diff --git a/pkg/ruleengine/v1/r1001_exec_binary_not_in_base_image.go b/pkg/ruleengine/v1/r1001_exec_binary_not_in_base_image.go index ac21de22..ec53edd2 100644 --- a/pkg/ruleengine/v1/r1001_exec_binary_not_in_base_image.go +++ b/pkg/ruleengine/v1/r1001_exec_binary_not_in_base_image.go @@ -68,8 +68,6 @@ func (rule *R1001ExecBinaryNotInBaseImage) ProcessEvent(eventType utils.EventTyp return nil } - execPath := getExecPathFromEvent(execEvent) - ruleFailure := GenericRuleFailure{ BaseRuntimeAlert: apitypes.BaseRuntimeAlert{ AlertName: rule.Name(), @@ -88,8 +86,8 @@ func (rule *R1001ExecBinaryNotInBaseImage) ProcessEvent(eventType utils.EventTyp Pcomm: execEvent.Pcomm, Cwd: execEvent.Cwd, Hardlink: execEvent.ExePath, - Path: execPath, - Cmdline: fmt.Sprintf("%s %s", execPath, strings.Join(utils.GetExecArgsFromEvent(execEvent), " ")), + Path: getExecFullPathFromEvent(execEvent), + Cmdline: fmt.Sprintf("%s %s", getExecPathFromEvent(execEvent), strings.Join(utils.GetExecArgsFromEvent(execEvent), " ")), }, ContainerID: execEvent.Runtime.ContainerID, },