openstack-helm-infra/falco/values.yaml

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
images:
  pull_policy: IfNotPresent
  tags:
    dep_check: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
    falco: docker.io/sysdig/falco:0.12.1
    image_repo_sync: docker.io/docker:17.07.0
  local_registry:
    active: false
    exclude:
      - dep_check
      - image_repo_sync


pod:
  resources:
    enabled: false
    falco:
      requests:
        memory: "128Mi"
        cpu: "20m"
      limits:
        memory: "128Mi"
        cpu: "30m"
  jobs:
    image_repo_sync:
      requests:
        memory: "128Mi"
        cpu: "20m"
      limits:
        memory: "128Mi"
        cpu: "30m"
  lifecycle:
    upgrades:
      daemonsets:
        pod_replacement_strategy: RollingUpdate
        falco:
          enabled: true
          min_ready_seconds: 0
          max_unavailable: 1
  tolerations:
    falco:
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master


conf:
  config:
    # The location of the rules file(s). This can contain one or more paths to
    # separate rules files.
    rules_file:
      - /etc/falco/falco_rules.yaml
      - /etc/falco/falco_rules.local.yaml
      - /etc/falco/rules.d

    # Whether to output events in json or text
    json_output: false

    # When using json output, whether or not to include the "output" property
    # itself (e.g. "File below a known binary directory opened for writing
    # (user=root ....") in the json output.
    json_include_output_property: true

    # Send information logs to stderr and/or syslog Note these are *not* security
    # notification logs! These are just Falco lifecycle (and possibly error) logs.
    log_stderr: true
    log_syslog: true

    # Minimum log level to include in logs. Note: these levels are
    # separate from the priority field of rules. This refers only to the
    # log level of falco's internal logging. Can be one of "emergency",
    # "alert", "critical", "error", "warning", "notice", "info", "debug".
    log_level: info

    # Minimum rule priority level to load and run. All rules having a
    # priority more severe than this level will be loaded/run.  Can be one
    # of "emergency", "alert", "critical", "error", "warning", "notice",
    # "info", "debug".
    priority: debug

    # Whether or not output to any of the output channels below is
    # buffered.
    buffered_outputs: false

    # A throttling mechanism implemented as a token bucket limits the
    # rate of falco notifications. This throttling is controlled by the following configuration
    # options:
    #  - rate: the number of tokens (i.e. right to send a notification)
    #    gained per second. Defaults to 1.
    #  - max_burst: the maximum number of tokens outstanding. Defaults to 1000.
    #
    # With these defaults, falco could send up to 1000 notifications after
    # an initial quiet period, and then up to 1 notification per second
    # afterward. It would gain the full burst back after 1000 seconds of
    # no activity.
    outputs:
      rate: 1
      max_burst: 1000

    # Where security notifications should go.
    # Multiple outputs can be enabled.
    syslog_output:
      enabled: true

    # If keep_alive is set to true, the file will be opened once and
    # continuously written to, with each output message on its own
    # line. If keep_alive is set to false, the file will be re-opened
    # for each output message.
    #
    # Also, the file will be closed and reopened if falco is signaled with
    # SIGUSR1.
    file_output:
      enabled: false
      keep_alive: false
      filename: ./events.txt

    stdout_output:
      enabled: true

    # Possible additional things you might want to do with program output:
    #   - send to a slack webhook:
    #         program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"
    #   - logging (alternate method than syslog):
    #         program: logger -t falco-test
    #   - send over a network connection:
    #         program: nc host.example.com 80

