containers that can run, so any container is\n#
      allowed, by using the always_true macro. In the overridden macro, the condition\n#
      would look something like (ka.req.pod.containers.image.repository in (my-repo/my-image))\n-
      macro: allowed_k8s_containers\n  condition: (k8s_audit_always_true)\n\n- macro:
      response_successful\n  condition: (ka.response.code startswith 2)\n\n- macro: kcreate\n
      \ condition: ka.verb=create\n\n- macro: kmodify\n  condition: (ka.verb in (create,update,patch))\n\n-
      macro: kdelete\n  condition: ka.verb=delete\n\n- macro: pod\n  condition: ka.target.resource=pods
      and not ka.target.subresource exists\n\n- macro: pod_subresource\n  condition: ka.target.resource=pods
      and ka.target.subresource exists\n\n- macro: deployment\n  condition: ka.target.resource=deployments\n\n-
      macro: service\n  condition: ka.target.resource=services\n\n- macro: configmap\n
      \ condition: ka.target.resource=configmaps\n\n- macro: namespace\n  condition: ka.target.resource=namespaces\n\n-
      macro: serviceaccount\n  condition: ka.target.resource=serviceaccounts\n\n- macro:
      clusterrole\n  condition: ka.target.resource=clusterroles\n\n- macro: clusterrolebinding\n
      \ condition: ka.target.resource=clusterrolebindings\n\n- macro: role\n  condition:
      ka.target.resource=roles\n\n- macro: secret\n  condition: ka.target.resource=secrets\n\n-
      macro: health_endpoint\n  condition: ka.uri=/healthz\n\n- rule: Create Disallowed
      Pod\n  desc: >\n    Detect an attempt to start a pod with a container image outside
      of a list of allowed images.\n  condition: kevt and pod and kcreate and not allowed_k8s_containers\n
      \ output: Pod started with container not in allowed list (user=%ka.user.name pod=%ka.resp.name
      ns=%ka.target.namespace images=%ka.req.pod.containers.image)\n  priority: WARNING\n
      \ source: k8s_audit\n  tags: [k8s]\n\n- rule: Create Privileged Pod\n  desc: >\n
      \   Detect an attempt to start a pod with a privileged container\n  condition: kevt
      and pod and kcreate and ka.req.pod.containers.privileged intersects (true) and not
      ka.req.pod.containers.image.repository in (falco_privileged_images)\n  output: Pod
      started with privileged container (user=%ka.user.name pod=%ka.resp.name ns=%ka.target.namespace
      images=%ka.req.pod.containers.image)\n  priority: WARNING\n  source: k8s_audit\n
      \ tags: [k8s]\n\n- macro: sensitive_vol_mount\n  condition: >\n    (ka.req.pod.volumes.hostpath
      intersects (/proc, /var/run/docker.sock, /, /etc, /root, /var/run/crio/crio.sock,
      /home/admin, /var/lib/kubelet, /var/lib/kubelet/pki, /etc/kubernetes, /etc/kubernetes/manifests))\n\n-
      rule: Create Sensitive Mount Pod\n  desc: >\n    Detect an attempt to start a pod
      with a volume from a sensitive host directory (i.e. /proc).\n    Exceptions are
      made for known trusted images.\n  condition: kevt and pod and kcreate and sensitive_vol_mount
      and not ka.req.pod.containers.image.repository in (falco_sensitive_mount_images)\n
      \ output: Pod started with sensitive mount (user=%ka.user.name pod=%ka.resp.name
      ns=%ka.target.namespace images=%ka.req.pod.containers.image volumes=%jevt.value[/requestObject/spec/volumes])\n
      \ priority: WARNING\n  source: k8s_audit\n  tags: [k8s]\n\n# Corresponds to K8s
      CIS Benchmark 1.7.4\n- rule: Create HostNetwork Pod\n  desc: Detect an attempt to
      start a pod using the host network.\n  condition: kevt and pod and kcreate and ka.req.pod.host_network
      intersects (true) and not ka.req.pod.containers.image.repository in (falco_hostnetwork_images)\n
      \ output: Pod started using host network (user=%ka.user.name pod=%ka.resp.name ns=%ka.target.namespace
      images=%ka.req.pod.containers.image)\n  priority: WARNING\n  source: k8s_audit\n
      \ tags: [k8s]\n\n- macro: user_known_node_port_service\n  condition: (k8s_audit_never_true)\n\n-
      rule: Create NodePort Service\n  desc: >\n    Detect an attempt to start a service
      with a NodePort service type\n  condition: kevt and service and kcreate and ka.req.service.type=NodePort
      and not user_known_node_port_service\n  output: NodePort Service Created (user=%ka.user.name
      service=%ka.target.name ns=%ka.target.namespace ports=%ka.req.service.ports)\n  priority:
      WARNING\n  source: k8s_audit\n  tags: [k8s]\n\n- macro: contains_private_credentials\n
      \ condition: >\n    (ka.req.configmap.obj contains \"aws_access_key_id\" or\n     ka.req.configmap.obj
      contains \"aws-access-key-id\" or\n     ka.req.configmap.obj contains \"aws_s3_access_key_id\"
      or\n     ka.req.configmap.obj contains \"aws-s3-access-key-id\" or\n     ka.req.configmap.obj
      contains \"password\" or\n     ka.req.configmap.obj contains \"passphrase\")\n\n-
      rule: Create/Modify Configmap With Private Credentials\n  desc: >\n     Detect creating/modifying
      a configmap containing a private credential (aws key, password, etc.)\n  condition:
      kevt and configmap and kmodify and contains_private_credentials\n  output: K8s configmap
      with private credential (user=%ka.user.name verb=%ka.verb configmap=%ka.req.configmap.name
      config=%ka.req.configmap.obj)\n  priority: WARNING\n  source: k8s_audit\n  tags:
      [k8s]\n\n# Corresponds to K8s CIS Benchmark, 1.1.1.\n- rule: Anonymous Request Allowed\n
      \ desc: >\n    Detect any request made by the anonymous user that was allowed\n
      \ condition: kevt and ka.user.name=system:anonymous and ka.auth.decision=\"allow\"
      and not health_endpoint\n  output: Request by anonymous user allowed (user=%ka.user.name
      verb=%ka.verb uri=%ka.uri reason=%ka.auth.reason))\n  priority: WARNING\n  source:
      k8s_audit\n  tags: [k8s]\n\n# Roughly corresponds to K8s CIS Benchmark, 1.1.12.
      In this case,\n# notifies an attempt to exec/attach to a privileged container.\n\n#
      Ideally, we'd add a more stringent rule that detects attaches/execs\n# to a privileged
      pod, but that requires the engine for k8s audit\n# events to be stateful, so it
      could know if a container named in an\n# attach request was created privileged or
      not. For now, we have a\n# less severe rule that detects attaches/execs to any pod.\n\n-
      macro: user_known_exec_pod_activities\n  condition: (k8s_audit_never_true)\n\n-
      rule: Attach/Exec Pod\n  desc: >\n    Detect any attempt to attach/exec to a pod\n
      \ condition: kevt_started and pod_subresource and kcreate and ka.target.subresource
      in (exec,attach) and not user_known_exec_pod_activities\n  output: Attach/Exec to
      pod (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace action=%ka.target.subresource
      command=%ka.uri.param[command])\n  priority: NOTICE\n  source: k8s_audit\n  tags:
      [k8s]\n\n- macro: user_known_pod_debug_activities\n  condition: (k8s_audit_never_true)\n\n#
      Only works when feature gate EphemeralContainers is enabled\n- rule: EphemeralContainers
      Created\n  desc: >\n    Detect any ephemeral container created\n  condition: kevt
      and pod_subresource and kmodify and ka.target.subresource in (ephemeralcontainers)
      and not user_known_pod_debug_activities\n  output: Ephemeral container is created
      in pod (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace ephemeral_container_name=%jevt.value[/requestObject/ephemeralContainers/0/name]
      ephemeral_container_image=%jevt.value[/requestObject/ephemeralContainers/0/image])\n
      \ priority: NOTICE\n  source: k8s_audit\n  tags: [k8s]\n\n# In a local/user rules
      fie, you can append to this list to add additional allowed namespaces\n- list: allowed_namespaces\n
      \ items: [kube-system, kube-public, default]\n\n- rule: Create Disallowed Namespace\n
      \ desc: Detect any attempt to create a namespace outside of a set of known namespaces\n
      \ condition: kevt and namespace and kcreate and not ka.target.name in (allowed_namespaces)\n
      \ output: Disallowed namespace created (user=%ka.user.name ns=%ka.target.name)\n
      \ priority: WARNING\n  source: k8s_audit\n  tags: [k8s]\n\n# Only defined for backwards
      compatibility. Use the more specific\n# user_allowed_kube_namespace_image_list instead.\n-
      list: user_trusted_image_list\n  items: []\n\n- list: user_allowed_kube_namespace_image_list\n
      \ items: [user_trusted_image_list]\n\n# Only defined for backwards compatibility.
      Use the more specific\n# allowed_kube_namespace_image_list instead.\n- list: k8s_image_list\n
      \ items: []\n\n- list: allowed_kube_namespace_image_list\n  items: [\n    gcr.io/google-containers/prometheus-to-sd,\n
      \   gcr.io/projectcalico-org/node,\n    gke.gcr.io/addon-resizer,\n    gke.gcr.io/heapster,\n
      \   gke.gcr.io/gke-metadata-server,\n    k8s.gcr.io/ip-masq-agent-amd64,\n    k8s.gcr.io/kube-apiserver,\n
      \   gke.gcr.io/kube-proxy,\n    gke.gcr.io/netd-amd64,\n    k8s.gcr.io/addon-resizer\n
      \   k8s.gcr.io/prometheus-to-sd,\n    k8s.gcr.io/k8s-dns-dnsmasq-nanny-amd64,\n
      \   k8s.gcr.io/k8s-dns-kube-dns-amd64,\n    k8s.gcr.io/k8s-dns-sidecar-amd64,\n
      \   k8s.gcr.io/metrics-server-amd64,\n    kope/kube-apiserver-healthcheck,\n    k8s_image_list\n
      \   ]\n\n- macro: allowed_kube_namespace_pods\n  condition: (ka.req.pod.containers.image.repository
      in (user_allowed_kube_namespace_image_list) or\n              ka.req.pod.containers.image.repository
      in (allowed_kube_namespace_image_list))\n\n# Detect any new pod created in the kube-system
      namespace\n- rule: Pod Created in Kube Namespace\n  desc: Detect any attempt to
      create a pod in the kube-system or kube-public namespaces\n  condition: kevt and
      pod and kcreate and ka.target.namespace in (kube-system, kube-public) and not allowed_kube_namespace_pods\n
      \ output: Pod created in kube namespace (user=%ka.user.name pod=%ka.resp.name ns=%ka.target.namespace
      images=%ka.req.pod.containers.image)\n  priority: WARNING\n  source: k8s_audit\n
      \ tags: [k8s]\n\n- list: user_known_sa_list\n  items: []\n\n- macro: trusted_sa\n
      \ condition: (ka.target.name in (user_known_sa_list))\n\n# Detect creating a service
      account in the kube-system/kube-public namespace\n- rule: Service Account Created
