{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":580805113,"defaultBranch":"main","name":"rules","ownerLogin":"falcosecurity","currentUserCanPush":false,"isFork":false,"isEmpty":false,"createdAt":"2022-12-21T13:49:45.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/42391047?v=4","public":true,"private":false,"isOrgOwned":true},"refInfo":{"name":"","listCacheKey":"v0:1723110296.0","currentOid":""},"activityList":{"items":[{"before":null,"after":"6b17aed34f8667ce27202ae3883e5ba5b26aa441","ref":"refs/heads/dependabot/github_actions/actions-3bd7fe2d52","pushedAt":"2024-08-08T09:44:56.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"dependabot[bot]","name":null,"path":"/apps/dependabot","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/29110?s=80&v=4"},"commit":{"message":"build(deps): Bump sigstore/cosign-installer in the actions group\n\nBumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).\n\n\nUpdates `sigstore/cosign-installer` from 3.5.0 to 3.6.0\n- [Release notes](https://github.com/sigstore/cosign-installer/releases)\n- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.5.0...v3.6.0)\n\n---\nupdated-dependencies:\n- dependency-name: sigstore/cosign-installer\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>","shortMessageHtmlLink":"build(deps): Bump sigstore/cosign-installer in the actions group"}},{"before":"250a9939979ffbeed5056eb9d1ca4cc07035e79a","after":null,"ref":"refs/heads/LucaGuerra-patch-2","pushedAt":"2024-08-02T16:00:32.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"}},{"before":"068f0f2dc9ff141d7fa750e4f40be680e4c15a21","after":"342b20dc7d58b9bc1883c809cbed25f21920e754","ref":"refs/heads/main","pushedAt":"2024-08-02T16:00:30.000Z","pushType":"pr_merge","commitsCount":2,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"update(rule): update description\n\nSigned-off-by: Luca Guerra <luca@guerra.sh>","shortMessageHtmlLink":"update(rule): update description"}},{"before":"e21150f967c0aae175fbd776bc132f6401bc78ec","after":"250a9939979ffbeed5056eb9d1ca4cc07035e79a","ref":"refs/heads/LucaGuerra-patch-2","pushedAt":"2024-08-02T15:59:36.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"LucaGuerra","name":"Luca Guerra","path":"/LucaGuerra","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/35580196?s=80&v=4"},"commit":{"message":"update(rule): update description\n\nSigned-off-by: Luca Guerra <luca@guerra.sh>","shortMessageHtmlLink":"update(rule): update description"}},{"before":"f51152029bec923e6ce2cb1ca1b3d9182a86947e","after":"e21150f967c0aae175fbd776bc132f6401bc78ec","ref":"refs/heads/LucaGuerra-patch-2","pushedAt":"2024-08-02T15:48:50.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"LucaGuerra","name":"Luca Guerra","path":"/LucaGuerra","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/35580196?s=80&v=4"},"commit":{"message":"update(rule): update description\n\nSigned-off-by: Luca Guerra <luca@guerra.sh>","shortMessageHtmlLink":"update(rule): update description"}},{"before":null,"after":"f51152029bec923e6ce2cb1ca1b3d9182a86947e","ref":"refs/heads/LucaGuerra-patch-2","pushedAt":"2024-08-02T09:54:06.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"LucaGuerra","name":"Luca Guerra","path":"/LucaGuerra","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/35580196?s=80&v=4"},"commit":{"message":"fix(incubating_rules): revert #508\n\nSigned-off-by: Luca Guerra <luca@guerra.sh>","shortMessageHtmlLink":"fix(incubating_rules): revert #508"}},{"before":"28b98b6f5f2fd1c1a82fc96c07bc844db33eb7cd","after":"068f0f2dc9ff141d7fa750e4f40be680e4c15a21","ref":"refs/heads/main","pushedAt":"2024-07-18T14:08:27.