From 27728c5de4f128f6f5b12730bfad068e3d5da161 Mon Sep 17 00:00:00 2001
From: bbuddha <137881590+0xbbuddha@users.noreply.github.com>
Date: Thu, 16 Oct 2025 15:35:21 +0200
Subject: [PATCH] better if_matched

---
 rules/event_tetragon_whitelist.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/event_tetragon_whitelist.xml b/rules/event_tetragon_whitelist.xml
index 21d67ac..4329171 100644
--- a/rules/event_tetragon_whitelist.xml
+++ b/rules/event_tetragon_whitelist.xml
@@ -1,6 +1,6 @@
 <group name="tetragon,">
   <rule id="120001" level="2">
-    <if_sid>110111</if_sid>
+    <if_matched_sid>110111</if_matched_sid>
     <field name="process_kprobe.process.binary">/usr/sbin/exim4$</field>
     <description>Credential changes by exim4 - Expected behavior</description>
     <group>tetragon,credentials</group>