Adding enrichment to rules

Signed-off-by: Amit Schendel <[email protected]>
kubescape · Jul 3, 2024 · 1820deb · 1820deb
1 parent 8de28e0
commit 1820deb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/pkg/ruleengine/v1/r1012_hardlink_created_over_sensitive_file.go b/pkg/ruleengine/v1/r1012_hardlink_created_over_sensitive_file.go
@@ -104,6 +104,8 @@ func (rule *R1012HardlinkCreatedOverSensitiveFile) ProcessEvent(eventType utils.
 						UpperLayer: &hardlinkEvent.UpperLayer,
 						Uid:        &hardlinkEvent.Uid,
 						Gid:        &hardlinkEvent.Gid,
+						Path:       hardlinkEvent.ExePath,
+						Hardlink:   hardlinkEvent.ExePath,
 					},
 					ContainerID: hardlinkEvent.Runtime.ContainerID,
 				},