      in Kube Namespace\n  desc: Detect any attempt to create a serviceaccount in the
      kube-system or kube-public namespaces\n  condition: kevt and serviceaccount and
      kcreate and ka.target.namespace in (kube-system, kube-public) and response_successful
      and not trusted_sa\n  output: Service account created in kube namespace (user=%ka.user.name
      serviceaccount=%ka.target.name ns=%ka.target.namespace)\n  priority: WARNING\n  source:
      k8s_audit\n  tags: [k8s]\n\n# Detect any modify/delete to any ClusterRole starting
      with\n# \"system:\". \"system:coredns\" is excluded as changes are expected in\n#
      normal operation.\n- rule: System ClusterRole Modified/Deleted\n  desc: Detect any
      attempt to modify/delete a ClusterRole/Role starting with system\n  condition: kevt
      and (role or clusterrole) and (kmodify or kdelete) and (ka.target.name startswith
      \"system:\") and\n             not ka.target.name in (system:coredns, system:managed-certificate-controller)\n
      \ output: System ClusterRole/Role modified or deleted (user=%ka.user.name role=%ka.target.name
      ns=%ka.target.namespace action=%ka.verb)\n  priority: WARNING\n  source: k8s_audit\n
      \ tags: [k8s]\n\n# Detect any attempt to create a ClusterRoleBinding to the cluster-admin
      user\n# (exapand this to any built-in cluster role that does \"sensitive\" things)\n-
      rule: Attach to cluster-admin Role\n  desc: Detect any attempt to create a ClusterRoleBinding
      to the cluster-admin user\n  condition: kevt and clusterrolebinding and kcreate
      and ka.req.binding.role=cluster-admin\n  output: Cluster Role Binding to cluster-admin
      role (user=%ka.user.name subject=%ka.req.binding.subjects)\n  priority: WARNING\n
      \ source: k8s_audit\n  tags: [k8s]\n\n- rule: ClusterRole With Wildcard Created\n
      \ desc: Detect any attempt to create a Role/ClusterRole with wildcard resources
      or verbs\n  condition: kevt and (role or clusterrole) and kcreate and (ka.req.role.rules.resources
      intersects (\"*\") or ka.req.role.rules.verbs intersects (\"*\"))\n  output: Created
      Role/ClusterRole with wildcard (user=%ka.user.name role=%ka.target.name rules=%ka.req.role.rules)\n
      \ priority: WARNING\n  source: k8s_audit\n  tags: [k8s]\n\n- macro: writable_verbs\n
      \ condition: >\n    (ka.req.role.rules.verbs intersects (create, update, patch,
      delete, deletecollection))\n\n- rule: ClusterRole With Write Privileges Created\n
      \ desc: Detect any attempt to create a Role/ClusterRole that can perform write-related
      actions\n  condition: kevt and (role or clusterrole) and kcreate and writable_verbs\n
      \ output: Created Role/ClusterRole with write privileges (user=%ka.user.name role=%ka.target.name
      rules=%ka.req.role.rules)\n  priority: NOTICE\n  source: k8s_audit\n  tags: [k8s]\n\n-
      rule: ClusterRole With Pod Exec Created\n  desc: Detect any attempt to create a
      Role/ClusterRole that can exec to pods\n  condition: kevt and (role or clusterrole)
      and kcreate and ka.req.role.rules.resources intersects (\"pods/exec\")\n  output:
      Created Role/ClusterRole with pod exec privileges (user=%ka.user.name role=%ka.target.name
      rules=%ka.req.role.rules)\n  priority: WARNING\n  source: k8s_audit\n  tags: [k8s]\n\n#
      The rules below this point are less discriminatory and generally\n# represent a
      stream of activity for a cluster. If you wish to disable\n# these events, modify
      the following macro.\n- macro: consider_activity_events\n  condition: (k8s_audit_always_true)\n\n-
      macro: kactivity\n  condition: (kevt and consider_activity_events)\n\n- rule: K8s
      Deployment Created\n  desc: Detect any attempt to create a deployment\n  condition:
      (kactivity and kcreate and deployment and response_successful)\n  output: K8s Deployment
      Created (user=%ka.user.name deployment=%ka.target.name ns=%ka.target.namespace resp=%ka.response.code
      decision=%ka.auth.decision reason=%ka.auth.reason)\n  priority: INFO\n  source:
      k8s_audit\n  tags: [k8s]\n\n- rule: K8s Deployment Deleted\n  desc: Detect any attempt
      to delete a deployment\n  condition: (kactivity and kdelete and deployment and response_successful)\n
      \ output: K8s Deployment Deleted (user=%ka.user.name deployment=%ka.target.name
      ns=%ka.target.namespace resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason)\n
      \ priority: INFO\n  source: k8s_audit\n  tags: [k8s]\n\n- rule: K8s Service Created\n
      \ desc: Detect any attempt to create a service\n  condition: (kactivity and kcreate
      and service and response_successful)\n  output: K8s Service Created (user=%ka.user.name
      service=%ka.target.name ns=%ka.target.namespace resp=%ka.response.code decision=%ka.auth.decision
      reason=%ka.auth.reason)\n  priority: INFO\n  source: k8s_audit\n  tags: [k8s]\n\n-
      rule: K8s Service Deleted\n  desc: Detect any attempt to delete a service\n  condition:
      (kactivity and kdelete and service and response_successful)\n  output: K8s Service
      Deleted (user=%ka.user.name service=%ka.target.name ns=%ka.target.namespace resp=%ka.response.code
      decision=%ka.auth.decision reason=%ka.auth.reason)\n  priority: INFO\n  source:
      k8s_audit\n  tags: [k8s]\n\n- rule: K8s ConfigMap Created\n  desc: Detect any attempt
      to create a configmap\n  condition: (kactivity and kcreate and configmap and response_successful)\n
      \ output: K8s ConfigMap Created (user=%ka.user.name configmap=%ka.target.name ns=%ka.target.namespace
      resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason)\n  priority:
      INFO\n  source: k8s_audit\n  tags: [k8s]\n\n- rule: K8s ConfigMap Deleted\n  desc:
      Detect any attempt to delete a configmap\n  condition: (kactivity and kdelete and
      configmap and response_successful)\n  output: K8s ConfigMap Deleted (user=%ka.user.name
      configmap=%ka.target.name ns=%ka.target.namespace resp=%ka.response.code decision=%ka.auth.decision
      reason=%ka.auth.reason)\n  priority: INFO\n  source: k8s_audit\n  tags: [k8s]\n\n-
      rule: K8s Namespace Created\n  desc: Detect any attempt to create a namespace\n
      \ condition: (kactivity and kcreate and namespace and response_successful)\n  output:
      K8s Namespace Created (user=%ka.user.name namespace=%ka.target.name resp=%ka.response.code
      decision=%ka.auth.decision reason=%ka.auth.reason)\n  priority: INFO\n  source:
      k8s_audit\n  tags: [k8s]\n\n- rule: K8s Namespace Deleted\n  desc: Detect any attempt
      to delete a namespace\n  condition: (kactivity and non_system_user and kdelete and
      namespace and response_successful)\n  output: K8s Namespace Deleted (user=%ka.user.name
      namespace=%ka.target.name resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason)\n
      \ priority: INFO\n  source: k8s_audit\n  tags: [k8s]\n\n- rule: K8s Serviceaccount
      Created\n  desc: Detect any attempt to create a service account\n  condition: (kactivity
      and kcreate and serviceaccount and response_successful)\n  output: K8s Serviceaccount
      Created (user=%ka.user.name user=%ka.target.name ns=%ka.target.namespace resp=%ka.response.code
      decision=%ka.auth.decision reason=%ka.auth.reason)\n  priority: INFO\n  source:
      k8s_audit\n  tags: [k8s]\n\n- rule: K8s Serviceaccount Deleted\n  desc: Detect any
      attempt to delete a service account\n  condition: (kactivity and kdelete and serviceaccount
      and response_successful)\n  output: K8s Serviceaccount Deleted (user=%ka.user.name
      user=%ka.target.name ns=%ka.target.namespace resp=%ka.response.code decision=%ka.auth.decision
      reason=%ka.auth.reason)\n  priority: INFO\n  source: k8s_audit\n  tags: [k8s]\n\n-
      rule: K8s Role/Clusterrole Created\n  desc: Detect any attempt to create a cluster
      role/role\n  condition: (kactivity and kcreate and (clusterrole or role) and response_successful)\n
      \ output: K8s Cluster Role Created (user=%ka.user.name role=%ka.target.name rules=%ka.req.role.rules
      resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason)\n  priority:
      INFO\n  source: k8s_audit\n  tags: [k8s]\n\n- rule: K8s Role/Clusterrole Deleted\n
      \ desc: Detect any attempt to delete a cluster role/role\n  condition: (kactivity
      and kdelete and (clusterrole or role) and response_successful)\n  output: K8s Cluster
      Role Deleted (user=%ka.user.name role=%ka.target.name resp=%ka.response.code decision=%ka.auth.decision
      reason=%ka.auth.reason)\n  priority: INFO\n  source: k8s_audit\n  tags: [k8s]\n\n-
      rule: K8s Role/Clusterrolebinding Created\n  desc: Detect any attempt to create
      a clusterrolebinding\n  condition: (kactivity and kcreate and clusterrolebinding
      and response_successful)\n  output: K8s Cluster Role Binding Created (user=%ka.user.name
      binding=%ka.target.name subjects=%ka.req.binding.subjects role=%ka.req.binding.role
      resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason)\n  priority:
      INFO\n  source: k8s_audit\n  tags: [k8s]\n\n- rule: K8s Role/Clusterrolebinding
      Deleted\n  desc: Detect any attempt to delete a clusterrolebinding\n  condition:
      (kactivity and kdelete and clusterrolebinding and response_successful)\n  output:
      K8s Cluster Role Binding Deleted (user=%ka.user.name binding=%ka.target.name resp=%ka.response.code
      decision=%ka.auth.decision reason=%ka.auth.reason)\n  priority: INFO\n  source:
      k8s_audit\n  tags: [k8s]\n\n- rule: K8s Secret Created\n  desc: Detect any attempt
      to create a secret. Service account tokens are excluded.\n  condition: (kactivity
      and kcreate and secret and ka.target.namespace!=kube-system and non_system_user
      and response_successful)\n  output: K8s Secret Created (user=%ka.user.name secret=%ka.target.name
      ns=%ka.target.namespace resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason)\n
      \ priority: INFO\n  source: k8s_audit\n  tags: [k8s]\n\n- rule: K8s Secret Deleted\n
      \ desc: Detect any attempt to delete a secret Service account tokens are excluded.\n
      \ condition: (kactivity and kdelete and secret and ka.target.namespace!=kube-system
      and non_system_user and response_successful)\n  output: K8s Secret Deleted (user=%ka.user.name
      secret=%ka.target.name ns=%ka.target.namespace resp=%ka.response.code decision=%ka.auth.decision
