diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index b81169308f3..15205bdaf56 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2647,6 +2647,8 @@ - macro: net_miner_pool condition: (evt.type in (sendto, sendmsg) and evt.dir=< and (fd.net != "127.0.0.0/8" and not fd.snet in (rfc_1918_addresses)) and ((minerpool_http) or (minerpool_https) or (minerpool_other))) +# The rule is disabled by default. +# Note: falco will send DNS request to resolve miner pool domain which may trigger alerts in your environment. - rule: Detect outbound connections to common miner pool ports desc: Miners typically connect to miner pools on common ports. condition: net_miner_pool