1name: crowdsecurity/auditd-whitelisted-process
2description: "Whitelist some process that are false-positives prone"
3whitelist:
4  reason: "package managers"
5  expression: 
6    - "all(evt.Overflow.Alert.Events, {.GetMeta('parent_progname') in ['/usr/bin/dpkg', '/usr/bin/dnf']})"
7