auditd-whitelisted-process
Postoverflow
- Version
- 0.2
Whitelist some process that are false-positives prone
Install with a top-level collection
2 collections include itsudo cscli collections install crowdsecurity/auditdInstalls 1 parser and 6 scenarios.
View Auditd - Post-Exploitation Detection →Installation
sudo cscli postoverflows install crowdsecurity/auditd-whitelisted-processThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/auditd-whitelisted-processdescription: "Whitelist some process that are false-positives prone"whitelist:reason: "package managers"expression:- "all(evt.Overflow.Alert.Events, {.GetMeta('parent_progname') in ['/usr/bin/dpkg', '/usr/bin/dnf']})"
Installed on
Know where it runs
Sign in to see the Security Engines that run this postoverflow, the version they run and whether it was modified locally.