rules update: add fluent/fluentd-kubernetes-daemonset to clear log tr…

…usted images Signed-off-by: kaizhe <derek0405@gmail.com>
falcosecurity · Sep 26, 2019 · 79a10ad · 79a10ad
1 parent c0721b3
commit 79a10ad
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -2356,7 +2356,8 @@
   condition: (never_true)
 
 - macro: trusted_logging_images
-  condition: (container.image.repository endswith "splunk/fluentd-hec")
+  condition: (container.image.repository endswith "splunk/fluentd-hec" or
+              container.image.repository endswith "fluent/fluentd-kubernetes-daemonset")
 
 - rule: Clear Log Activities
   desc: Detect clearing of critical log files