Access Camera

content/en/docs/reference/rules/examples/access_camera.md

latest294 B

yaml

- rule: access_camera
  desc: a process other than skype/webex tries to access the camera
  condition: evt.type = open and fd.name = /dev/video0 and not proc.name in (skype, webex)
  output: Unexpected process opening camera video device | command=%proc.cmdline
  priority: WARNING