    # If keep_alive is set to true, the program will be started once and
    # continuously written to, with each output message on its own
    # line. If keep_alive is set to false, the program will be re-spawned
    # for each output message.
    #
    # Also, the program will be closed and reopened if falco is signaled with
    # SIGUSR1.
    program_output:
      enabled: false
      keep_alive: false
      program: mail -s "Falco Notification" someone@example.com
  rules:
    falco_rules: |
      - macro: open_write
        condition: (evt.type=open or evt.type=openat) and evt.is_open_write=true and fd.typechar='f' and fd.num>=0
      - macro: open_read
        condition: (evt.type=open or evt.type=openat) and evt.is_open_read=true and fd.typechar='f' and fd.num>=0
      - macro: never_true
        condition: (evt.num=0)
      - macro: always_true
        condition: (evt.num=>0)
      - macro: proc_name_exists
        condition: (proc.name!="<NA>")
      - macro: rename
        condition: evt.type in (rename, renameat)
      - macro: mkdir
        condition: evt.type = mkdir
      - macro: remove
        condition: evt.type in (rmdir, unlink, unlinkat)
      - macro: modify
        condition: rename or remove
      - macro: spawned_process
        condition: evt.type = execve and evt.dir=<
      - macro: bin_dir
        condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)
      - macro: bin_dir_mkdir
        condition: >
          (evt.arg[1] startswith /bin/ or
           evt.arg[1] startswith /sbin/ or
           evt.arg[1] startswith /usr/bin/ or
           evt.arg[1] startswith /usr/sbin/)
      - macro: bin_dir_rename
        condition: >
          evt.arg[1] startswith /bin/ or
          evt.arg[1] startswith /sbin/ or
          evt.arg[1] startswith /usr/bin/ or
          evt.arg[1] startswith /usr/sbin/
      - macro: etc_dir
        condition: fd.name startswith /etc/
      - macro: root_dir
        condition: ((fd.directory=/ or fd.name startswith /root) and fd.name contains "/")
      - list: shell_binaries
        items: [bash, csh, ksh, sh, tcsh, zsh, dash]
      - list: shell_mgmt_binaries
        items: [add-shell, remove-shell]
      - macro: shell_procs
        condition: (proc.name in (shell_binaries))
      - list: coreutils_binaries
        items: [
          truncate, sha1sum, numfmt, fmt, fold, uniq, cut, who,
          groups, csplit, sort, expand, printf, printenv, unlink, tee, chcon, stat,
          basename, split, nice, "yes", whoami, sha224sum, hostid, users, stdbuf,
          base64, unexpand, cksum, od, paste, nproc, pathchk, sha256sum, wc, test,
          comm, arch, du, factor, sha512sum, md5sum, tr, runcon, env, dirname,
          tsort, join, shuf, install, logname, pinky, nohup, expr, pr, tty, timeout,
          tail, "[", seq, sha384sum, nl, head, id, mkfifo, sum, dircolors, ptx, shred,
          tac, link, chroot, vdir, chown, touch, ls, dd, uname, "true", pwd, date,
          chgrp, chmod, mktemp, cat, mknod, sync, ln, "false", rm, mv, cp, echo,
          readlink, sleep, stty, mkdir, df, dir, rmdir, touch
          ]
      - list: login_binaries
        items: [
          login, systemd, '"(systemd)"', systemd-logind, su,
          nologin, faillog, lastlog, newgrp, sg
          ]
      - list: passwd_binaries
        items: [
          shadowconfig, grpck, pwunconv, grpconv, pwck,
          groupmod, vipw, pwconv, useradd, newusers, cppw, chpasswd, usermod,
          groupadd, groupdel, grpunconv, chgpasswd, userdel, chage, chsh,
          gpasswd, chfn, expiry, passwd, vigr, cpgr
          ]
      - list: shadowutils_binaries
        items: [
          chage, gpasswd, lastlog, newgrp, sg, adduser, deluser, chpasswd,
          groupadd, groupdel, addgroup, delgroup, groupmems, groupmod, grpck, grpconv, grpunconv,
          newusers, pwck, pwconv, pwunconv, useradd, userdel, usermod, vigr, vipw, unix_chkpwd
          ]
      - list: sysdigcloud_binaries
        items: [setup-backend, dragent, sdchecks]
      - list: docker_binaries
        items: [docker, dockerd, exe, docker-compose, docker-entrypoi, docker-runc-cur, docker-current]
      - list: k8s_binaries
        items: [hyperkube, skydns, kube2sky, exechealthz]
      - list: lxd_binaries
        items: [lxd, lxcfs]
      - list: http_server_binaries
        items: [nginx, httpd, httpd-foregroun, lighttpd, apache, apache2]
      - list: db_server_binaries
        items: [mysqld, postgres, sqlplus]
      - list: mysql_mgmt_binaries
        items: [mysql_install_d, mysql_ssl_rsa_s]
      - list: postgres_mgmt_binaries
        items: [pg_dumpall, pg_ctl, pg_lsclusters, pg_ctlcluster]
      - list: db_mgmt_binaries
        items: [mysql_mgmt_binaries, postgres_mgmt_binaries]
      - list: nosql_server_binaries
        items: [couchdb, memcached, redis-server, rabbitmq-server, mongod]
      - list: gitlab_binaries
        items: [gitlab-shell, gitlab-mon, gitlab-runner-b, git]
      - macro: server_procs
        condition: proc.name in (http_server_binaries, db_server_binaries, docker_binaries, sshd)
      - list: rpm_binaries
        items: [dnf, rpm, rpmkey, yum, '"75-system-updat"', rhsmcertd-worke, subscription-ma,
                repoquery, rpmkeys, rpmq, yum-cron, yum-config-mana, yum-debug-dump,
                abrt-action-sav, rpmdb_stat, microdnf]
      - macro: rpm_procs
        condition: proc.name in (rpm_binaries) or proc.name in (salt-minion)
      - list: deb_binaries
        items: [dpkg, dpkg-preconfigu, dpkg-reconfigur, dpkg-divert, apt, apt-get, aptitude,
          frontend, preinst, add-apt-reposit, apt-auto-remova, apt-key,
          apt-listchanges, unattended-upgr, apt-add-reposit
          ]
      - list: package_mgmt_binaries
        items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client]
      - macro: package_mgmt_procs
        condition: proc.name in (package_mgmt_binaries)
      - macro: coreos_write_ssh_dir
        condition: (proc.name=update-ssh-keys and fd.name startswith /home/core/.ssh)
      - macro: run_by_package_mgmt_binaries
        condition: proc.aname in (package_mgmt_binaries, needrestart)
      - list: ssl_mgmt_binaries
        items: [ca-certificates]
      - list: dhcp_binaries
        items: [dhclient, dhclient-script]
      - list: userexec_binaries
        items: [sudo, su, suexec]
      - list: known_setuid_binaries
        items: [
          sshd, dbus-daemon-lau, ping, ping6, critical-stack-, pmmcli,
          filemng, PassengerAgent, bwrap, osdetect, nginxmng, sw-engine-fpm,
          start-stop-daem
          ]
      - list: user_mgmt_binaries
        items: [login_binaries, passwd_binaries, shadowutils_binaries]
      - list: dev_creation_binaries
        items: [blkid, rename_device, update_engine, sgdisk]
      - list: hids_binaries
        items: [aide]
      - list: vpn_binaries
        items: [openvpn]
      - list: nomachine_binaries
        items: [nxexec, nxnode.bin, nxserver.bin, nxclient.bin]
      - macro: system_procs
        condition: proc.name in (coreutils_binaries, user_mgmt_binaries)
      - list: mail_binaries
        items: [
          sendmail, sendmail-msp, postfix, procmail, exim4,
          pickup, showq, mailq, dovecot, imap-login, imap,
          mailmng-core, pop3-login, dovecot-lda, pop3
          ]
      - list: mail_config_binaries
        items: [
          update_conf, parse_mc, makemap_hash, newaliases, update_mk, update_tlsm4,
          update_db, update_mc, ssmtp.postinst, mailq, postalias, postfix.config.,
          postfix.config, postfix-script
          ]
      - list: sensitive_file_names
        items: [/etc/shadow, /etc/sudoers, /etc/pam.conf]
      - macro: sensitive_files
        condition: >
          fd.name startswith /etc and
          (fd.name in (sensitive_file_names)
           or fd.directory in (/etc/sudoers.d, /etc/pam.d))
      - macro: proc_is_new
        condition: proc.duration <= 5000000000
      - macro: inbound
        condition: >
          (((evt.type in (accept,listen) and evt.dir=<)) or
           (fd.typechar = 4 or fd.typechar = 6) and
           (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
           (evt.rawres >= 0 or evt.res = EINPROGRESS))
      - macro: outbound
        condition: >
          (((evt.type = connect and evt.dir=<)) or
           (fd.typechar = 4 or fd.typechar = 6) and
           (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
           (evt.rawres >= 0 or evt.res = EINPROGRESS))
      - macro: inbound_outbound
        condition: >
          (((evt.type in (accept,listen,connect) and evt.dir=<)) or
           (fd.typechar = 4 or fd.typechar = 6) and
           (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
           (evt.rawres >= 0 or evt.res = EINPROGRESS))
      - macro: ssh_port
        condition: fd.sport=22
      - macro: allowed_ssh_hosts
        condition: ssh_port
      - rule: Disallowed SSH Connection
        desc: Detect any new ssh connection to a host other than those in an allowed group of hosts
        condition: (inbound_outbound) and ssh_port and not allowed_ssh_hosts
        output: Disallowed SSH Connection (command=%proc.cmdline connection=%fd.name user=%user.name)
        priority: NOTICE
        tags: [network]
      - macro: container
        condition: container.id != host
      - macro: interactive
        condition: >
          ((proc.aname=sshd and proc.name != sshd) or
          proc.name=systemd-logind or proc.name=login)
      - list: cron_binaries
        items: [anacron, cron, crond, crontab]
      - list: needrestart_binaries
        items: [needrestart, 10-dpkg, 20-rpm, 30-pacman]
      - list: sshkit_script_binaries
        items: [10_etc_sudoers., 10_passwd_group]
      - list: plesk_binaries
        items: [sw-engine, sw-engine-fpm, sw-engine-kv, filemng, f2bmng]
      - macro: system_users
        condition: user.name in (bin, daemon, games, lp, mail, nobody, sshd, sync, uucp, www-data)
      - macro: parent_ansible_running_python
        condition: (proc.pname in (python, pypy) and proc.pcmdline contains ansible)
      - macro: parent_bro_running_python
        condition: (proc.pname=python and proc.cmdline contains /usr/share/broctl)
      - macro: parent_python_running_denyhosts
        condition: >
          (proc.cmdline startswith "denyhosts.py /usr/bin/denyhosts.py" or
           (proc.pname=python and
           (proc.pcmdline contains /usr/sbin/denyhosts or
