Open
Description
Description
Even if eBPF event has containerId, and caused a triggering of a signature, the event of the signature comes out with empty containerId.
It seems that when putting in the selector "container" origin, the signature event (with empty containerId) still reaches the signature
Output of tracee version
:
main