Apparmor DENIED mknod operation.

Description

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 52000 Apparmor messages grouped. anchor level 3
   decoded_as=kernel AND match="apparmor="
2. 52002 Apparmor DENIED anchor level 3
   match="apparmor="
3. 52004 Apparmor DENIED mknod operation. refinement level 4 this rule
   Matches no fields of its own.

Rule dependencies

Depends on

• composes · Wazuh if_sid 52002
  • Apparmor DENIED

Rule logic