      reason=%ka.auth.reason)\n  priority: INFO\n  source: k8s_audit\n  tags: [k8s]\n\n#
      This rule generally matches all events, and as a result is disabled\n# by default.
      If you wish to enable these events, modify the\n# following macro.\n#  condition:
      (jevt.rawtime exists)\n- macro: consider_all_events\n  condition: (k8s_audit_never_true)\n\n-
      macro: kall\n  condition: (kevt and consider_all_events)\n\n- rule: All K8s Audit
      Events\n  desc: Match all K8s Audit Events\n  condition: kall\n  output: K8s Audit
      Event received (user=%ka.user.name verb=%ka.verb uri=%ka.uri obj=%jevt.obj)\n  priority:
      DEBUG\n  source: k8s_audit\n  tags: [k8s]\n\n\n# This macro disables following rule,
      change to k8s_audit_never_true to enable it\n- macro: allowed_full_admin_users\n
      \ condition: (k8s_audit_always_true)\n\n# This list includes some of the default
      user names for an administrator in several K8s installations\n- list: full_admin_k8s_users\n
      \ items: [\"admin\", \"kubernetes-admin\",  \"kubernetes-admin@kubernetes\", <EMAIL_ADDRESS>      \"minikube-user\"]\n\n# This rules detect an operation triggered by an user name
      that is \n# included in the list of those that are default administrators upon \n#
      cluster creation. This may signify a permission setting too broader. \n# As we can't
      check for role of the user on a general ka.* event, this \n# may or may not be an
      administrator. Customize the full_admin_k8s_users \n# list to your needs, and activate
      at your discrection.\n\n# # How to test:\n# # Execute any kubectl command connected
      using default cluster user, as:\n# kubectl create namespace rule-test\n\n- rule:
      Full K8s Administrative Access\n  desc: Detect any k8s operation by a user name
      that may be an administrator with full access.\n  condition: >\n    kevt \n    and
      non_system_user \n    and ka.user.name in (admin_k8s_users) \n    and not allowed_full_admin_users\n
      \ output: K8s Operation performed by full admin user (user=%ka.user.name target=%ka.target.name/%ka.target.resource
      verb=%ka.verb uri=%ka.uri resp=%ka.response.code)\n  priority: WARNING\n  source:
      k8s_audit\n  tags: [k8s]\n\n- macro: ingress\n  condition: ka.target.resource=ingresses\n\n-
      macro: ingress_tls\n  condition: (jevt.value[/requestObject/spec/tls] exists)\n\n#
      # How to test:\n# # Create an ingress.yaml file with content:\n# apiVersion: networking.k8s.io/v1beta1\n#
      kind: Ingress\n# metadata:\n#   name: test-ingress\n#   annotations:\n#     nginx.ingress.kubernetes.io/rewrite-target:
      /\n# spec:\n#   rules:\n#   - http:\n#       paths:\n#       - path: /testpath\n#
      \        backend:\n#           serviceName: test\n#           servicePort: 80\n#
      # Execute: kubectl apply -f ingress.yaml\n\n- rule: Ingress Object without TLS Certificate
      Created\n  desc: Detect any attempt to create an ingress without TLS certification.\n
      \ condition: >\n    (kactivity and kcreate and ingress and response_successful and
      not ingress_tls)\n  output: >\n    K8s Ingress Without TLS Cert Created (user=%ka.user.name
      ingress=%ka.target.name\n    namespace=%ka.target.namespace)\n  source: k8s_audit
      \   \n  priority: WARNING\n  tags: [k8s, network]\n\n- macro: node\n  condition:
      ka.target.resource=nodes\n\n- macro: allow_all_k8s_nodes\n  condition: (k8s_audit_always_true)\n\n-
      list: allowed_k8s_nodes\n  items: []\n\n# # How to test:\n# # Create a Falco monitored
      cluster with Kops\n# # Increase the number of minimum nodes with:\n# kops edit ig
      nodes\n# kops apply --yes\n\n- rule: Untrusted Node Successfully Joined the Cluster\n
      \ desc: >\n    Detect a node successfully joined the cluster outside of the list
      of allowed nodes.\n  condition: >\n    kevt and node \n    and kcreate \n    and
      response_successful \n    and not allow_all_k8s_nodes \n    and not ka.target.name
      in (allowed_k8s_nodes)\n  output: Node not in allowed list successfully joined the
      cluster (user=%ka.user.name node=%ka.target.name)\n  priority: ERROR\n  source:
      k8s_audit\n  tags: [k8s]\n\n- rule: Untrusted Node Unsuccessfully Tried to Join
      the Cluster\n  desc: >\n    Detect an unsuccessful attempt to join the cluster for
      a node not in the list of allowed nodes.\n  condition: >\n    kevt and node \n    and
      kcreate \n    and not response_successful \n    and not allow_all_k8s_nodes \n    and
      not ka.target.name in (allowed_k8s_nodes)\n  output: Node not in allowed list tried
      unsuccessfully to join the cluster  (user=%ka.user.name node=%ka.target.name reason=%ka.response.reason)\n
      \ priority: WARNING\n  source: k8s_audit\n  tags: [k8s]\n\n"
falco, falco, ClusterRole (rbac.authorization.k8s.io) has changed:
  # Source: falco/templates/clusterrole.yaml
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: falco
    labels:
      app: falco
-     chart: "falco-1.5.8"
+     chart: "falco-1.6.0"
      release: "falco"
      heritage: "Helm"
  rules:
    - apiGroups:
        - extensions
        - ""
      resources:
        - nodes
        - namespaces
        - pods
        - replicationcontrollers
        - replicasets
        - services
        - daemonsets
        - deployments
        - events
        - configmaps
      verbs:
        - get
        - list
        - watch
    - apiGroups:
        - apps
      resources:
        - daemonsets
        - deployments
        - replicasets
        - statefulsets
      verbs:
        - get
        - list
        - watch
    - nonResourceURLs:
        - /healthz
        - /healthz/*
      verbs:
        - get
falco, falco, ClusterRoleBinding (rbac.authorization.k8s.io) has changed:
  # Source: falco/templates/clusterrolebinding.yaml
  kind: ClusterRoleBinding
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: falco
    labels:
      app: falco
-     chart: "falco-1.5.8"
+     chart: "falco-1.6.0"
      release: "falco"
      heritage: "Helm"
  subjects:
    - kind: ServiceAccount
      name: falco
      namespace: falco
  roleRef:
    kind: ClusterRole
    name: falco
    apiGroup: rbac.authorization.k8s.io
falco, falco, DaemonSet (apps) has changed:
  # Source: falco/templates/daemonset.yaml
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: falco
    namespace: falco
    labels:
      app: falco
-     chart: "falco-1.5.8"
+     chart: "falco-1.6.0"
      release: "falco"
      heritage: "Helm"
  spec:
    selector:
      matchLabels:
        app: falco
        role: security
    template:
      metadata:
        name: falco
        labels:
          app: falco
          role: security
        annotations:
-         checksum/config: 15ae8cb74ef522302712a632601a625588d569690bfc0525d93c3ebb0f5f708b
-         checksum/rules: 14977e19723da3d82caddb84f1cb806a61c1f329148705428c740486c3c04e12
+         checksum/config: 74564d810353b314661fe17bfb915fe056d874f64f8a3b857e88a848fef6f1fb
+         checksum/rules: c8a8632f8c0aecfdb368149f829e6e5a57d3c16ec9c0fa5b74875f65259ed7be
          checksum/certs: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
      spec:
        serviceAccountName: falco
        tolerations:
          - effect: NoSchedule
            key: node-role.kubernetes.io/master
        containers:
          - name: falco
            image: docker.io/falcosecurity/falco:0.26.2
            imagePullPolicy: IfNotPresent
            resources:
              limits:
                cpu: 200m
                memory: 1024Mi
              requests:
                cpu: 100m
                memory: 512Mi
            securityContext:
              privileged: true
            args:
              - /usr/bin/falco
              - --cri
              - /run/containerd/containerd.sock
              - -K
              - /var/run/secrets/kubernetes.io/serviceaccount/token
              - -k
              - "https://$(KUBERNETES_SERVICE_HOST)"
              - -pk
            env:
            volumeMounts:
              - mountPath: /host/var/run/docker.sock
                name: docker-socket
              - mountPath: /host/run/containerd/containerd.sock
                name: containerd-socket
              - mountPath: /host/dev
                name: dev-fs
                readOnly: true
              - mountPath: /host/proc
                name: proc-fs
                readOnly: true
              - mountPath: /host/boot
                name: boot-fs
                readOnly: true
              - mountPath: /host/lib/modules
                name: lib-modules
              - mountPath: /host/usr
                name: usr-fs
                readOnly: true
-             - mountPath: /dev/shm
-               name: dshm
              - mountPath: /host/etc
                name: etc-fs
                readOnly: true
              - mountPath: /etc/falco
                name: config-volume
              - mountPath: /etc/falco/rules.d
                name: rules-volume
        volumes:
-         - name: dshm
-           emptyDir:
-             medium: Memory
          - name: docker-socket
            hostPath:
              path: /var/run/docker.sock
          - name: containerd-socket
            hostPath:
              path: /run/containerd/containerd.sock
          - name: dev-fs
            hostPath:
              path: /dev
          - name: proc-fs
            hostPath:
              path: /proc
          - name: boot-fs
            hostPath:
              path: /boot
          - name: lib-modules
            hostPath:
              path: /lib/modules
          - name: usr-fs
            hostPath:
              path: /usr
          - name: etc-fs
            hostPath:
              path: /etc
          - name: config-volume
            configMap:
              name: falco
              items:
                - key: falco.yaml
                  path: falco.yaml
                - key: falco_rules.yaml
                  path: falco_rules.yaml
                - key: falco_rules.local.yaml
                  path: falco_rules.local.yaml
                - key: application_rules.yaml
                  path: rules.available/application_rules.yaml
          - name: rules-volume
            configMap:
              name: falco-rules
    updateStrategy:
      type: RollingUpdate

