diff --git a/rules/falco-incubating_rules.yaml b/rules/falco-incubating_rules.yaml index 6dbd30d0..27174c6d 100644 --- a/rules/falco-incubating_rules.yaml +++ b/rules/falco-incubating_rules.yaml @@ -25,7 +25,7 @@ # Starting with version 8, the Falco engine supports exceptions. # However the Falco rules file does not use them by default. -- required_engine_version: "0.26.0" +- required_engine_version: 0.26.0 - macro: open_write condition: (evt.type in (open,openat,openat2) and evt.is_open_write=true and fd.typechar='f' and fd.num>=0) diff --git a/rules/falco-sandbox_rules.yaml b/rules/falco-sandbox_rules.yaml index 932d4c09..945244b8 100644 --- a/rules/falco-sandbox_rules.yaml +++ b/rules/falco-sandbox_rules.yaml @@ -25,7 +25,7 @@ # Starting with version 8, the Falco engine supports exceptions. # However the Falco rules file does not use them by default. -- required_engine_version: "0.26.0" +- required_engine_version: 0.26.0 # Currently disabled as read/write are ignored syscalls. The nearly # similar open_write/open_read check for files being opened for diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index f1a3ec6a..c3738b0c 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -25,7 +25,7 @@ # Starting with version 8, the Falco engine supports exceptions. # However the Falco rules file does not use them by default. -- required_engine_version: "0.26.0" +- required_engine_version: 0.26.0 # Currently disabled as read/write are ignored syscalls. The nearly # similar open_write/open_read check for files being opened for