Back to Falco

Proc Is New

content/en/docs/reference/rules/default-macros/proc_is_new.md

latest73 B
Original Source
yaml
- macro: proc_is_new
  condition: proc.duration <= 5000000000