Added an event for default rule "Detect outbound connections to common miner pool ports" #176
Conversation
…rPoolPorts Signed-off-by: GLVS Kiriti <glvskiriti2003369@gmail.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: GLVSKiriti The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
As this rule is disabled by default so I enabled it at here. And on executing event code it is producing critical priority log as expected in left terminal. And now test is also successful!
|
Signed-off-by: GLVS Kiriti <glvskiriti2003369@gmail.com>
| h.Log().Warnf("Curl is needed to launch this action") | ||
| return err | ||
| } | ||
| cmd := exec.Command(curl, "http://mine.moneropool.com") |
There was a problem hiding this comment.
Mmh is GETting this link safe?
There was a problem hiding this comment.
Dont have an idea about that . I executed in my system 🙃
There was a problem hiding this comment.
Regardless if it's safe or not, this approach will make the action unpredictable (that worries me more).
Are there any alternative approaches that do not involve talking with external servers? 🤔
There was a problem hiding this comment.
@FedeDP @leogr if we are worrying about this
Mmh is GETting this link safe?
then why cant we follow this approach i.e, let us add any example domain in the rule here, which can be used for testing purposes. So after that we can curl example.com which triggers the rule and safe to GET the request. WDYT? about this approach. IMO instead of curling the suspicious domains we can do this which will be beneficial for testing purposes
- list: http_miner_domains
items: [
"ca.minexmr.com",
"de.minexmr.com",
"fr.minexmr.com",
"mine.moneropool.com",
"mine.xmrpool.net",
"pool.minexmr.com",
"sg.minexmr.com",
"xmr.crypto-pool.fr",
"example.com" # Not a miner domain but used for testing purposes in falco
]
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area events
What this PR does / why we need it:
Added an event for default rule "Detect outbound connections to common miner pool ports"
Which issue(s) this PR fixes:
Fixes #174
Special notes for your reviewer: