poprhythm
33868ee9bb
"Redirect STDOUT/STDIN to Network Connection in Container" (a reverse-shell detector) was firing legitimately: gitea's sshd/sshd-session dup2 the accepted SSH socket onto stdio for every session (4x per connection), and firefly-iii's wait-for-it.sh does the same TCP-readiness-check dance while waiting for postgres. Both confirmed recurring via netdata's alert history, not one-off. Scoped exceptions added to each's specific binary/cmdline, not the whole container/image. Verified: a gitea SSH login no longer alerts, while a real dup2-based redirect (bash's /dev/tcp exec pattern) from an unrelated container still fires - the exception is narrow, not a blanket disable. "Run shell untrusted" was also flagged as noisy, but investigation showed it fired exactly once, during my own rule-testing window, and never before or since - left alone rather than building a permanent exception for a self-caused test artifact.