            proc.pcmdline contains /usr/local/bin/denyhosts.py)))
      - macro: parent_python_running_sdchecks
        condition: >
          (proc.pname in (python, python2.7) and
          (proc.pcmdline contains /opt/draios/bin/sdchecks))
      - macro: parent_linux_image_upgrade_script
        condition: proc.pname startswith linux-image-
      - macro: parent_java_running_echo
        condition: (proc.pname=java and proc.cmdline startswith "sh -c echo")
      - macro: parent_scripting_running_builds
        condition: >
          (proc.pname in (php,php5-fpm,php-fpm7.1,python,ruby,ruby2.3,ruby2.1,node,conda) and (
             proc.cmdline startswith "sh -c git" or
             proc.cmdline startswith "sh -c date" or
             proc.cmdline startswith "sh -c /usr/bin/g++" or
             proc.cmdline startswith "sh -c /usr/bin/gcc" or
             proc.cmdline startswith "sh -c gcc" or
             proc.cmdline startswith "sh -c if type gcc" or
             proc.cmdline startswith "sh -c cd '/var/www/edi/';LC_ALL=en_US.UTF-8 git" or
             proc.cmdline startswith "sh -c /var/www/edi/bin/sftp.sh" or
             proc.cmdline startswith "sh -c /usr/src/app/crxlsx/bin/linux/crxlsx" or
             proc.cmdline startswith "sh -c make parent" or
             proc.cmdline startswith "node /jenkins/tools" or
             proc.cmdline startswith "sh -c '/usr/bin/node'" or
             proc.cmdline startswith "sh -c stty -a |" or
             proc.pcmdline startswith "node /opt/nodejs/bin/yarn" or
             proc.pcmdline startswith "node /usr/local/bin/yarn" or
             proc.pcmdline startswith "node /root/.config/yarn" or
             proc.pcmdline startswith "node /opt/yarn/bin/yarn.js"))
      - macro: httpd_writing_ssl_conf
        condition: >
          (proc.pname=run-httpd and
           (proc.cmdline startswith "sed -ri" or proc.cmdline startswith "sed -i") and
           (fd.name startswith /etc/httpd/conf.d/ or fd.name startswith /etc/httpd/conf))
      - macro: userhelper_writing_etc_security
        condition: (proc.name=userhelper and fd.name startswith /etc/security)
      - macro: parent_Xvfb_running_xkbcomp
        condition: (proc.pname=Xvfb and proc.cmdline startswith 'sh -c "/usr/bin/xkbcomp"')
      - macro: parent_nginx_running_serf
        condition: (proc.pname=nginx and proc.cmdline startswith "sh -c serf")
      - macro: parent_node_running_npm
        condition: (proc.pcmdline startswith "node /usr/local/bin/npm" or
                    proc.pcmdline startswith "node /usr/local/nodejs/bin/npm" or
                    proc.pcmdline startswith "node /opt/rh/rh-nodejs6/root/usr/bin/npm")
      - macro: parent_java_running_sbt
        condition: (proc.pname=java and proc.pcmdline contains sbt-launch.jar)
      - list: known_container_shell_spawn_cmdlines
        items: []
      - list: known_shell_spawn_binaries
        items: []
      - macro: ansible_running_python
        condition: (proc.name in (python, pypy) and proc.cmdline contains ansible)
      - macro: python_running_chef
        condition: (proc.name=python and (proc.cmdline contains yum-dump.py or proc.cmdline="python /usr/bin/chef-monitor.py"))
      - macro: python_running_denyhosts
        condition: >
          (proc.name=python and
          (proc.cmdline contains /usr/sbin/denyhosts or
           proc.cmdline contains /usr/local/bin/denyhosts.py))
      - macro: run_by_qualys
        condition: >
          (proc.pname=qualys-cloud-ag or
           proc.aname[2]=qualys-cloud-ag or
           proc.aname[3]=qualys-cloud-ag or
           proc.aname[4]=qualys-cloud-ag)
      - macro: run_by_sumologic_securefiles
        condition: >
          ((proc.cmdline="usermod -a -G sumologic_collector" or
            proc.cmdline="groupadd sumologic_collector") and
           (proc.pname=secureFiles.sh and proc.aname[2]=java))
      - macro: run_by_yum
        condition: ((proc.pname=sh and proc.aname[2]=yum) or
                    (proc.aname[2]=sh and proc.aname[3]=yum))
      - macro: run_by_ms_oms
        condition: >
          (proc.aname[3] startswith omsagent- or
           proc.aname[3] startswith scx-)
      - macro: run_by_google_accounts_daemon
        condition: >
          (proc.aname[1] startswith google_accounts or
           proc.aname[2] startswith google_accounts)
      - macro: run_by_chef
        condition: (proc.aname[2]=chef_command_wr or proc.aname[3]=chef_command_wr or
                    proc.aname[2]=chef-client or proc.aname[3]=chef-client or
                    proc.name=chef-client)
      - macro: run_by_adclient
        condition: (proc.aname[2]=adclient or proc.aname[3]=adclient or proc.aname[4]=adclient)
      - macro: run_by_centrify
        condition: (proc.aname[2]=centrify or proc.aname[3]=centrify or proc.aname[4]=centrify)
      - macro: run_by_puppet
        condition: (proc.aname[2]=puppet or proc.aname[3]=puppet)
      - macro: run_by_foreman
        condition: >
          (user.name=foreman and
           (proc.pname in (rake, ruby, scl) and proc.aname[5] in (tfm-rake,tfm-ruby)) or
           (proc.pname=scl and proc.aname[2] in (tfm-rake,tfm-ruby)))
      - macro: java_running_sdjagent
        condition: proc.name=java and proc.cmdline contains sdjagent.jar
      - macro: kubelet_running_loopback
        condition: (proc.pname=kubelet and proc.name=loopback)
      - macro: python_mesos_marathon_scripting
        condition: (proc.pcmdline startswith "python3 /marathon-lb/marathon_lb.py")
      - macro: splunk_running_forwarder
        condition: (proc.pname=splunkd and proc.cmdline startswith "sh -c /opt/splunkforwarder")
      - macro: parent_supervise_running_multilog
        condition: (proc.name=multilog and proc.pname=supervise)
      - macro: supervise_writing_status
        condition: (proc.name in (supervise,svc) and fd.name startswith "/etc/sb/")
      - macro: pki_realm_writing_realms
        condition: (proc.cmdline startswith "bash /usr/local/lib/pki/pki-realm" and fd.name startswith /etc/pki/realms)
      - macro: htpasswd_writing_passwd
        condition: (proc.name=htpasswd and fd.name=/etc/nginx/.htpasswd)
      - macro: lvprogs_writing_conf
        condition: >
          (proc.name in (dmeventd,lvcreate,pvscan) and
           (fd.name startswith /etc/lvm/archive or
            fd.name startswith /etc/lvm/backup or
            fd.name startswith /etc/lvm/cache))
      - macro: ovsdb_writing_openvswitch
        condition: (proc.name=ovsdb-server and fd.directory=/etc/openvswitch)
      - macro: perl_running_plesk
        condition: (proc.cmdline startswith "perl /opt/psa/admin/bin/plesk_agent_manager" or
                    proc.pcmdline startswith "perl /opt/psa/admin/bin/plesk_agent_manager")
      - macro: perl_running_updmap
        condition: (proc.cmdline startswith "perl /usr/bin/updmap")
      - macro: perl_running_centrifydc
        condition: (proc.cmdline startswith "perl /usr/share/centrifydc")
      - macro: parent_ucf_writing_conf
        condition: (proc.pname=ucf and proc.aname[2]=frontend)
      - macro: consul_template_writing_conf
        condition: >
          ((proc.name=consul-template and fd.name startswith /etc/haproxy) or
           (proc.name=reload.sh and proc.aname[2]=consul-template and fd.name startswith /etc/ssl))
      - macro: countly_writing_nginx_conf
        condition: (proc.cmdline startswith "nodejs /opt/countly/bin" and fd.name startswith /etc/nginx)
      - list: ms_oms_binaries
        items: [omi.postinst, omsconfig.posti, scx.postinst, omsadmin.sh, omiagent]
      - macro: ms_oms_writing_conf
        condition: >
          ((proc.name in (omiagent,omsagent,in_heartbeat_r*,omsadmin.sh,PerformInventor)
             or proc.pname in (ms_oms_binaries)
             or proc.aname[2] in (ms_oms_binaries))
           and (fd.name startswith /etc/opt/omi or fd.name startswith /etc/opt/microsoft/omsagent))
      - macro: ms_scx_writing_conf
        condition: (proc.name in (GetLinuxOS.sh) and fd.name startswith /etc/opt/microsoft/scx)
      - macro: azure_scripts_writing_conf
        condition: (proc.pname startswith "bash /var/lib/waagent/" and fd.name startswith /etc/azure)
      - macro: azure_networkwatcher_writing_conf
        condition: (proc.name in (NetworkWatcherA) and fd.name=/etc/init.d/AzureNetworkWatcherAgent)
      - macro: couchdb_writing_conf
        condition: (proc.name=beam.smp and proc.cmdline contains couchdb and fd.name startswith /etc/couchdb)
      - macro: update_texmf_writing_conf
        condition: (proc.name=update-texmf and fd.name startswith /etc/texmf)
      - macro: slapadd_writing_conf
        condition: (proc.name=slapadd and fd.name startswith /etc/ldap)
      - macro: openldap_writing_conf
        condition: (proc.pname=run-openldap.sh and fd.name startswith /etc/openldap)
      - macro: ucpagent_writing_conf
        condition: (proc.name=apiserver and container.image startswith docker/ucp-agent and fd.name=/etc/authorization_config.cfg)
      - macro: iscsi_writing_conf
        condition: (proc.name=iscsiadm and fd.name startswith /etc/iscsi)
      - macro: symantec_writing_conf
        condition: >
          ((proc.name=symcfgd and fd.name startswith /etc/symantec) or
           (proc.name=navdefutil and fd.name=/etc/symc-defutils.conf))
      - macro: liveupdate_writing_conf
        condition: (proc.cmdline startswith "java LiveUpdate" and fd.name in (/etc/liveupdate.conf, /etc/Product.Catalog.JavaLiveUpdate))
      - macro: sosreport_writing_files
        condition: >
          (proc.name=urlgrabber-ext- and proc.aname[3]=sosreport and
           (fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb))
      - macro: pkgmgmt_progs_writing_pki
        condition: >
          (proc.name=urlgrabber-ext- and proc.pname in (yum, yum-cron, repoquery) and
           (fd.name startswith /etc/pkt/nssdb or fd.name startswith /etc/pki/nssdb))
      - macro: update_ca_trust_writing_pki
        condition: (proc.pname=update-ca-trust and proc.name=trust and fd.name startswith /etc/pki)
      - macro: brandbot_writing_os_release
        condition: proc.name=brandbot and fd.name=/etc/os-release
      - macro: selinux_writing_conf
        condition: (proc.name in (semodule,genhomedircon,sefcontext_comp) and fd.name startswith /etc/selinux)
      - list: veritas_binaries
        items: [vxconfigd, sfcache, vxclustadm, vxdctl, vxprint, vxdmpadm, vxdisk, vxdg, vxassist, vxtune]
      - macro: veritas_driver_script
