{"action":"created","issue":{"url":"https://api.github.com/repos/draios/falco/issues/274","repository_url":"https://api.github.com/repos/draios/falco","labels_url":"https://api.github.com/repos/draios/falco/issues/274/labels{/name}","comments_url":"https://api.github.com/repos/draios/falco/issues/274/comments","events_url":"https://api.github.com/repos/draios/falco/issues/274/events","html_url":"https://github.com/draios/falco/issues/274","id":258501975,"number":274,"title":"Rule to alert on file renaming, deletion","user":{"login":"finid","id":1239372,"avatar_url":"https://avatars1.githubusercontent.com/u/1239372?v=4","gravatar_id":"","url":"https://api.github.com/users/finid","html_url":"https://github.com/finid","followers_url":"https://api.github.com/users/finid/followers","following_url":"https://api.github.com/users/finid/following{/other_user}","gists_url":"https://api.github.com/users/finid/gists{/gist_id}","starred_url":"https://api.github.com/users/finid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/finid/subscriptions","organizations_url":"https://api.github.com/users/finid/orgs","repos_url":"https://api.github.com/users/finid/repos","events_url":"https://api.github.com/users/finid/events{/privacy}","received_events_url":"https://api.github.com/users/finid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2017-09-18T14:32:18Z","updated_at":"2017-10-04T20:01:06Z","closed_at":null,"author_association":"NONE","body":"Hello:\r\n\r\nWant Falco to alert when a file is renamed or deleted from within a certain directory by a non-system user. So I set up this list:\r\n\r\n```\r\n- list: nonsystem_users\r\n  items: [root, user1, user2]\r\n```\r\n\r\nThen this rule that references it:\r\n\r\n```\r\n- rule: Rename, delete files\r\n  desc: a particular file has been renamed or deleted\r\n  condition: part_dir and evt.type = rename and user.name in (nonsystem_users)\r\n  output: \"File below this dir has been renamed (user=%user.name command=%proc.cmdline file=%fd.name)\"\r\n  priority: ERROR\r\n  tags: [filesystem]\r\n```\r\n\r\npart_dir is a macro that points to the particular directory. Falco did not spew an error after restarting, but the above rule never triggers an alert.\r\n\r\nIs there something I'm missing here? In place of `evt.type = rename`, I also used `evt.type = unlink`. It too, did not work.\r\n\r\nTIA"},"comment":{"url":"https://api.github.com/repos/draios/falco/issues/comments/334272372","html_url":"https://github.com/draios/falco/issues/274#issuecomment-334272372","issue_url":"https://api.github.com/repos/draios/falco/issues/274","id":334272372,"user":{"login":"finid","id":1239372,"avatar_url":"https://avatars1.githubusercontent.com/u/1239372?v=4","gravatar_id":"","url":"https://api.github.com/users/finid","html_url":"https://github.com/finid","followers_url":"https://api.github.com/users/finid/followers","following_url":"https://api.github.com/users/finid/following{/other_user}","gists_url":"https://api.github.com/users/finid/gists{/gist_id}","starred_url":"https://api.github.com/users/finid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/finid/subscriptions","organizations_url":"https://api.github.com/users/finid/orgs","repos_url":"https://api.github.com/users/finid/repos","events_url":"https://api.github.com/users/finid/events{/privacy}","received_events_url":"https://api.github.com/users/finid/received_events","type":"User","site_admin":false},"created_at":"2017-10-04T20:01:06Z","updated_at":"2017-10-04T20:01:06Z","author_association":"NONE","body":"Yes, I'll take a stab at this again, and make the trace file available. What I'm actually trying to do is implement a rule that gives me some of what OSSEC does, which would be nice to have in Falco's base rule.\r\n\r\nAnd thanks for the pointer about `fd.directory`."}}
{"actor":{"display_login":"finid"}}