All pull requests

Pull requests

• build(deps): Bump the actions group across 1 directory with 2 updates

  dco-signoff: yesdependenciesgithub_actionsneeds-kindsize/XS
  #402·dependabot[bot] opened Nov 9, 2026Bot·

  ·
  2

• Add rke2 conditions to containerd_activities macro

  area/maturity-stablearea/rulesdco-signoff: yeskind/featuresize/XS
  #401·D3luxee opened Nov 5, 2026·

  ·
  2

• fix(sandbox): use proc.pcmdline in azure_scripts_writing_conf

  area/maturity-sandboxarea/rulesdco-signoff: yeskind/bugsize/XS
  #400·RaphaelFakhri opened Nov 5, 2026·

  ·
  1

  2

• update(falco_rules): treat php-fpm as a protected shell spawner

  area/maturity-stablearea/rulesdco-signoff: yeskind/featuresize/S
  #398·yusufyildiz34 opened Nov 1, 2026·

  ·
  2

• new(rules): detect file capabilities set with setcap (T1548)

  area/maturity-sandboxarea/rulesdco-signoff: yeskind/featuresize/S
  #397·bryand410 opened Oct 30, 2026·

  ·
  2

• feat(rules): add DECTRAX cyber deception and honeytoken ruleset

  area/maturity-sandboxarea/rulesdco-signoff: yeskind/featuresize/L
  #395·Sadman-TheDentian opened Oct 25, 2026·

  ·
  2

• new(rules): detect AI coding agents launched without approvals during NPM install

  area/maturity-sandboxarea/rulesdco-signoff: yeskind/featuresize/L
  #394·basitalisandhu opened Oct 19, 2026·

  ·
  5

• fix(rules): exclude in-process image layer extraction by dockerd

  area/maturity-incubatingarea/maturity-sandboxarea/maturity-stablearea/rulesdco-signoff: yeskind/bugsize/M
  #393·luiacuaniello opened Oct 17, 2026Contributor·

  ·
  8

• chore(.github): add Falco 0.45.0 and 0.45.1 to the testing matrix

  approvedarea/automationdco-signoff: yeskind/featuresize/XS
  #388·leogr opened Sep 21, 2026Member·

  ·
  3

• fix(falco_rules): handle "sh -c --" and tighten postgres_running_cnpg

  area/maturity-stablearea/rulesdco-signoff: yeskind/bugsize/S
  #387·scribblrsam opened Sep 18, 2026·

  ·
  1

  4

• Add sandbox rule for container escape via kernel usermode helper overwrite

  dco-signoff: yessize/S
  #381·ChrisJr404 opened Aug 26, 2026·

  ·
  5

• new(rules): detect security tool impairment in containers (T1562.001)

  dco-signoff: yeslifecycle/stalesize/M
  #367·JayKnowSo opened May 15, 2026·

  ·
  12

• docs: add STYLE_GUIDE.md for rules doc comments (closes #150)

  dco-signoff: yessize/XL
  #364·koiakoia opened Apr 29, 2026·

  ·
  1

  18

  

• feat(rules): detect container shell spawn for MITRE T1059

  dco-signoff: yessize/M
  #363·JayKnowSo opened Apr 20, 2026·

  ·
  14