        condition: (proc.cmdline startswith "perl /opt/VRTSsfmh/bin/mh_driver.pl")
      - macro: veritas_progs
        condition: (proc.name in (veritas_binaries) or veritas_driver_script)
      - macro: veritas_writing_config
        condition: (veritas_progs and (fd.name startswith /etc/vx or fd.name startswith /etc/opt/VRTS or fd.name startswith /etc/vom))
      - macro: nginx_writing_conf
        condition: (proc.name=nginx and fd.name startswith /etc/nginx)
      - macro: nginx_writing_certs
        condition: >
          (((proc.name=openssl and proc.pname=nginx-launch.sh) or proc.name=nginx-launch.sh) and fd.name startswith /etc/nginx/certs)
      - macro: chef_client_writing_conf
        condition: (proc.pcmdline startswith "chef-client /opt/gitlab" and fd.name startswith /etc/gitlab)
      - macro: centrify_writing_krb
        condition: (proc.name in (adjoin,addns) and fd.name startswith /etc/krb5)
      - macro: cockpit_writing_conf
        condition: >
          ((proc.pname=cockpit-kube-la or proc.aname[2]=cockpit-kube-la)
           and fd.name startswith /etc/cockpit)
      - macro: ipsec_writing_conf
        condition: (proc.name=start-ipsec.sh and fd.directory=/etc/ipsec)
      - macro: exe_running_docker_save
        condition: (proc.cmdline startswith "exe /var/lib/docker" and proc.pname in (dockerd, docker))
      - macro: sed_temporary_file
        condition: (proc.name=sed and fd.name startswith "/etc/sed")
      - macro: python_running_get_pip
        condition: (proc.cmdline startswith "python get-pip.py")
      - macro: python_running_ms_oms
        condition: (proc.cmdline startswith "python /var/lib/waagent/")
      - macro: gugent_writing_guestagent_log
        condition: (proc.name=gugent and fd.name=GuestAgent.log)
      - macro: dse_writing_tmp
        condition: (proc.name=dse-entrypoint and fd.name=/root/tmp__)
      - macro: zap_writing_state
        condition: (proc.name=java and proc.cmdline contains "jar /zap" and fd.name startswith /root/.ZAP)
      - macro: airflow_writing_state
        condition: (proc.name=airflow and fd.name startswith /root/airflow)
      - macro: rpm_writing_root_rpmdb
        condition: (proc.name=rpm and fd.directory=/root/.rpmdb)
      - macro: maven_writing_groovy
        condition: (proc.name=java and proc.cmdline contains "classpath /usr/local/apache-maven" and fd.name startswith /root/.groovy)
      - rule: Write below binary dir
        desc: an attempt to write to any file below a set of binary directories
        condition: >
          bin_dir and evt.dir = < and open_write
          and not package_mgmt_procs
          and not exe_running_docker_save
          and not python_running_get_pip
          and not python_running_ms_oms
        output: >
          File below a known binary directory opened for writing (user=%user.name
          command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline gparent=%proc.aname[2])
        priority: ERROR
        tags: [filesystem]
      - list: monitored_directories
        items: [/boot, /lib, /lib64, /usr/lib, /usr/local/lib, /usr/local/sbin, /usr/local/bin, /root/.ssh, /etc/cardserver]
      - macro: user_ssh_directory
        condition: (fd.name startswith '/home' and fd.name contains '.ssh')
      - macro: mkinitramfs_writing_boot
        condition: (proc.pname in (mkinitramfs, update-initramf) and fd.directory=/boot)
      - macro: monitored_dir
        condition: >
          (fd.directory in (monitored_directories)
           or user_ssh_directory)
          and not mkinitramfs_writing_boot
      - rule: Write below monitored dir
        desc: an attempt to write to any file below a set of binary directories
        condition: >
          evt.dir = < and open_write and monitored_dir
          and not package_mgmt_procs
          and not coreos_write_ssh_dir
          and not exe_running_docker_save
          and not python_running_get_pip
          and not python_running_ms_oms
        output: >
          File below a monitored directory opened for writing (user=%user.name
          command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline gparent=%proc.aname[2])
        priority: ERROR
        tags: [filesystem]
      - list: safe_etc_dirs
        items: [/etc/cassandra, /etc/ssl/certs/java, /etc/logstash, /etc/nginx/conf.d, /etc/container_environment, /etc/hrmconfig]
      - macro: fluentd_writing_conf_files
        condition: (proc.name=start-fluentd and fd.name in (/etc/fluent/fluent.conf, /etc/td-agent/td-agent.conf))
      - macro: qualys_writing_conf_files
        condition: (proc.name=qualys-cloud-ag and fd.name=/etc/qualys/cloud-agent/qagent-log.conf)
      - macro: git_writing_nssdb
        condition: (proc.name=git-remote-http and fd.directory=/etc/pki/nssdb)
      - macro: plesk_writing_keys
        condition: (proc.name in (plesk_binaries) and fd.name startswith /etc/sw/keys)
      - macro: plesk_install_writing_apache_conf
        condition: (proc.cmdline startswith "bash -hB /usr/lib/plesk-9.0/services/webserver.apache configure"
                    and fd.name="/etc/apache2/apache2.conf.tmp")
      - macro: plesk_running_mktemp
        condition: (proc.name=mktemp and proc.aname[3] in (plesk_binaries))
      - macro: networkmanager_writing_resolv_conf
        condition: proc.aname[2]=nm-dispatcher and fd.name=/etc/resolv.conf
      - macro: add_shell_writing_shells_tmp
        condition: (proc.name=add-shell and fd.name=/etc/shells.tmp)
      - macro: duply_writing_exclude_files
        condition: (proc.name=touch and proc.pcmdline startswith "bash /usr/bin/duply" and fd.name startswith "/etc/duply")
      - macro: xmlcatalog_writing_files
        condition: (proc.name=update-xmlcatal and fd.directory=/etc/xml)
      - macro: datadog_writing_conf
        condition: ((proc.cmdline startswith "python /opt/datadog-agent" or
                     proc.cmdline startswith "entrypoint.sh /entrypoint.sh datadog start" or
                     proc.cmdline startswith "agent.py /opt/datadog-agent")
                    and fd.name startswith "/etc/dd-agent")
      - macro: curl_writing_pki_db
        condition: (proc.name=curl and fd.directory=/etc/pki/nssdb)
      - macro: haproxy_writing_conf
        condition: ((proc.name in (update-haproxy-,haproxy_reload.) or proc.pname in (update-haproxy-,haproxy_reload,haproxy_reload.))
                     and (fd.name=/etc/openvpn/client.map or fd.name startswith /etc/haproxy))
      - macro: java_writing_conf
        condition: (proc.name=java and fd.name=/etc/.java/.systemPrefs/.system.lock)
      - macro: rabbitmq_writing_conf
        condition: (proc.name=rabbitmq-server and fd.directory=/etc/rabbitmq)
      - macro: rook_writing_conf
        condition: (proc.name=toolbox.sh and container.image startswith rook/toolbox
                    and fd.directory=/etc/ceph)
      - macro: httpd_writing_conf_logs
        condition: (proc.name=httpd and fd.name startswith /etc/httpd/)
      - macro: mysql_writing_conf
        condition: >
          ((proc.name in (start-mysql.sh, run-mysqld) or proc.pname=start-mysql.sh) and
           (fd.name startswith /etc/mysql or fd.directory=/etc/my.cnf.d))
      - macro: redis_writing_conf
        condition: >
          (proc.name in (run-redis, redis-launcher.) and fd.name=/etc/redis.conf or fd.name startswith /etc/redis)
      - macro: openvpn_writing_conf
        condition: (proc.name in (openvpn,openvpn-entrypo) and fd.name startswith /etc/openvpn)
      - macro: php_handlers_writing_conf
        condition: (proc.name=php_handlers_co and fd.name=/etc/psa/php_versions.json)
      - macro: sed_writing_temp_file
        condition: >
          ((proc.aname[3]=cron_start.sh and fd.name startswith /etc/security/sed) or
           (proc.name=sed and (fd.name startswith /etc/apt/sources.list.d/sed or
                               fd.name startswith /etc/apt/sed or
                               fd.name startswith /etc/apt/apt.conf.d/sed)))
      - macro: cron_start_writing_pam_env
        condition: (proc.cmdline="bash /usr/sbin/start-cron" and fd.name=/etc/security/pam_env.conf)
      - macro: dpkg_scripting
        condition: (proc.aname[2] in (dpkg-reconfigur, dpkg-preconfigu))
      - macro: user_known_write_etc_conditions
        condition: proc.name=confd
      - macro: write_etc_common
        condition: >
          etc_dir and evt.dir = < and open_write
          and proc_name_exists
          and not proc.name in (passwd_binaries, shadowutils_binaries, sysdigcloud_binaries,
                                package_mgmt_binaries, ssl_mgmt_binaries, dhcp_binaries,
                                dev_creation_binaries, shell_mgmt_binaries,
                                mail_config_binaries,
                                sshkit_script_binaries,
                                ldconfig.real, ldconfig, confd, gpg, insserv,
                                apparmor_parser, update-mime, tzdata.config, tzdata.postinst,
                                systemd, systemd-machine, systemd-sysuser,
                                debconf-show, rollerd, bind9.postinst, sv,
                                gen_resolvconf., update-ca-certi, certbot, runsv,
                                qualys-cloud-ag, locales.postins, nomachine_binaries,
                                adclient, certutil, crlutil, pam-auth-update, parallels_insta,
                                openshift-launc, update-rc.d)
          and not proc.pname in (sysdigcloud_binaries, mail_config_binaries, hddtemp.postins, sshkit_script_binaries, locales.postins, deb_binaries, dhcp_binaries)
          and not fd.name pmatch (safe_etc_dirs)
          and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json, /etc/motd, /etc/motd.svc)
          and not sed_temporary_file
          and not exe_running_docker_save
          and not ansible_running_python
          and not python_running_denyhosts
          and not fluentd_writing_conf_files
          and not user_known_write_etc_conditions
          and not run_by_centrify
          and not run_by_adclient
          and not qualys_writing_conf_files
          and not git_writing_nssdb
          and not plesk_writing_keys
          and not plesk_install_writing_apache_conf
          and not plesk_running_mktemp
          and not networkmanager_writing_resolv_conf
          and not run_by_chef
          and not add_shell_writing_shells_tmp
          and not duply_writing_exclude_files
          and not xmlcatalog_writing_files
