diff --git a/rules/cloud/azure_kubernetes_role_access.yml b/rules/cloud/azure_kubernetes_role_access.yml index 553711eca..74b5c4ae1 100644 --- a/rules/cloud/azure_kubernetes_role_access.yml +++ b/rules/cloud/azure_kubernetes_role_access.yml @@ -28,4 +28,5 @@ level: medium tags: - attack.impact falsepositives: - - ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. + - ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. + - ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.