Completed upto lesson 28

lab/lesson-20-falco-rule.yaml

@@ -0,0 +1,15 @@
+- rule: custom_rule
+  desc: custom_rule
+  source: syscall
+  condition: >
+   (evt.type in (execve, execveat)) and
+   container.id != host and
+   k8s.ns.name = "payments" and
+   (proc.name = bash or
+   proc.name = sh)
+  output: >
+   %k8s.pod.name,%k8s.ns.name,%proc.cmdline,%container.name
+  priority: WARNING
+  tags: [container,mitre_execution]
+
+