grafana, grafana, Secret (v1) has changed:
+ Changes suppressed on sensitive content of type Secret
grafana, grafana, StatefulSet (apps) has changed:
  # Source: grafana/templates/statefulset.yaml
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: grafana
    namespace: grafana
    labels:
      helm.sh/chart: grafana-6.1.17
      app.kubernetes.io/name: grafana
      app.kubernetes.io/instance: grafana
      app.kubernetes.io/version: "7.3.5"
      app.kubernetes.io/managed-by: Helm
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/name: grafana
        app.kubernetes.io/instance: grafana
    serviceName: grafana-headless
    template:
      metadata:
        labels:
          app.kubernetes.io/name: grafana
          app.kubernetes.io/instance: grafana
        annotations:
          checksum/config: c99be678052b197b06dd051e3653dcee9b5cc6d3d6376246fd10a3dcc165dabe
          checksum/dashboards-json-config: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
          checksum/sc-dashboard-provider-config: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-         checksum/secret: f032fa052a7dd3b0815f1177e3ba27fb429c1dd380bfb7464972dfefbcdef004
+         checksum/secret: 98ffbd75346fb7b922323d8462a54c417878567c4fa479741eab73f42d6b7765
      spec:

        serviceAccountName: grafana
        securityContext:
          fsGroup: 472
          runAsGroup: 472
          runAsUser: 472
        initContainers:
          - name: init-chown-data
            image: "busybox:1.31.1"
            imagePullPolicy: IfNotPresent
            securityContext:
              runAsNonRoot: false
              runAsUser: 0
            command: ["chown", "-R", "472:472", "/var/lib/grafana"]
            resources:
              {}
            volumeMounts:
              - name: storage
                mountPath: "/var/lib/grafana"
        containers:
          - name: grafana
            image: "grafana/grafana:7.3.5"
            imagePullPolicy: IfNotPresent
            volumeMounts:
              - name: config
                mountPath: "/etc/grafana/grafana.ini"
                subPath: grafana.ini
              - name: ldap
                mountPath: "/etc/grafana/ldap.toml"
                subPath: ldap.toml
              - name: storage
                mountPath: "/var/lib/grafana"
              - name: config
                mountPath: "/etc/grafana/provisioning/datasources/datasources.yaml"
                subPath: datasources.yaml
            ports:
              - name: service
                containerPort: 80
                protocol: TCP
              - name: grafana
                containerPort: 3000
                protocol: TCP
            env:
              - name: GF_SECURITY_ADMIN_USER
                valueFrom:
                  secretKeyRef:
                    name: grafana
                    key: admin-user
              - name: GF_SECURITY_ADMIN_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: grafana
                    key: admin-password

