Falco low stable other
Network Connection outside Local Subnet
Detect network traffic (inbound or outbound) from a container to a destination outside the local subnet. To operationalize this rule, profile your environment and update the template macro namespace_scope_network_only_subnet. Customizing network-related rules usually demands substantial engineering effort to ensure their functionality.
Detection Logic
inbound_outbound and container and k8s.ns.name in (namespace_scope_network_only_subnet) and not network_local_subnet Field Validations
Loading…
Comments (0)
Loading comments...