Falco informational stable other

Update Package Repository

This rule generically detects updates to package repositories and can be seen as an auditing measure. Recommend evaluating its relevance for your specific environment.

View Source

Detection Logic

((open_write and access_repositories) or (modify and modify_repositories)) and not package_mgmt_procs and not package_mgmt_ancestor_procs and not exe_running_docker_save and not user_known_update_package_registry

Field Validations

Loading…

Comments (0)

Loading comments...