            livenessProbe:
              failureThreshold: 10
              httpGet:
                path: /api/health
                port: 3000
              initialDelaySeconds: 60
              timeoutSeconds: 30
            readinessProbe:
              httpGet:
                path: /api/health
                port: 3000
            resources:
              limits:
                cpu: 200m
                memory: 256Mi
              requests:
                cpu: 100m
                memory: 128Mi
        volumes:
          - name: config
            configMap:
              name: grafana
          - name: ldap
            secret:
              secretName: grafana
              items:
                - key: ldap-toml
                  path: ldap.toml
        # nothing
    volumeClaimTemplates:
    - metadata:
        name: storage
      spec:
        accessModes: [ReadWriteOnce]
        storageClassName:
        resources:
          requests:
            storage: 50

jenkins-infra, jenkins-infra, Secret (v1) has changed:
+ Changes suppressed on sensitive content of type Secret
jenkins-infra, jenkins-infra-jenkins-config-credentials, ConfigMap (v1) has changed:
  # Source: jenkins/charts/jenkins/templates/jcasc-config.yaml
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: jenkins-infra-jenkins-config-credentials
    namespace: jenkins-infra
    labels:
      "app.kubernetes.io/name": jenkins
      "helm.sh/chart": "jenkins-2.19.0"
      "app.kubernetes.io/managed-by": "Helm"
      "app.kubernetes.io/instance": "jenkins-infra"
      "app.kubernetes.io/component": "jenkins-master"
      jenkins-infra-jenkins-config: "true"
  data:
    credentials.yaml: |-
      credentials:
        system:
          domainCredentials:
            - credentials:
-             - usernamePassword:
-                 description: "GitHub access token for jenkinsadmin"
-                 id: "github-access-token"
-                 username: "${GITHUB_USERNAME}"
-                 password: "${GITHUB_PASSWORD}"
-                 scope: GLOBAL
+             - gitHubApp:
+                 appID: "${GITHUB_APP_ID}"
+                 description: "GitHub App for infra.ci.jenkins.io"
+                 id: "github-app-infra"
+                 privateKey: "${GITHUB_APP_PRIVATE_KEY}"
              - string:
                  scope: GLOBAL
                  id: "updatecli-github-token"
                  secret: '${UPDATECLI_GITHUB_TOKEN}'
                  description: Github Token used by updatecli to update version
              - string:
                  scope: GLOBAL
                  id: "sops-client-id"
                  secret: "${SOPS_CLIENT_ID}"
                  description: Azure client ID used by sops to decrypt secrets
              - string:
                  scope: GLOBAL
                  id: "sops-client-secret"
                  secret: "${SOPS_CLIENT_SECRET}"
                  description: Azure client secret used by sops to decrypt secrets
              - string:
                  scope: GLOBAL
                  id: "PLUGINSITE_STORAGEACCOUNTKEY"
                  secret: "${PLUGINSITE_STORAGEACCOUNTKEY}"
                  description: Azure storage account key for plugin site
              - string:
                  scope: GLOBAL
                  id: "sops-tenant-id"
                  secret: "${SOPS_TENANT_ID}"
                  description: Azure tenant id used by sops to decrypt secrets
              - basicSSHUserPrivateKey:
                  scope: GLOBAL
                  id: "charts-secrets"
                  username: ${SSH_CHARTS_SECRETS_USERNAME}
                  #passphrase: ${SSH_CHARTS_SECRETS_PASSWORD}
                  description: "SSH privkey used to access jenkins-infra/charts-secrets"
                  privateKeySource:
                    directEntry:
                      privateKey: ${SSH_CHARTS_SECRETS_PRIVKEY}
              - usernamePassword:
                  scope: GLOBAL
                  description: Docker hub credential for jenkinsinfra organisation
                  id: jenkins-dockerhub
                  username: "${DOCKER_HUB_USERNAME}"
                  password: "${DOCKER_HUB_TOKEN}"
jenkins-infra, jenkins-infra-jenkins-config-jobs-settings, ConfigMap (v1) has changed:
  # Source: jenkins/charts/jenkins/templates/jcasc-config.yaml
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: jenkins-infra-jenkins-config-jobs-settings
    namespace: jenkins-infra
    labels:
      "app.kubernetes.io/name": jenkins
      "helm.sh/chart": "jenkins-2.19.0"
      "app.kubernetes.io/managed-by": "Helm"
      "app.kubernetes.io/instance": "jenkins-infra"
      "app.kubernetes.io/component": "jenkins-master"
      jenkins-infra-jenkins-config: "true"
  data:
    jobs-settings.yaml: |-
      jobs:
        - script: >
            multibranchPipelineJob('k8smgmt') {
              displayName "K8s Cluster Management"
              description "Current K8s Cluster Management"
              branchSources {
                github {
                  id('2019081602')
-                 scanCredentialsId('github-access-token')
+                 scanCredentialsId('github-app-infra')
                  repoOwner('jenkins-infra')
                  repository('charts')
                }
              }
              factory {
                workflowBranchProjectFactory {
                  scriptPath('Jenkinsfile_k8s')
                }
              }
              configure { node ->
                def traits = node / 'sources' / 'data' / 'jenkins.branch.BranchSource' / 'source' / 'traits'
                traits << 'org.jenkinsci.plugins.github__branch__source.BranchDiscoveryTrait' {
                  strategyId(1)
                }
                traits << 'org.jenkinsci.plugins.github__branch__source.OriginPullRequestDiscoveryTrait' {
                  strategyId(1)
                }
                traits << 'org.jenkinsci.plugins.github__branch__source.ForkPullRequestDiscoveryTrait' {
                  strategyId(1)
                  trust(class: 'org.jenkinsci.plugins.github_branch_source.ForkPullRequestDiscoveryTrait$TrustPermission')
                }
                traits << 'jenkins.scm.impl.trait.WildcardSCMHeadFilterTrait' {
                  includes('main master PR-*')
                  excludes()
                }
                traits << 'org.jenkinsci.plugins.github.label.filter.PullRequestLabelsBlackListFilterTrait' {
                  labels('on-hold ci-skip')
                }
              }
            }
        - script: >
            multibranchPipelineJob('plugin-site') {
              displayName "Plugin Site"
              branchSources {
                github {
                  id('2019081602')
-                 scanCredentialsId('github-access-token')
+                 scanCredentialsId('github-app-infra')
                  repoOwner('jenkins-infra')
                  repository('plugin-site')
                  includes('master')
                }
              }
              factory {
                workflowBranchProjectFactory {
                  scriptPath('Jenkinsfile_k8s')
                }
              }
            }
        - script: >
            organizationFolder('Docker Builds') {
              description('Docker Builds')
              displayName('Docker Builds')
              organizations {
                github {
                  repoOwner("jenkins-infra")
                  apiUri("https://api.github.com")
-                 credentialsId('github-access-token')
+                 credentialsId('github-app-infra')

