From f63b4147cea7cd7e72683a1dc6abb012ed136caa Mon Sep 17 00:00:00 2001 From: frack113 <62423083+frack113@users.noreply.github.com> Date: Mon, 9 Aug 2021 10:06:31 +0200 Subject: [PATCH] formatting falsepositives --- rules/cloud/azure_kubernetes_role_access.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/cloud/azure_kubernetes_role_access.yml b/rules/cloud/azure_kubernetes_role_access.yml index 553711eca..74b5c4ae1 100644 --- a/rules/cloud/azure_kubernetes_role_access.yml +++ b/rules/cloud/azure_kubernetes_role_access.yml @@ -28,4 +28,5 @@ level: medium tags: - attack.impact falsepositives: - - ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. + - ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. + - ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.