          and not parent_supervise_running_multilog
          and not supervise_writing_status
          and not pki_realm_writing_realms
          and not htpasswd_writing_passwd
          and not lvprogs_writing_conf
          and not ovsdb_writing_openvswitch
          and not datadog_writing_conf
          and not curl_writing_pki_db
          and not haproxy_writing_conf
          and not java_writing_conf
          and not dpkg_scripting
          and not parent_ucf_writing_conf
          and not rabbitmq_writing_conf
          and not rook_writing_conf
          and not php_handlers_writing_conf
          and not sed_writing_temp_file
          and not cron_start_writing_pam_env
          and not httpd_writing_conf_logs
          and not mysql_writing_conf
          and not openvpn_writing_conf
          and not consul_template_writing_conf
          and not countly_writing_nginx_conf
          and not ms_oms_writing_conf
          and not ms_scx_writing_conf
          and not azure_scripts_writing_conf
          and not azure_networkwatcher_writing_conf
          and not couchdb_writing_conf
          and not update_texmf_writing_conf
          and not slapadd_writing_conf
          and not symantec_writing_conf
          and not liveupdate_writing_conf
          and not sosreport_writing_files
          and not selinux_writing_conf
          and not veritas_writing_config
          and not nginx_writing_conf
          and not nginx_writing_certs
          and not chef_client_writing_conf
          and not centrify_writing_krb
          and not cockpit_writing_conf
          and not ipsec_writing_conf
          and not httpd_writing_ssl_conf
          and not userhelper_writing_etc_security
          and not pkgmgmt_progs_writing_pki
          and not update_ca_trust_writing_pki
          and not brandbot_writing_os_release
          and not redis_writing_conf
          and not openldap_writing_conf
          and not ucpagent_writing_conf
          and not iscsi_writing_conf
      - rule: Write below etc
        desc: an attempt to write to any file below /etc
        condition: write_etc_common
        output: "File below /etc opened for writing (user=%user.name command=%proc.cmdline parent=%proc.pname pcmdline=%proc.pcmdline file=%fd.name program=%proc.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4])"
        priority: ERROR
        tags: [filesystem]
      - list: known_root_files
        items: [/root/.monit.state, /root/.auth_tokens, /root/.bash_history, /root/.ash_history, /root/.aws/credentials,
                /root/.viminfo.tmp, /root/.lesshst, /root/.bzr.log, /root/.gitconfig.lock, /root/.babel.json, /root/.localstack,
                /root/.node_repl_history, /root/.mongorc.js, /root/.dbshell, /root/.augeas/history, /root/.rnd, /root/.wget-hsts]
      - list: known_root_directories
        items: [/root/.oracle_jre_usage, /root/.ssh, /root/.subversion, /root/.nami]
      - macro: known_root_conditions
        condition: (fd.name startswith /root/orcexec.
                    or fd.name startswith /root/.m2
                    or fd.name startswith /root/.npm
                    or fd.name startswith /root/.pki
                    or fd.name startswith /root/.ivy2
                    or fd.name startswith /root/.config/Cypress
                    or fd.name startswith /root/.config/pulse
                    or fd.name startswith /root/.config/configstore
                    or fd.name startswith /root/jenkins/workspace
                    or fd.name startswith /root/.jenkins
                    or fd.name startswith /root/.cache
                    or fd.name startswith /root/.sbt
                    or fd.name startswith /root/.java
                    or fd.name startswith /root/.glide
                    or fd.name startswith /root/.sonar
                    or fd.name startswith /root/.v8flag
                    or fd.name startswith /root/infaagent
                    or fd.name startswith /root/.local/lib/python
                    or fd.name startswith /root/.pm2
                    or fd.name startswith /root/.gnupg
                    or fd.name startswith /root/.pgpass
                    or fd.name startswith /root/.theano
                    or fd.name startswith /root/.gradle
                    or fd.name startswith /root/.android
                    or fd.name startswith /root/.ansible
                    or fd.name startswith /root/.crashlytics
                    or fd.name startswith /root/.dbus
                    or fd.name startswith /root/.composer
                    or fd.name startswith /root/.gconf
                    or fd.name startswith /root/.nv
                    or fd.name startswith /root/.local/share/jupyter
                    or fd.name startswith /root/oradiag_root
                    or fd.name startswith /root/workspace
                    or fd.name startswith /root/jvm
                    or fd.name startswith /root/.node-gyp)
      - rule: Write below root
        desc: an attempt to write to any file directly below / or /root
        condition: >
          root_dir and evt.dir = < and open_write
          and not fd.name in (known_root_files)
          and not fd.directory in (known_root_directories)
          and not exe_running_docker_save
          and not gugent_writing_guestagent_log
          and not dse_writing_tmp
          and not zap_writing_state
          and not airflow_writing_state
          and not rpm_writing_root_rpmdb
          and not maven_writing_groovy
          and not known_root_conditions
        output: "File below / or /root opened for writing (user=%user.name command=%proc.cmdline parent=%proc.pname file=%fd.name program=%proc.name)"
        priority: ERROR
        tags: [filesystem]
      - macro: cmp_cp_by_passwd
        condition: proc.name in (cmp, cp) and proc.pname in (passwd, run-parts)
      - rule: Read sensitive file trusted after startup
        desc: >
          an attempt to read any sensitive file (e.g. files containing user/password/authentication
          information) by a trusted program after startup. Trusted programs might read these files
          at startup to load initial state, but not afterwards.
        condition: sensitive_files and open_read and server_procs and not proc_is_new and proc.name!="sshd"
        output: >
          Sensitive file opened for reading by trusted program after startup (user=%user.name
          command=%proc.cmdline parent=%proc.pname file=%fd.name parent=%proc.pname gparent=%proc.aname[2])
        priority: WARNING
        tags: [filesystem]
      - list: read_sensitive_file_binaries
        items: [
          iptables, ps, lsb_release, check-new-relea, dumpe2fs, accounts-daemon, sshd,
          vsftpd, systemd, mysql_install_d, psql, screen, debconf-show, sa-update,
          pam-auth-update, pam-config, /usr/sbin/spamd, polkit-agent-he, lsattr, file, sosreport,
          scxcimservera, adclient, rtvscand, cockpit-session, userhelper, ossec-syscheckd
          ]
      - macro: user_read_sensitive_file_conditions
        condition: cmp_cp_by_passwd
      - rule: Read sensitive file untrusted
        desc: >
          an attempt to read any sensitive file (e.g. files containing user/password/authentication
          information). Exceptions are made for known trusted programs.
        condition: >
          sensitive_files and open_read
          and proc_name_exists
          and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries,
           cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries,
           vpn_binaries, mail_config_binaries, nomachine_binaries, sshkit_script_binaries,
           in.proftpd, mandb, salt-minion, postgres_mgmt_binaries)
          and not cmp_cp_by_passwd
          and not ansible_running_python
          and not proc.cmdline contains /usr/bin/mandb
          and not run_by_qualys
          and not run_by_chef
          and not user_read_sensitive_file_conditions
          and not perl_running_plesk
          and not perl_running_updmap
          and not veritas_driver_script
          and not perl_running_centrifydc
        output: >
          Sensitive file opened for reading by non-trusted program (user=%user.name program=%proc.name
          command=%proc.cmdline file=%fd.name parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4])
        priority: WARNING
        tags: [filesystem]
      - rule: Write below rpm database
        desc: an attempt to write to the rpm database by any non-rpm related program
        condition: fd.name startswith /var/lib/rpm and open_write and not rpm_procs and not ansible_running_python and not python_running_chef
        output: "Rpm database opened for writing by a non-rpm program (command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline)"
        priority: ERROR
        tags: [filesystem, software_mgmt]
      - macro: postgres_running_wal_e
        condition: (proc.pname=postgres and proc.cmdline startswith "sh -c envdir /etc/wal-e.d/env /usr/local/bin/wal-e")
      - macro: redis_running_prepost_scripts
        condition: (proc.aname[2]=redis-server and (proc.cmdline contains "redis-server.post-up.d" or proc.cmdline contains "redis-server.pre-up.d"))
      - macro: rabbitmq_running_scripts
        condition: >
          (proc.pname=beam.smp and
          (proc.cmdline startswith "sh -c exec ps" or
           proc.cmdline startswith "sh -c exec inet_gethost" or
           proc.cmdline= "sh -s unix:cmd" or
           proc.cmdline= "sh -c exec /bin/sh -s unix:cmd 2>&1"))
      - macro: rabbitmqctl_running_scripts
        condition: (proc.aname[2]=rabbitmqctl and proc.cmdline startswith "sh -c ")
      - macro: run_by_appdynamics
        condition: (proc.pname=java and proc.pcmdline startswith "java -jar -Dappdynamics")
      - rule: DB program spawned process
        desc: >
          a database-server related program spawned a new process other than itself.
          This shouldn\'t occur and is a follow on from some SQL injection attacks.
        condition: >
          proc.pname in (db_server_binaries)
          and spawned_process
          and not proc.name in (db_server_binaries)
          and not postgres_running_wal_e
        output: >
          Database-related program spawned process other than itself (user=%user.name
          program=%proc.cmdline parent=%proc.pname)
        priority: NOTICE
        tags: [process, database]
      - rule: Modify binary dirs