                  traits {
                    gitHubTagDiscovery()
                    cloneOptionTrait {
                      extension {
                        shallow(false)
                        noTags(false)
                        reference('')
                        timeout(10)
                        honorRefspec(true)
                      }
                    }
                  }
                }
              }

              orphanedItemStrategy {
                discardOldItems {
                  daysToKeep(7)
                  numToKeep(10)
                }
              }

              projectFactories {
                workflowMultiBranchProjectFactory {
                  scriptPath('Jenkinsfile_k8s')
                }
              }

              buildStrategies {
-               buildTags {
-                 atLeastDays("0")
-                 atMostDays("7")
+               buildAnyBranches {
+                 strategies {
+                   buildChangeRequests {
+                     ignoreTargetOnlyChanges(true)
+                     ignoreUntrustedChanges(true)
+                   }
+                   buildRegularBranches()
+                   buildTags {
+                     atLeastDays("0")
+                     atMostDays("7")
+                   }
+                 }
                }
              }

              configure { node ->
                def traits = node / navigators / 'org.jenkinsci.plugins.github__branch__source.GitHubSCMNavigator' / traits
                traits << 'jenkins.scm.impl.trait.RegexSCMSourceFilterTrait' {
                  regex('docker-.*')
                }
                traits << 'org.jenkinsci.plugins.github__branch__source.BranchDiscoveryTrait' {
                  strategyId(1)
                }
                traits << 'org.jenkinsci.plugins.github__branch__source.OriginPullRequestDiscoveryTrait' {
                  strategyId(1)
                }
                traits << 'org.jenkinsci.plugins.github__branch__source.ForkPullRequestDiscoveryTrait' {
                  strategyId(1)
                  trust(class: 'org.jenkinsci.plugins.github_branch_source.ForkPullRequestDiscoveryTrait$TrustPermission')
                }
                traits << 'org.jenkinsci.plugins.github__branch__source.ExcludeArchivedRepositoriesTrait' {
                }
                traits << 'org.jenkinsci.plugins.github.label.filter.PullRequestLabelsBlackListFilterTrait' {
                  labels('on-hold ci-skip')
                }
              }
            }
        - script: >
            multibranchPipelineJob('aws') {
              displayName "AWS Infra"
              branchSources {
                github {
                  id('2020120401')
-                 scanCredentialsId('github-access-token')
+                 scanCredentialsId('github-app-infra')
                  repoOwner('jenkins-infra')
                  repository('aws')
                }
              }
              factory {
                workflowBranchProjectFactory {
                  scriptPath('Jenkinsfile_k8s')
                }
              }
            }
        - script: >
            [
              ['jenkins-infra', 'jenkins-wiki-exporter', 'Wiki Exporter'],
              ['jenkinsci', 'custom-distribution-service', 'Custom Distribution Service'],
              ['jenkins-infra', 'incrementals-publisher', 'Incrementals Publisher'],
            ].each { config ->
              multibranchPipelineJob(config[1]) {
                displayName config[2]
                triggers {
                  pollSCM {
                    // poll every two hours until hooks are setup
                    scmpoll_spec('H/2 * * * *')
                  }
                }
                branchSources {
                  branchSource {
                    source {
                      github {
-                       credentialsId("github-access-token")
+                       credentialsId("github-app-infra")
                        configuredByUrl(true)
                        repositoryUrl('https://github.com/' + config[0] + '/' + config[1])
                        repoOwner(config[0])
                        repository(config[1])
                        traits {
                          gitHubBranchDiscovery {
                            strategyId(1) // 1-only branches that are not pull requests
                          }
                          pruneStaleBranchTrait()
                          gitHubTagDiscovery()
                        }
                      }
                      buildStrategies {
                        buildAnyBranches {
                          strategies {
                            buildAllBranches {
                              strategies {
                                buildNamedBranches {
                                  filters {
                                    exact {
                                      name("master")
                                      caseSensitive(true)
                                    }
                                  }
                                }
                              }
                            }
                          }
                        }
                        buildAnyBranches {
                          strategies {
                            buildAllBranches {
                              strategies {
                                buildTags {
                                  atLeastDays '-1'
                                  atMostDays '3'
                                }
                              }
                            }
                          }
                        }
                      }
                    }
                  }
                }
                factory {
                  workflowBranchProjectFactory {
                    scriptPath('Jenkinsfile')
                  }
                }
              }
            }
jenkins-infra, jenkins-infra-jenkins-config-pipeline-library, ConfigMap (v1) has changed:
  # Source: jenkins/charts/jenkins/templates/jcasc-config.yaml
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: jenkins-infra-jenkins-config-pipeline-library
    namespace: jenkins-infra
    labels:
      "app.kubernetes.io/name": jenkins
      "helm.sh/chart": "jenkins-2.19.0"
      "app.kubernetes.io/managed-by": "Helm"
      "app.kubernetes.io/instance": "jenkins-infra"
      "app.kubernetes.io/component": "jenkins-master"
      jenkins-infra-jenkins-config: "true"
  data:
    pipeline-library.yaml: |-
      unclassified:
        globalLibraries:
          libraries:
          - defaultVersion: "master"
            implicit: true
            name: "pipeline-library"
            retriever:
              modernSCM:
                scm:
                  git:
-                   id: "github-access-token"
+                   id: "github-app-infra"
                    remote: "https://github.com/jenkins-infra/pipeline-library.git"

