Update launch_suspicious_network_tool_in_container.go

Signed-off-by: Kapil Sharma <[email protected]>
falcosecurity · Apr 3, 2024 · f1ade29 · f1ade29
1 parent 8eb4381
commit f1ade29
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/events/syscall/launch_suspicious_network_tool_in_container.go b/events/syscall/launch_suspicious_network_tool_in_container.go
@@ -20,7 +20,10 @@ import (
     "github.com/falcosecurity/event-generator/events"
 )
 
-var _ = events.Register(LaunchSuspiciousNetworkToolInContainer)
+var _ = events.Register(
+    LaunchSuspiciousNetworkToolInContainer,
+    events.WithDisabled(), // this rule is not included in falco_rules.yaml (stable rules), so disable the action
+)
 
 func LaunchSuspiciousNetworkToolInContainer(h events.Helper) error {
     if h.InContainer() {