updated falco rules files

Signed-off-by: h4l0gen <[email protected]>
falcosecurity · Mar 22, 2024 · 1f2926e · 1f2926e
1 parent 2fd2028
commit 1f2926e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/rules/falco-deprecated_rules.yaml b/rules/falco-deprecated_rules.yaml
@@ -33,7 +33,7 @@
 # Starting with version 8, the Falco engine supports exceptions.
 # However the Falco rules file does not use them by default.
 
-required_engine_version: '0.31.0'
+- required_engine_version: '0.31.0'
 
 # This macro `never_true` is used as placeholder for
 # tuning negative logical sub-expressions, for example

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
@@ -344,7 +344,7 @@
 
 - macro: splunk_running_forwarder
   condition: >
-  (proc.pname=splunkd and proc.cmdline startswith "sh -c /opt/splunkforwarder")
+    (proc.pname=splunkd and proc.cmdline startswith "sh -c /opt/splunkforwarder")
 
 - macro: perl_running_plesk
   condition: >