From 4a8d8a049fc7238cab1263c1e7130cbc61883ca9 Mon Sep 17 00:00:00 2001 From: kaizhe Date: Tue, 25 Feb 2020 14:14:03 -0800 Subject: [PATCH] add comments Signed-off-by: kaizhe --- rules/falco_rules.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index b81169308f3..15205bdaf56 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2647,6 +2647,8 @@ - macro: net_miner_pool condition: (evt.type in (sendto, sendmsg) and evt.dir=< and (fd.net != "127.0.0.0/8" and not fd.snet in (rfc_1918_addresses)) and ((minerpool_http) or (minerpool_https) or (minerpool_other))) +# The rule is disabled by default. +# Note: falco will send DNS request to resolve miner pool domain which may trigger alerts in your environment. - rule: Detect outbound connections to common miner pool ports desc: Miners typically connect to miner pools on common ports. condition: net_miner_pool