        desc: an attempt to modify any file below a set of binary directories.
        condition: (bin_dir_rename) and modify and not package_mgmt_procs and not exe_running_docker_save
        output: >
          File below known binary directory renamed/removed (user=%user.name command=%proc.cmdline
          pcmdline=%proc.pcmdline operation=%evt.type file=%fd.name %evt.args)
        priority: ERROR
        tags: [filesystem]
      - rule: Mkdir binary dirs
        desc: an attempt to create a directory below a set of binary directories.
        condition: mkdir and bin_dir_mkdir and not package_mgmt_procs
        output: >
          Directory below known binary directory created (user=%user.name
          command=%proc.cmdline directory=%evt.arg.path)
        priority: ERROR
        tags: [filesystem]
      - list: user_known_change_thread_namespace_binaries
        items: []
      - rule: Change thread namespace
        desc: >
          an attempt to change a program/thread\'s namespace (commonly done
          as a part of creating a container) by calling setns.
        condition: >
          evt.type = setns
          and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, sysdig, nsenter)
          and not proc.name in (user_known_change_thread_namespace_binaries)
          and not proc.name startswith "runc:"
          and not proc.pname in (sysdigcloud_binaries)
          and not java_running_sdjagent
          and not kubelet_running_loopback
        output: >
          Namespace change (setns) by unexpected program (user=%user.name command=%proc.cmdline
          parent=%proc.pname %container.info)
        priority: NOTICE
        tags: [process]
      - list: protected_shell_spawning_binaries
        items: [
          http_server_binaries, db_server_binaries, nosql_server_binaries, mail_binaries,
          fluentd, flanneld, splunkd, consul, smbd, runsv, PM2
          ]
      - macro: parent_java_running_zookeeper
        condition: (proc.pname=java and proc.pcmdline contains org.apache.zookeeper.server)
      - macro: parent_java_running_kafka
        condition: (proc.pname=java and proc.pcmdline contains kafka.Kafka)
      - macro: parent_java_running_elasticsearch
        condition: (proc.pname=java and proc.pcmdline contains org.elasticsearch.bootstrap.Elasticsearch)
      - macro: parent_java_running_activemq
        condition: (proc.pname=java and proc.pcmdline contains activemq.jar)
      - macro: parent_java_running_cassandra
        condition: (proc.pname=java and (proc.pcmdline contains "-Dcassandra.config.loader" or proc.pcmdline contains org.apache.cassandra.service.CassandraDaemon))
      - macro: parent_java_running_jboss_wildfly
        condition: (proc.pname=java and proc.pcmdline contains org.jboss)
      - macro: parent_java_running_glassfish
        condition: (proc.pname=java and proc.pcmdline contains com.sun.enterprise.glassfish)
      - macro: parent_java_running_hadoop
        condition: (proc.pname=java and proc.pcmdline contains org.apache.hadoop)
      - macro: parent_java_running_datastax
        condition: (proc.pname=java and proc.pcmdline contains com.datastax)
      - macro: nginx_starting_nginx
        condition: (proc.pname=nginx and proc.cmdline contains "/usr/sbin/nginx -c /etc/nginx/nginx.conf")
      - macro: nginx_running_aws_s3_cp
        condition: (proc.pname=nginx and proc.cmdline startswith "sh -c /usr/local/bin/aws s3 cp")
      - macro: consul_running_net_scripts
        condition: (proc.pname=consul and (proc.cmdline startswith "sh -c curl" or proc.cmdline startswith "sh -c nc"))
      - macro: consul_running_alert_checks
        condition: (proc.pname=consul and proc.cmdline startswith "sh -c /bin/consul-alerts")
      - macro: serf_script
        condition: (proc.cmdline startswith "sh -c serf")
      - macro: check_process_status
        condition: (proc.cmdline startswith "sh -c kill -0 ")
      - macro: possibly_node_in_container
        condition: (never_true and (proc.pname=node and proc.aname[3]=docker-containe))
      - macro: possibly_parent_java_running_tomcat
        condition: (never_true and proc.pname=java and proc.pcmdline contains org.apache.catalina.startup.Bootstrap)
      - macro: protected_shell_spawner
        condition: >
          (proc.aname in (protected_shell_spawning_binaries)
          or parent_java_running_zookeeper
          or parent_java_running_kafka
          or parent_java_running_elasticsearch
          or parent_java_running_activemq
          or parent_java_running_cassandra
          or parent_java_running_jboss_wildfly
          or parent_java_running_glassfish
          or parent_java_running_hadoop
          or parent_java_running_datastax
          or possibly_parent_java_running_tomcat
          or possibly_node_in_container)
      - list: mesos_shell_binaries
        items: [mesos-docker-ex, mesos-slave, mesos-health-ch]
      - rule: Run shell untrusted
        desc: an attempt to spawn a shell below a non-shell application. Specific applications are monitored.
        condition: >
          spawned_process
          and shell_procs
          and proc.pname exists
          and protected_shell_spawner
          and not proc.pname in (shell_binaries, gitlab_binaries, cron_binaries, user_known_shell_spawn_binaries,
                                 needrestart_binaries,
                                 mesos_shell_binaries,
                                 erl_child_setup, exechealthz,
                                 PM2, PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf,
                                 lb-controller, nvidia-installe, runsv, statsite, erlexec)
          and not proc.cmdline in (known_shell_spawn_cmdlines)
          and not proc.aname in (unicorn_launche)
          and not consul_running_net_scripts
          and not consul_running_alert_checks
          and not nginx_starting_nginx
          and not nginx_running_aws_s3_cp
          and not run_by_package_mgmt_binaries
          and not serf_script
          and not check_process_status
          and not run_by_foreman
          and not python_mesos_marathon_scripting
          and not splunk_running_forwarder
          and not postgres_running_wal_e
          and not redis_running_prepost_scripts
          and not rabbitmq_running_scripts
          and not rabbitmqctl_running_scripts
          and not run_by_appdynamics
          and not user_shell_container_exclusions
        output: >
          Shell spawned by untrusted binary (user=%user.name shell=%proc.name parent=%proc.pname
          cmdline=%proc.cmdline pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3]
          aname[4]=%proc.aname[4] aname[5]=%proc.aname[5] aname[6]=%proc.aname[6] aname[7]=%proc.aname[7])
        priority: DEBUG
        tags: [shell]
      - macro: trusted_containers
        condition: (container.image startswith sysdig/agent or
                    (container.image startswith sysdig/falco and
                     not container.image startswith sysdig/falco-event-generator) or
                    container.image startswith quay.io/sysdig or
                    container.image startswith sysdig/sysdig or
                    container.image startswith gcr.io/google_containers/hyperkube or
                    container.image startswith quay.io/coreos/flannel or
                    container.image startswith gcr.io/google_containers/kube-proxy or
                    container.image startswith calico/node or
                    container.image startswith rook/toolbox or
                    container.image startswith registry.access.redhat.com/openshift3/logging-fluentd or
                    container.image startswith registry.access.redhat.com/openshift3/logging-elasticsearch or
                    container.image startswith registry.access.redhat.com/openshift3/metrics-cassandra or
                    container.image startswith openshift3/ose-sti-builder or
                    container.image startswith registry.access.redhat.com/openshift3/ose-sti-builder or
                    container.image startswith registry.access.redhat.com/openshift3/ose-docker-builder or
                    container.image startswith registry.access.redhat.com/openshift3/image-inspector or
                    container.image startswith cloudnativelabs/kube-router or
                    container.image startswith "consul:" or
                    container.image startswith mesosphere/mesos-slave or
                    container.image startswith istio/proxy_ or
                    container.image startswith datadog/docker-dd-agent or
                    container.image startswith datadog/agent or
                    container.image startswith docker/ucp-agent or
                    container.image startswith gliderlabs/logspout)
      - macro: user_trusted_containers
        condition: (container.image startswith sysdig/agent)
      - macro: user_sensitive_mount_containers
        condition: (container.image startswith sysdig/agent)
      - rule: Launch Privileged Container
        desc: Detect the initial process started in a privileged container. Exceptions are made for known trusted images.
        condition: >
          evt.type=execve and proc.vpid=1 and container
          and container.privileged=true
          and not trusted_containers
          and not user_trusted_containers
        output: Privileged container started (user=%user.name command=%proc.cmdline %container.info image=%container.image)
        priority: INFO
        tags: [container, cis]
      - macro: sensitive_mount
        condition: (container.mount.dest[/proc*] != "N/A" or
                    container.mount.dest[/var/run/docker.sock] != "N/A" or
                    container.mount.dest[/] != "N/A" or
                    container.mount.dest[/etc] != "N/A" or
                    container.mount.dest[/root*] != "N/A")
      - macro: container_entrypoint
        condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], runc:[1:CHILD], docker-runc, exe))
      - rule: Launch Sensitive Mount Container
        desc: >
          Detect the initial process started by a container that has a mount from a sensitive host directory
          (i.e. /proc). Exceptions are made for known trusted images.
        condition: >
          evt.type=execve and proc.vpid=1 and container
          and sensitive_mount
          and not trusted_containers
          and not user_sensitive_mount_containers
