aws-cni emits excessive logs

[whiskeyjimbo]

aws-cni for eks hits rule Change thread namespace - an attempt to change a program/thread\'s namespace (commonly done as a part of creating a container) by calling setns. quite a bit causing an excessive amount of log messages.

Simple solution would be to add aws-cni to:

falco/rules/falco_rules.yaml

Line 1429 in 0e1c436

sysdig, nsenter, calico, oci-umount)

is that the correct solution though? or one could continue with an override.

[mfdii]

Yes, adding aws-cni there would be the correct solution to reduce the FPs. Would you be able to submit a PR, else we can get it into the next round of rule updates?

[mstemm]

Can you include a full alert example? I'd like to see the context include cmdline, etc.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[fntlnz]

@whiskeyjimbo can you provide more info on this?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[leodido]

/triage needs-information

[leodido]

Closing this since missing info. Comment (and we'll re-open) in case there are details about this.