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"changing line length limit to 130\n\nSigned-off-by: h4l0gen <ks3913688@gmail.com>","shortMessageHtmlLink":"changing line length limit to 130"}},{"before":"baade76b0633a48577a7db588fba60af10a07706","after":null,"ref":"refs/heads/darryk10-patch-1","pushedAt":"2024-06-27T19:22:52.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"}},{"before":"c0a9bf17d5451340ab8a497efae1b8a8bd95adcb","after":"28b98b6f5f2fd1c1a82fc96c07bc844db33eb7cd","ref":"refs/heads/main","pushedAt":"2024-06-27T19:22:50.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"fix: fixed output issues within the sandbox ruleset\n\nSigned-off-by: Stefano Chierici <stefano.chierici@sysdig.com>\n\nSigned-off-by: schie <77834235+darryk10@users.noreply.github.com>","shortMessageHtmlLink":"fix: fixed output issues within the sandbox ruleset"}},{"before":null,"after":"baade76b0633a48577a7db588fba60af10a07706","ref":"refs/heads/darryk10-patch-1","pushedAt":"2024-06-27T19:13:24.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"darryk10","name":"schie","path":"/darryk10","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/77834235?s=80&v=4"},"commit":{"message":"fix: fixed output issues within the sandbox ruleset\n\nSigned-off-by: Stefano Chierici <stefano.chierici@sysdig.com>\n\nSigned-off-by: schie <77834235+darryk10@users.noreply.github.com>","shortMessageHtmlLink":"fix: fixed output issues within the sandbox ruleset"}},{"before":"ea8f7925899c0dc28b07acb68f35a5b2bd72682c","after":"c0a9bf17d5451340ab8a497efae1b8a8bd95adcb","ref":"refs/heads/main","pushedAt":"2024-06-12T13:29:44.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"vote: update(OWNERS): add loresuso to approvers\n\nSigned-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>","shortMessageHtmlLink":"vote: update(OWNERS): add loresuso to approvers"}},{"before":"45de72c8ccf7c59ab0028d5276dd5c7fffee4c87","after":null,"ref":"refs/heads/darryk10-patch-1","pushedAt":"2024-06-11T18:18:41.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"}},{"before":"ea57e78ea189ba5810946b5dbb8c65080db0bb45","after":"ea8f7925899c0dc28b07acb68f35a5b2bd72682c","ref":"refs/heads/main","pushedAt":"2024-06-11T18:18:40.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"fix: fixed output issues within the incubating ruleset\n\nSigned-off-by: Stefano Chierici <stefano.chierici@sysdig.com>\n\nSigned-off-by: schie <77834235+darryk10@users.noreply.github.com>","shortMessageHtmlLink":"fix: fixed output issues within the incubating ruleset"}},{"before":null,"after":"45de72c8ccf7c59ab0028d5276dd5c7fffee4c87","ref":"refs/heads/darryk10-patch-1","pushedAt":"2024-06-11T07:45:45.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"darryk10","name":"schie","path":"/darryk10","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/77834235?s=80&v=4"},"commit":{"message":"fix: fixed output issues within the incubating ruleset\n\nSigned-off-by: Stefano Chierici <stefano.chierici@sysdig.com>\n\nSigned-off-by: schie <77834235+darryk10@users.noreply.github.com>","shortMessageHtmlLink":"fix: fixed output issues within the incubating ruleset"}},{"before":"994ec44520db6721dd1c000b98512ba5f6f52208","after":null,"ref":"refs/heads/darryk10-patch-1","pushedAt":"2024-06-06T15:59:26.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"}},{"before":"36f4320a46ca867144237259bc07bec798922999","after":"ea57e78ea189ba5810946b5dbb8c65080db0bb45","ref":"refs/heads/main","pushedAt":"2024-06-06T15:59:24.