Merge pull request #14 from chainguard-dev/false-positives

False-positive update: Chrome, /usr/local/bin

detection/c2/unexpected-talkers-linux.sql

@@ -109,5 +109,12 @@ WHERE
     AND s.protocol = 6
     AND p.euid > 500
   )
+  AND NOT (
+    p.name = 'chrome'
+    AND f.filename = 'chrome'
+    AND s.remote_port > 5000
+    AND s.protocol = 6
+    AND p.euid > 500
+  )
 GROUP BY
   p.cmdline

detection/execution/unexpected-gatekeeper-approvals-macos.sql

@@ -27,6 +27,7 @@ FROM
 WHERE
   gap.path NOT LIKE '/Users/%/bin/%'
   AND gap.path NOT LIKE '/Users/%/rekor-cli'
+  AND gap.path NOT LIKE '/usr/local/bin/%'
   AND gap.path NOT LIKE '/Users/%/scorecard-darwin-amd64'
   AND gap.path NOT LIKE '/Users/%/scorecard-darwin-amd64'
   AND gap.path NOT LIKE '/Users/%/configure'