diff --git a/rules/falco-incubating_rules.yaml b/rules/falco-incubating_rules.yaml index ac13988e..58afc491 100644 --- a/rules/falco-incubating_rules.yaml +++ b/rules/falco-incubating_rules.yaml @@ -25,7 +25,7 @@ # Starting with version 8, the Falco engine supports exceptions. # However the Falco rules file does not use them by default. -- required_engine_version: 0.31.0 +- required_engine_version: 0.35.0 - macro: open_write condition: (evt.type in (open,openat,openat2) and evt.is_open_write=true and fd.typechar='f' and fd.num>=0)