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"Update falco_rules.yaml\n\nSigned-off-by: Stefano Chierici <stefano.chierici@sysdig.com>\n\nSigned-off-by: schie <77834235+darryk10@users.noreply.github.com>","shortMessageHtmlLink":"Update falco_rules.yaml"}},{"before":null,"after":"994ec44520db6721dd1c000b98512ba5f6f52208","ref":"refs/heads/darryk10-patch-1","pushedAt":"2024-06-06T15:44:50.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"darryk10","name":"schie","path":"/darryk10","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/77834235?s=80&v=4"},"commit":{"message":"Update falco_rules.yaml\n\nSigned-off-by: Stefano Chierici <stefano.chierici@sysdig.com>\n\nSigned-off-by: schie <77834235+darryk10@users.noreply.github.com>","shortMessageHtmlLink":"Update falco_rules.yaml"}},{"before":"df963b6bcdf340200fd19a7d253eaf113df40008","after":"36f4320a46ca867144237259bc07bec798922999","ref":"refs/heads/main","pushedAt":"2024-06-06T15:30:23.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"fix: Missing % in \"Unexpected UDP Traffic\" output rule\n\nSigned-off-by: Damien DELPORTE <damien.delporte@doctolib.com>","shortMessageHtmlLink":"fix: Missing % in \"Unexpected UDP Traffic\" output rule"}},{"before":"ad27109fa2d9653737ee1651662b8200701ffddf","after":"df963b6bcdf340200fd19a7d253eaf113df40008","ref":"refs/heads/main","pushedAt":"2024-05-31T09:59:59.000Z","pushType":"pr_merge","commitsCount":2,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"cleanup: remove `startswith /etc`\n\nIn macro `sensitive_files` the `startswith /etc` is redundant because it\nused in combination with the `in` condition\n\nSigned-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>","shortMessageHtmlLink":"cleanup: remove <code>startswith /etc</code>"}},{"before":"256a2d770a82c8937deeb0db8e4ffa4ede7dc1c3","after":null,"ref":"refs/heads/LucaGuerra-patch-2","pushedAt":"2024-05-30T14:35:58.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"}},{"before":"679a50aa5c1593dfae7eb66261cb3dcec82cea76","after":"ad27109fa2d9653737ee1651662b8200701ffddf","ref":"refs/heads/main","pushedAt":"2024-05-30T14:35:56.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"chore(gha): add 0.38.0 to supported Falco versions\n\nSigned-off-by: Luca Guerra <luca@guerra.sh>","shortMessageHtmlLink":"chore(gha): add 0.38.0 to supported Falco versions"}},{"before":null,"after":"256a2d770a82c8937deeb0db8e4ffa4ede7dc1c3","ref":"refs/heads/LucaGuerra-patch-2","pushedAt":"2024-05-30T13:18:24.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"LucaGuerra","name":"Luca Guerra","path":"/LucaGuerra","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/35580196?s=80&v=4"},"commit":{"message":"chore(gha): add 0.38.0 to supported Falco versions\n\nSigned-off-by: Luca Guerra <luca@guerra.sh>","shortMessageHtmlLink":"chore(gha): add 0.38.0 to supported Falco versions"}},{"before":"9e56293b55dac24c8f124b5b7aebfec07a6b4f5e","after":"679a50aa5c1593dfae7eb66261cb3dcec82cea76","ref":"refs/heads/main","pushedAt":"2024-05-29T14:13:50.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"Create OWNERS\n\nAdded myself to maintainers for rules\n\nSigned-off-by: Stefano Chierici <stefano.chierici@sysdig.com>","shortMessageHtmlLink":"Create OWNERS"}},{"before":"87c6d145960274efd5bb868957b224751e2107b4","after":null,"ref":"refs/heads/leogr-patch-1","pushedAt":"2024-05-22T09:42:21.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"}},{"before":"59bf03bf740b41b74c2dfad1e25179f2c30f92c0","after":"9e56293b55dac24c8f124b5b7aebfec07a6b4f5e","ref":"refs/heads/main","pushedAt":"2024-05-22T09:42:19.