        output: Container with sensitive mount started (user=%user.name command=%proc.cmdline %container.info image=%container.image mounts=%container.mounts)
        priority: INFO
        tags: [container, cis]
      - macro: allowed_containers
        condition: (proc.vpid=1)
      - rule: Launch Disallowed Container
        desc: >
          Detect the initial process started by a container that is not in a list of allowed containers.
        condition: evt.type=execve and proc.vpid=1 and container and not allowed_containers
        output: Container started and not in allowed list (user=%user.name command=%proc.cmdline %container.info image=%container.image)
        priority: WARNING
        tags: [container]
      - rule: System user interactive
        desc: an attempt to run interactive commands by a system (i.e. non-login) user
        condition: spawned_process and system_users and interactive
        output: "System user ran an interactive command (user=%user.name command=%proc.cmdline)"
        priority: INFO
        tags: [users]
      - rule: Terminal shell in container
        desc: A shell was used as the entrypoint/exec point into a container with an attached terminal.
        condition: >
          spawned_process and container
          and shell_procs and proc.tty != 0
          and container_entrypoint
        output: >
          A shell was spawned in a container with an attached terminal (user=%user.name %container.info
          shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty)
        priority: NOTICE
        tags: [container, shell]
      - list: known_shell_spawn_cmdlines
        items: [
          '"sh -c uname -p 2> /dev/null"',
          '"sh -c uname -s 2>&1"',
          '"sh -c uname -r 2>&1"',
          '"sh -c uname -v 2>&1"',
          '"sh -c uname -a 2>&1"',
          '"sh -c ruby -v 2>&1"',
          '"sh -c getconf CLK_TCK"',
          '"sh -c getconf PAGESIZE"',
          '"sh -c LC_ALL=C LANG=C /sbin/ldconfig -p 2>/dev/null"',
          '"sh -c LANG=C /sbin/ldconfig -p 2>/dev/null"',
          '"sh -c /sbin/ldconfig -p 2>/dev/null"',
          '"sh -c stty -a 2>/dev/null"',
          '"sh -c stty -a < /dev/tty"',
          '"sh -c stty -g < /dev/tty"',
          '"sh -c node index.js"',
          '"sh -c node index"',
          '"sh -c node ./src/start.js"',
          '"sh -c node app.js"',
          '"sh -c node -e \"require(''nan'')\""',
          '"sh -c node -e \"require(''nan'')\")"',
          '"sh -c node $NODE_DEBUG_OPTION index.js "',
          '"sh -c crontab -l 2"',
          '"sh -c lsb_release -a"',
          '"sh -c lsb_release -is 2>/dev/null"',
          '"sh -c whoami"',
          '"sh -c node_modules/.bin/bower-installer"',
          '"sh -c /bin/hostname -f 2> /dev/null"',
          '"sh -c locale -a"',
          '"sh -c  -t -i"',
          '"sh -c openssl version"',
          '"bash -c id -Gn kafadmin"',
          '"sh -c /bin/sh -c ''date +%%s''"'
          ]
      - list: user_known_shell_spawn_binaries
        items: []
      - macro: user_shell_container_exclusions
        condition: (never_true)
      - macro: login_doing_dns_lookup
        condition: (proc.name=login and fd.l4proto=udp and fd.sport=53)
      - rule: System procs network activity
        desc: any network activity performed by system binaries that are not expected to send or receive any network traffic
        condition: >
          (fd.sockfamily = ip and system_procs)
          and (inbound_outbound)
          and not proc.name in (systemd, hostid, id)
          and not login_doing_dns_lookup
        output: >
          Known system binary sent/received network traffic
          (user=%user.name command=%proc.cmdline connection=%fd.name)
        priority: NOTICE
        tags: [network]
      - list: openvpn_udp_ports
        items: [1194, 1197, 1198, 8080, 9201]
      - list: l2tp_udp_ports
        items: [500, 1701, 4500, 10000]
      - list: statsd_ports
        items: [8125]
      - list: ntp_ports
        items: [123]
      - list: test_connect_ports
        items: [0, 9, 80, 3306]
      - macro: do_unexpected_udp_check
        condition: (never_true)
      - list: expected_udp_ports
        items: [53, openvpn_udp_ports, l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports]
      - macro: expected_udp_traffic
        condition: fd.port in (expected_udp_ports)
      - rule: Unexpected UDP Traffic
        desc: UDP traffic not on port 53 (DNS) or other commonly used ports
        condition: (inbound_outbound) and do_unexpected_udp_check and fd.l4proto=udp and not expected_udp_traffic
        output: >
          Unexpected UDP Traffic Seen
          (user=%user.name command=%proc.cmdline connection=%fd.name proto=%fd.l4proto evt=%evt.type %evt.args)
        priority: NOTICE
        tags: [network]
      - macro: somebody_becoming_themself
        condition: ((user.name=nobody and evt.arg.uid=nobody) or
                    (user.name=www-data and evt.arg.uid=www-data) or
                    (user.name=_apt and evt.arg.uid=_apt) or
                    (user.name=postfix and evt.arg.uid=postfix) or
                    (user.name=pki-agent and evt.arg.uid=pki-agent) or
                    (user.name=pki-acme and evt.arg.uid=pki-acme) or
                    (user.name=nfsnobody and evt.arg.uid=nfsnobody) or
                    (user.name=postgres and evt.arg.uid=postgres))
      - macro: nrpe_becoming_nagios
        condition: (proc.name=nrpe and evt.arg.uid=nagios)
      - macro: known_user_in_container
        condition: (container and user.name != "N/A")
      - rule: Non sudo setuid
        desc: >
          an attempt to change users by calling setuid. sudo/su are excluded. users "root" and "nobody"
          suing to itself are also excluded, as setuid calls typically involve dropping privileges.
        condition: >
          evt.type=setuid and evt.dir=>
          and (known_user_in_container or not container)
          and not user.name=root and not somebody_becoming_themself
          and not proc.name in (known_setuid_binaries, userexec_binaries, mail_binaries, docker_binaries,
                                nomachine_binaries)
          and not java_running_sdjagent
          and not nrpe_becoming_nagios
        output: >
          Unexpected setuid call by non-sudo, non-root program (user=%user.name cur_uid=%user.uid parent=%proc.pname
          command=%proc.cmdline uid=%evt.arg.uid)
        priority: NOTICE
        tags: [users]
      - rule: User mgmt binaries
        desc: >
          activity by any programs that can manage users, passwords, or permissions. sudo and su are excluded.
          Activity in containers is also excluded--some containers create custom users on top
          of a base linux distribution at startup.
          Some innocuous commandlines that don't actually change anything are excluded.
        condition: >
          spawned_process and proc.name in (user_mgmt_binaries) and
          not proc.name in (su, sudo, lastlog, nologin, unix_chkpwd) and not container and
          not proc.pname in (cron_binaries, systemd, systemd.postins, udev.postinst, run-parts) and
          not proc.cmdline startswith "passwd -S" and
          not proc.cmdline startswith "useradd -D" and
          not proc.cmdline startswith "systemd --version" and
          not run_by_qualys and
          not run_by_sumologic_securefiles and
          not run_by_yum and
          not run_by_ms_oms and
          not run_by_google_accounts_daemon
        output: >
          User management binary command run outside of container
          (user=%user.name command=%proc.cmdline parent=%proc.pname gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4])
        priority: NOTICE
        tags: [host, users]
      - list: allowed_dev_files
        items: [
          /dev/null, /dev/stdin, /dev/stdout, /dev/stderr,
          /dev/random, /dev/urandom, /dev/console, /dev/kmsg
          ]
      - rule: Create files below dev
        desc: creating any files below /dev other than known programs that manage devices. Some rootkits hide files in /dev.
        condition: >
          fd.directory = /dev and
          (evt.type = creat or (evt.type = open and evt.arg.flags contains O_CREAT))
          and not proc.name in (dev_creation_binaries)
          and not fd.name in (allowed_dev_files)
          and not fd.name startswith /dev/tty
        output: "File created below /dev by untrusted program (user=%user.name command=%proc.cmdline file=%fd.name)"
        priority: ERROR
        tags: [filesystem]
      - macro: ec2_metadata_containers
        condition: container
      - rule: Contact EC2 Instance Metadata Service From Container
        desc: Detect attempts to contact the EC2 Instance Metadata Service from a container
        condition: outbound and fd.sip="169.254.169.254" and container and not ec2_metadata_containers
        output: Outbound connection to EC2 instance metadata service (command=%proc.cmdline connection=%fd.name %container.info image=%container.image)
        priority: NOTICE
        tags: [network, aws, container]
      - macro: k8s_api_server
        condition: (fd.sip="1.2.3.4" and fd.sport=8080)
      - macro: k8s_containers
        condition: >
          (container.image startswith gcr.io/google_containers/hyperkube-amd64 or
           container.image startswith gcr.io/google_containers/kube2sky or
           container.image startswith sysdig/agent or
           container.image startswith sysdig/falco or
           container.image startswith sysdig/sysdig)
      - rule: Contact K8S API Server From Container
        desc: Detect attempts to contact the K8S API Server from a container
        condition: outbound and k8s_api_server and container and not k8s_containers
        output: Unexpected connection to K8s API Server from container (command=%proc.cmdline %container.info image=%container.image connection=%fd.name)
        priority: NOTICE
        tags: [network, k8s, container]
      - macro: nodeport_containers
        condition: container
      - rule: Unexpected K8s NodePort Connection
        desc: Detect attempts to use K8s NodePorts from a container
        condition: (inbound_outbound) and fd.sport >= 30000 and fd.sport <= 32767 and container and not nodeport_containers
        output: Unexpected K8s NodePort Connection (command=%proc.cmdline connection=%fd.name)
        priority: NOTICE
        tags: [network, k8s, container]      

