Skip to content

Commit

Permalink
[Compute CWP-39605]: Language fix
Browse files Browse the repository at this point in the history
  • Loading branch information
divyabhushan committed Apr 10, 2023
1 parent a7035fc commit 2d2900c
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions compute/admin_guide/runtime_defense/runtime_audits.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -110,14 +110,14 @@ Hosts
* Enable and disable this detection via the *Reverse shell attacks* toggle, under the Runtime rule Processes / Anti-malware tab.
* Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes *Allowed* list.
|<processes> is a reverse shell . Full command: <path>
|<processes> is a reverse shell. Full command: <path>
|xref:incident_types/reverse_shell.adoc[Reverse shell]
|
Containers,
Hosts

|Suid Binaries
|Indicates that a process is running with high priviliges, by watching for binaries with the setuid bit that are executed.
|Indicates that a process is running with high privileges, by watching for binaries with the setuid bit that are executed.

* Enable and disable this detection via the *Processes started with SUID* toggle, under the Runtime rule Processes tab.
Expand Down Expand Up @@ -325,7 +325,7 @@ Hosts
|Explicitly Denied Listening Port
|Indicates a container process is listening on a port that is explicitly listed in the *Listening ports* list, under *Denied & fallback*.

For App-embedded, this indicates ports that are not listed in the Allowed Listening ports list, or they are on denied list.
For App-embedded, this indicates ports that are not listed in the Allowed Listening ports list, or they are on the denied list.

|Process <process name> is listening on port <port> explicitly denied by a runtime rule

Expand All @@ -338,7 +338,7 @@ App-embedded
|Explicitly Denied Outbound Port
|Indicates a container process uses an outbound port that is explicitly listed in the *Outbound internet ports* list under *Denied & fallback*.

For App-embedded, this indicates ports that are not listed in the *Outbound ports* list under *Allowed*, or they are on denied list.
For App-embedded, this indicates ports that are not listed in the *Outbound ports* list under *Allowed*, or they are on the denied list.

|Outbound connection <process> to port <destination port> (IP: <destination ip>) is explicitly denied by a runtime rule.

Expand Down Expand Up @@ -425,7 +425,7 @@ Containers,
App-Embedded

|SSH Access
|Indicates that a ssh config file was accessed
|Indicates that an ssh config file was accessed

* Enable and disable this detection via the *Changes to SSH and admin account configuration files* toggle, under the Container/App-Embedded Runtime rule's File system tab.
* To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process.
Expand Down

0 comments on commit 2d2900c

Please sign in to comment.