update(falco/rules): re-use spawned_process macro inside `container…

…_started` macro Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
falcosecurity · Oct 26, 2020 · bc9a2f3 · bc9a2f3
1 parent c188f4a
commit bc9a2f3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -522,7 +522,7 @@
 - macro: container_started
   condition: >
     ((evt.type = container or
-     (evt.type=execve and evt.dir=< and proc.vpid=1)) and
+     (spawned_process and proc.vpid=1)) and
      container.image.repository != incomplete)
 
 - macro: interactive