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"fix(.github/workflow): strict naming convention for changed rules files\n\nSigned-off-by: Leonardo Grasso <me@leonardograsso.com>","shortMessageHtmlLink":"fix(.github/workflow): strict naming convention for changed rules files"}},{"before":null,"after":"87c6d145960274efd5bb868957b224751e2107b4","ref":"refs/heads/leogr-patch-1","pushedAt":"2024-05-22T09:33:43.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"leogr","name":"Leonardo Grasso","path":"/leogr","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/3390997?s=80&v=4"},"commit":{"message":"fix(.github/workflow): strict naming convention for changed rules files\n\nSigned-off-by: Leonardo Grasso <me@leonardograsso.com>","shortMessageHtmlLink":"fix(.github/workflow): strict naming convention for changed rules files"}},{"before":"29c41c4eed4bbc51aaf5be0f3ea332a66ef54e31","after":"59bf03bf740b41b74c2dfad1e25179f2c30f92c0","ref":"refs/heads/main","pushedAt":"2024-05-20T11:39:10.000Z","pushType":"pr_merge","commitsCount":3,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"chore: bump engine version for incubating rules\n\nSigned-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>","shortMessageHtmlLink":"chore: bump engine version for incubating rules"}},{"before":"4f153f53aee76351b3f51438c8c3a28bba1b1210","after":"29c41c4eed4bbc51aaf5be0f3ea332a66ef54e31","ref":"refs/heads/main","pushedAt":"2024-05-14T09:13:45.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"fix: change CVE-2024-3094 to match liblzma contain instead of endswith\n\nSigned-off-by: Edgaras <edgaras@apsega.lt>","shortMessageHtmlLink":"fix: change <a title=\"CVE-2024-3094\" data-hovercard-type=\"advisory\" data-hovercard-url=\"/advisories/GHSA-rxwq-x6h5-x525/hovercard\" href=\"https://github.com/advisories/GHSA-rxwq-x6h5-x525\">CVE-2024-3094</a> to match liblzma contain instead of endswith"}},{"before":"e65f2518b06b6e439b49451a0738115f74d224e0","after":"4f153f53aee76351b3f51438c8c3a28bba1b1210","ref":"refs/heads/main","pushedAt":"2024-04-30T16:14:51.000Z","pushType":"pr_merge","commitsCount":2,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"fix: add `\"\"` case for user.name\n\nSigned-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>","shortMessageHtmlLink":"fix: add <code>\"\"</code> case for user.name"}},{"before":"ec255e68f4cc05ce91d641e36f1855b4435556d5","after":"e65f2518b06b6e439b49451a0738115f74d224e0","ref":"refs/heads/main","pushedAt":"2024-04-23T09:02:17.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"poiana","name":"poiana","path":"/poiana","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/51138685?s=80&v=4"},"commit":{"message":"rule(write_etc_common): Ignore writes by etckeeper under /etc/.git/\n\nEvery time etckeeper update the git history of the content in /etc/, it update\nfiles in /etc/.git/ (nd /etc/.etckeeper).  This trigger a warning from falco about\nwrites in /etc/ for every time the cron job or package update.  This change tell\nthe write_etc_common macro to ignore all writes under /etc/.git/ by a\nprocess whos anchestor is etckeeper and one of the scripts called by etckeeper\nto do the /etc/.git updates.\n\n/kind bug\n/kind design\n/kind feature\n/area rules\n\nSigned-off-by: Petter Reinholdtsen <pere@hungry.com>","shortMessageHtmlLink":"rule(write_etc_common): Ignore writes by etckeeper under /etc/.git/"}}],"hasNextPage":true,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"djE6ks8AAAAElRNHIQA","startCursor":null,"endCursor":null}},"title":"Activity · falcosecurity/rules"}