docs: changes to the policies documentation #3416
Conversation
Signed-off-by: AnaisUrlichs <urlichsanais@gmail.com>
Signed-off-by: AnaisUrlichs <urlichsanais@gmail.com>
docs/docs/policies/rules.md
Outdated
| scope: | ||
| - global | ||
| rules: | ||
| event: TRC-101 |
There was a problem hiding this comment.
| event: TRC-101 | |
| event: TRC-101 |
TRCs are internal ids, we need to use the event name, soon TRCs won't be exposed anymore.
eg:
There was a problem hiding this comment.
What do you mean by soon TRCs won't be exposed anymore?
There was a problem hiding this comment.
We will remove the TRCs ids from tracee.
There was a problem hiding this comment.
@AnaisUrlichs This one still needs to be fixed before we can merge this PR
Co-authored-by: Jose Donizetti <jdbjunior@gmail.com>
Co-authored-by: Jose Donizetti <jdbjunior@gmail.com>
Signed-off-by: AnaisUrlichs <urlichsanais@gmail.com>
docs/docs/policies/index.md
Outdated
| @@ -43,6 +43,6 @@ This policy applies to any workload (global) and will log the dropped_executable | |||
| While specifying event filters is optional, policies must have the `name`, `description`, `scope` and `rules` fields. | |||
|
|
|||
| !!! Note | |||
| A current limitation is that only one rule can be defined per any event type in a policy | |||
| Note that only one rule can be defined per any event type in a policy | |||
There was a problem hiding this comment.
I don't see why this is a limitation -- I know users should be aware of it but I would not call it a limitation
There was a problem hiding this comment.
Ok, but I would add the word "currently" since we want to support more than one rule per event in the future
There was a problem hiding this comment.
oki, sounds good, will add it
|
@yanivagman @itaysk I have added the names for the behavioral signatures -- I think they are all added correctly but for the following, I could not find the right name && the list provided by this one currently is wrong and misses the event name: Note the name here for the event on the left is just the placeholder |
This is its name: https://github.com/aquasecurity/tracee/blob/main/signatures/golang/kubernetes_certificate_theft_attempt.go#L31 Not sure why it is not printed in the list |
Signed-off-by: AnaisUrlichs <urlichsanais@gmail.com>
Signed-off-by: AnaisUrlichs <urlichsanais@gmail.com>
#3403
and
#3398