Merge pull request #435 from chainguard-dev/lorimor/AllowKeybaseAsDis…

…kImageSource Add Keybase hosts to allowed disk image source list
chainguard-dev · Dec 26, 2024 · 8a42b80 · 8a42b80
2 parents 2a74734 + f0da208
commit 8a42b80
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/detection/initial_access/unexpected-diskimage-source-macos.sql b/detection/initial_access/unexpected-diskimage-source-macos.sql
@@ -201,6 +201,7 @@ WHERE
     'gitbutler.com',
     'go.dev',
     'imazing.com',
+    'keybase.io',
     'kittycad.io',
     'krisp.ai',
     'macroplant.com',
@@ -221,6 +222,7 @@ WHERE
     'persistent.oaistatic.com',
     'portswigger-cdn.net',
     'posit.co',
+    'prerelease.keybase.io',
     'presenting.app',
     'proton.me',
     'rancherdesktop.io',