release, default-release-jenkins, Secret (v1) has changed:
+ Changes suppressed on sensitive content of type Secret

falco, falco, ServiceAccount (v1) has changed:
  # Source: falco/templates/serviceaccount.yaml
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: falco
    namespace: falco
    labels:
      app: falco
-     chart: "falco-1.5.8"
+     chart: "falco-1.6.0"
      release: "falco"
      heritage: "Helm"
falco, falco-rules, ConfigMap (v1) has changed:
  # Source: falco/templates/configmap-rules.yaml
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: falco-rules
    namespace: falco
    labels:
      app: falco
-     chart: "falco-1.5.8"
+     chart: "falco-1.6.0"
      release: "falco"
      heritage: "Helm"
  data:
    rules-jenkins-infra.yaml: |-
      - list: allowed_docker_image_repository
        items:
          - jenkins/jenkins
          - jenkins/inbound-agent
          - olblak/nexus
          - olblak/helmfile
          - olblak/packaging
          - nginx

      - list: monitored_namespaces
        items:
          - release

      - rule: Using unauthorized docker image
        desc: Track whenever we install an unofficial jenkins-infra docker image
        condition: not container.image.repository in (allowed_docker_image_repository) and k8s.ns.name in (monitored_namespaces)
        output: Unauthorized container %container.image.repository running in namespace %k8s.ns.name (command=%proc.cmdline pid=%proc.pid file=%fd.name %container.info image=%container.image registry=%container.image.repository)
        priority: ALERT
falco, falco, ConfigMap (v1) has changed:
  # Source: falco/templates/configmap.yaml
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: falco
    namespace: falco
    labels:
      app: falco
-     chart: "falco-1.5.8"
+     chart: "falco-1.6.0"
      release: "falco"
      heritage: "Helm"
  data:
    falco.yaml: |-
      # File(s) or Directories containing Falco rules, loaded at startup.
      # The name "rules_file" is only for backwards compatibility.
      # If the entry is a file, it will be read directly. If the entry is a directory,
      # every file in that directory will be read, in alphabetical order.
      #
      # falco_rules.yaml ships with the falco package and is overridden with
      # every new software version. falco_rules.local.yaml is only created
      # if it doesn't exist. If you want to customize the set of rules, add
      # your customizations to falco_rules.local.yaml.
      #
      # The files will be read in the order presented here, so make sure if
      # you have overrides they appear in later files.
      rules_file:
        - /etc/falco/falco_rules.yaml
        - /etc/falco/falco_rules.local.yaml
        - /etc/falco/k8s_audit_rules.yaml
        - /etc/falco/rules.d

      # If true, the times displayed in log messages and output messages
      # will be in ISO 8601. By default, times are displayed in the local
      # time zone, as governed by /etc/localtime.
      time_format_iso_8601: false

      # Whether to output events in json or text
      json_output: false

      # When using json output, whether or not to include the "output" property
      # itself (e.g. "File below a known binary directory opened for writing
      # (user=root ....") in the json output.
+
      json_include_output_property: true

      # Send information logs to stderr and/or syslog Note these are *not* security
      # notification logs! These are just Falco lifecycle (and possibly error) logs.
      log_stderr: true
      log_syslog: true

      # Minimum log level to include in logs. Note: these levels are
      # separate from the priority field of rules. This refers only to the
      # log level of falco's internal logging. Can be one of "emergency",
      # "alert", "critical", "error", "warning", "notice", "info", "debug".
      log_level: info

      # Minimum rule priority level to load and run. All rules having a
      # priority more severe than this level will be loaded/run.  Can be one
      # of "emergency", "alert", "critical", "error", "warning", "notice",
      # "info", "debug".
      priority: debug

      # Whether or not output to any of the output channels below is
      # buffered. Defaults to false
      buffered_outputs: false

      # Falco uses a shared buffer between the kernel and userspace to pass
      # system call information. When falco detects that this buffer is
      # full and system calls have been dropped, it can take one or more of
      # the following actions:
      #   - "ignore": do nothing. If an empty list is provided, ignore is assumed.
      #   - "log": log a CRITICAL message noting that the buffer was full.
      #   - "alert": emit a falco alert noting that the buffer was full.
      #   - "exit": exit falco with a non-zero rc.
      #
      # The rate at which log/alert messages are emitted is governed by a
      # token bucket. The rate corresponds to one message every 30 seconds
      # with a burst of 10 messages.
      syscall_event_drops:
        actions:
          - log
          - alert
        rate: 0.03333
        max_burst: 10

      # A throttling mechanism implemented as a token bucket limits the
      # rate of falco notifications. This throttling is controlled by the following configuration
      # options:
      #  - rate: the number of tokens (i.e. right to send a notification)
      #    gained per second. Defaults to 1.
      #  - max_burst: the maximum number of tokens outstanding. Defaults to 1000.
      #
      # With these defaults, falco could send up to 1000 notifications after
      # an initial quiet period, and then up to 1 notification per second
      # afterward. It would gain the full burst back after 1000 seconds of
      # no activity.
      outputs:
        rate: 1
        max_burst: 1000

      # Where security notifications should go.
      # Multiple outputs can be enabled.

      syslog_output:
        enabled: true

      # If keep_alive is set to true, the file will be opened once and
      # continuously written to, with each output message on its own
      # line. If keep_alive is set to false, the file will be re-opened
      # for each output message.
      #
      # Also, the file will be closed and reopened if falco is signaled with
      # SIGUSR1.
+
      file_output:
        enabled: false
        keep_alive: false
        filename: ./events.txt

      stdout_output:
        enabled: true

      # Falco contains an embedded webserver that can be used to accept K8s
      # Audit Events. These config options control the behavior of that
      # webserver. (By default, the webserver is disabled).
      #
      # The ssl_certificate is a combination SSL Certificate and corresponding
      # key contained in a single file. You can generate a key/cert as follows:
      #
      # $ openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
      # $ cat certificate.pem key.pem > falco.pem
      # $ sudo cp falco.pem /etc/falco/falco.pem

      webserver:
        enabled: true
        listen_port: 8765
        k8s_audit_endpoint: /k8s-audit
        ssl_enabled: false
        ssl_certificate: /etc/falco/certs/server.pem

      # Possible additional things you might want to do with program output:
      #   - send to a slack webhook:
      #         program: "\"jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX\""
      #   - logging (alternate method than syslog):
      #         program: logger -t falco-test
      #   - send over a network connection:
      #         program: nc host.example.com 80

