poprhythm
2ed0565486
git-hook-tamper.yaml's condition used proc.exepath, which resolves to the script interpreter's path (e.g. /bin/busybox) for shebang scripts, not the script's own path - switched to proc.cmdline, which retains the originally invoked path. Confirmed via live-testing both ways. ssh-persistence/cloud-metadata-probe/db-spawned-process round out the post-incident hardening pass with a few more incubating-ruleset adaptations.
40 lines
1.4 KiB
YAML
40 lines
1.4 KiB
YAML
networks:
|
|
default:
|
|
# Falco's own default bridge network, plus netdata's network so netdata
|
|
# can scrape http://falco:8765/metrics by container name.
|
|
netdata_default:
|
|
external: true
|
|
|
|
services:
|
|
falco:
|
|
image: falcosecurity/falco:0.44.1
|
|
container_name: falco
|
|
restart: always
|
|
cap_drop:
|
|
- all
|
|
cap_add:
|
|
- sys_admin
|
|
- sys_resource
|
|
- sys_ptrace
|
|
security_opt:
|
|
- apparmor:unconfined
|
|
networks:
|
|
- default
|
|
- netdata_default
|
|
ports:
|
|
- "127.0.0.1:8765:8765"
|
|
volumes:
|
|
- /sys/kernel/tracing:/sys/kernel/tracing:ro
|
|
- /var/run/docker.sock:/host/var/run/docker.sock:ro
|
|
- /proc:/host/proc:ro
|
|
- /etc:/host/etc:ro
|
|
- ./config/falco.yaml:/etc/falco/config.d/telemetry.yaml:ro
|
|
- ./rules/miner-detect.yaml:/etc/falco/rules.d/miner-detect.yaml:ro
|
|
- ./rules/miner-pool-ports.yaml:/etc/falco/rules.d/miner-pool-ports.yaml:ro
|
|
- ./rules/tune-noise.yaml:/etc/falco/rules.d/tune-noise.yaml:ro
|
|
- ./rules/git-hook-tamper.yaml:/etc/falco/rules.d/git-hook-tamper.yaml:ro
|
|
- ./rules/unexpected-child-of-git.yaml:/etc/falco/rules.d/unexpected-child-of-git.yaml:ro
|
|
- ./rules/ssh-persistence.yaml:/etc/falco/rules.d/ssh-persistence.yaml:ro
|
|
- ./rules/cloud-metadata-probe.yaml:/etc/falco/rules.d/cloud-metadata-probe.yaml:ro
|
|
- ./rules/db-spawned-process.yaml:/etc/falco/rules.d/db-spawned-process.yaml:ro
|