    falco_rules_local: |
      ####################
      # Your custom rules!
      ####################

      # Add new rules, like this one
      # - rule: The program "sudo" is run in a container
      #   desc: An event will trigger every time you run sudo in a container
      #   condition: evt.type = execve and evt.dir=< and container.id != host and proc.name = sudo
      #   output: "Sudo run in container (user=%user.name %container.info parent=%proc.pname cmdline=%proc.cmdline)"
      #   priority: ERROR
      #   tags: [users, container]

      # Or override/append to any rule, macro, or list from the Default Rules      
    custom_rules: {}
      # Although Falco comes with a nice default rule set for detecting weird
      # behavior in containers, our users are going to customize the run-time
      # security rule sets or policies for the specific container images and
      # applications they run. This feature can be handled in this section.
      #
      # Example:
      #
      # rules-traefik.yaml: |-
      #   [ rule body ]

dependencies:
  dynamic:
    common:
      local_image_registry:
        jobs:
          - k8sksauth-image-repo-sync
        services:
          - endpoint: node
            service: local_image_registry
  static:
    falco:
      services: null
    image_repo_sync:
      services:
        - endpoint: internal
          service: local_image_registry

manifests:
  daemonset: true
  configmap_etc: true
  configmap_custom_rules: false
  configmap_bin: true
...