      # If keep_alive is set to true, the program will be started once and
      # continuously written to, with each output message on its own
      # line. If keep_alive is set to false, the program will be re-spawned
      # for each output message.
      #
      # Also, the program will be closed and reopened if falco is signaled with
      # SIGUSR1.
      program_output:
        enabled: false
        keep_alive: false
        program: |
          mail -s "Falco Notification"<EMAIL_ADDRESS>
      http_output:
        enabled: false
        url: http://some.url

      grpc:
        enabled: false
        threadiness: 0
        bind_address: "unix:///var/run/falco/falco.sock"

      grpc_output:
        enabled: false

    application_rules.yaml: |
      #
      # Copyright (C) 2019 The Falco Authors.
      #
      #
      # Licensed under the Apache License, Version 2.0 (the "License");
      # you may not use this file except in compliance with the License.
      # You may obtain a copy of the License at
      #
      #     http://www.apache.org/licenses/LICENSE-2.0
      #
      # Unless required by applicable law or agreed to in writing, software
      # distributed under the License is distributed on an "AS IS" BASIS,
      # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
      # See the License for the specific language governing permissions and
      # limitations under the License.
      #

      - required_engine_version: 2

      ################################################################
      # By default all application-related rules are disabled for
      # performance reasons. Depending on the application(s) you use,
      # uncomment the corresponding rule definitions for
      # application-specific activity monitoring.
      ################################################################

      # Elasticsearch ports
      - macro: elasticsearch_cluster_port
        condition: fd.sport=9300
      - macro: elasticsearch_api_port
        condition: fd.sport=9200
      - macro: elasticsearch_port
        condition: elasticsearch_cluster_port or elasticsearch_api_port

      # - rule: Elasticsearch unexpected network inbound traffic
      #   desc: inbound network traffic to elasticsearch on a port other than the standard ports
      #   condition: user.name = elasticsearch and inbound and not elasticsearch_port
      #   output: "Inbound network traffic to Elasticsearch on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # - rule: Elasticsearch unexpected network outbound traffic
      #   desc: outbound network traffic from elasticsearch on a port other than the standard ports
      #   condition: user.name = elasticsearch and outbound and not elasticsearch_cluster_port
      #   output: "Outbound network traffic from Elasticsearch on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # ActiveMQ ports
      - macro: activemq_cluster_port
        condition: fd.sport=61616
      - macro: activemq_web_port
        condition: fd.sport=8161
      - macro: activemq_port
        condition: activemq_web_port or activemq_cluster_port

      # - rule: Activemq unexpected network inbound traffic
      #   desc: inbound network traffic to activemq on a port other than the standard ports
      #   condition: user.name = activemq and inbound and not activemq_port
      #   output: "Inbound network traffic to ActiveMQ on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # - rule: Activemq unexpected network outbound traffic
      #   desc: outbound network traffic from activemq on a port other than the standard ports
      #   condition: user.name = activemq and outbound and not activemq_cluster_port
      #   output: "Outbound network traffic from ActiveMQ on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # Cassandra ports
      # https://docs.datastax.com/en/cassandra/2.0/cassandra/security/secureFireWall_r.html
      - macro: cassandra_thrift_client_port
        condition: fd.sport=9160
      - macro: cassandra_cql_port
        condition: fd.sport=9042
      - macro: cassandra_cluster_port
        condition: fd.sport=7000
      - macro: cassandra_ssl_cluster_port
        condition: fd.sport=7001
      - macro: cassandra_jmx_port
        condition: fd.sport=7199
      - macro: cassandra_port
        condition: >
          cassandra_thrift_client_port or
          cassandra_cql_port or cassandra_cluster_port or
          cassandra_ssl_cluster_port or cassandra_jmx_port

      # - rule: Cassandra unexpected network inbound traffic
      #   desc: inbound network traffic to cassandra on a port other than the standard ports
      #   condition: user.name = cassandra and inbound and not cassandra_port
      #   output: "Inbound network traffic to Cassandra on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # - rule: Cassandra unexpected network outbound traffic
      #   desc: outbound network traffic from cassandra on a port other than the standard ports
      #   condition: user.name = cassandra and outbound and not (cassandra_ssl_cluster_port or cassandra_cluster_port)
      #   output: "Outbound network traffic from Cassandra on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # Couchdb ports
      # https://github.com/davisp/couchdb/blob/master/etc/couchdb/local.ini
      - macro: couchdb_httpd_port
        condition: fd.sport=5984
      - macro: couchdb_httpd_ssl_port
        condition: fd.sport=6984
      # xxx can't tell what clustering ports are used. not writing rules for this
      # yet.

      # Fluentd ports
      - macro: fluentd_http_port
        condition: fd.sport=9880
      - macro: fluentd_forward_port
        condition: fd.sport=24224

      # - rule: Fluentd unexpected network inbound traffic
      #   desc: inbound network traffic to fluentd on a port other than the standard ports
      #   condition: user.name = td-agent and inbound and not (fluentd_forward_port or fluentd_http_port)
      #   output: "Inbound network traffic to Fluentd on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # - rule: Tdagent unexpected network outbound traffic
      #   desc: outbound network traffic from fluentd on a port other than the standard ports
      #   condition: user.name = td-agent and outbound and not fluentd_forward_port
      #   output: "Outbound network traffic from Fluentd on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # Gearman ports
      # http://gearman.org/protocol/
      # - rule: Gearman unexpected network outbound traffic
      #   desc: outbound network traffic from gearman on a port other than the standard ports
      #   condition: user.name = gearman and outbound and outbound and not fd.sport = 4730
      #   output: "Outbound network traffic from Gearman on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # Zookeeper
      - macro: zookeeper_port
        condition: fd.sport = 2181

      # Kafka ports
      # - rule: Kafka unexpected network inbound traffic
      #   desc: inbound network traffic to kafka on a port other than the standard ports
      #   condition: user.name = kafka and inbound and fd.sport != 9092
      #   output: "Inbound network traffic to Kafka on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # Memcached ports
      # - rule: Memcached unexpected network inbound traffic
      #   desc: inbound network traffic to memcached on a port other than the standard ports
      #   condition: user.name = memcached and inbound and fd.sport != 11211
      #   output: "Inbound network traffic to Memcached on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # - rule: Memcached unexpected network outbound traffic
      #   desc: any outbound network traffic from memcached. memcached never initiates outbound connections.
      #   condition: user.name = memcached and outbound
      #   output: "Unexpected Memcached outbound connection (connection=%fd.name)"
      #   priority: WARNING

      # MongoDB ports
      - macro: mongodb_server_port
        condition: fd.sport = 27017
      - macro: mongodb_shardserver_port
        condition: fd.sport = 27018
      - macro: mongodb_configserver_port
        condition: fd.sport = 27019
      - macro: mongodb_webserver_port
        condition: fd.sport = 28017

      # - rule: Mongodb unexpected network inbound traffic
      #   desc: inbound network traffic to mongodb on a port other than the standard ports
      #   condition: >
      #     user.name = mongodb and inbound and not (mongodb_server_port or
      #     mongodb_shardserver_port or mongodb_configserver_port or mongodb_webserver_port)
      #   output: "Inbound network traffic to MongoDB on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # MySQL ports
      # - rule: Mysql unexpected network inbound traffic
      #   desc: inbound network traffic to mysql on a port other than the standard ports
      #   condition: user.name = mysql and inbound and fd.sport != 3306
      #   output: "Inbound network traffic to MySQL on unexpected port (connection=%fd.name)"
      #   priority: WARNING

      # - rule: HTTP server unexpected network inbound traffic
      #   desc: inbound network traffic to a http server program on a port other than the standard ports
      #   condition: proc.name in (http_server_binaries) and inbound and fd.sport != 80 and fd.sport != 443
      #   output: "Inbound network traffic to HTTP Server on unexpected port (connection=%fd.name)"
      #   priority: WARNING
    falco_rules.local.yaml: |
      #
      # Copyright (C) 2019 The Falco Authors.
      #
      #
      # Licensed under the Apache License, Version 2.0 (the "License");
      # you may not use this file except in compliance with the License.
      # You may obtain a copy of the License at
      #
      #     http://www.apache.org/licenses/LICENSE-2.0
      #