diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index ae2d64d4..0589e82f 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -36,8 +36,8 @@
   condition: syscall.type in (remove, rmdir, unlink, unlink_at)
 
 - macro: modify
-  condition: rename or mkdir or remove
-
+  condition: rename or remove
+  
 - macro: spawn_process
   condition: syscall.type = execve
 
@@ -167,37 +167,43 @@
 - rule: write_binary_dir
   desc: an attempt to write to any file below a set of binary directories
   condition: evt.dir = > and open_write and bin_dir
-  output: "Write to bin dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "File below a known binary directory opened for writing (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: write_etc
   desc: an attempt to write to any file below /etc
   condition: evt.dir = > and open_write and etc_dir
-  output: "Write to etc dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "File below /etc opened for writing (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: read_sensitive_file_untrusted
   desc: an attempt to read any sensitive file (e.g. files containing user/password/authentication information). Exceptions are made for known trusted programs.
   condition: open_read and not server_binaries and not userexec_binaries and not proc.name in (iptables, ps, systemd-logind, lsb_release, check-new-relea, dumpe2fs, accounts-daemon, bash) and not cron and sensitive_files
-  output: "Read sensitive file (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Sensitive file opened for reading by non-trusted program (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: read_sensitive_file_trusted_after_startup
   desc: an attempt to read any sensitive file (e.g. files containing user/password/authentication information) by a trusted program after startup. The idea is that trusted programs might read these files at startup to load initial state, but not afterwards.
   condition: open_read and server_binaries and not proc_is_new and sensitive_files
-  output: "Read sensitive file after startup (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Sensitive file opened for reading by trusted program after startup (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: db_program_spawn_process
   desc: a database-server related program spawning a new process after startup. This shouldn\'t occur and is a followon from some SQL injection attacks.
   condition: db_server_binaries and not proc_is_new and spawn_process
-  output: "Read sensitive file after startup (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Database-related program spawned new process after startup (%user.name %proc.name %evt.type %evt.args)"
   priority: WARNING
 
 - rule: modify_binary_dirs
   desc: an attempt to modify any file below a set of binary directories.
-  condition: modify and (bin_dir_rename or bin_dir_mkdir)
-  output: "Modify bin dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  condition: modify and bin_dir_rename
+  output: "File below known binary directory renamed/removed (%user.name %proc.name %evt.type %evt.args %fd.name)"
+  priority: WARNING
+
+- rule: mkdir_binary_dirs
+  desc: an attempt to create a directory below a set of binary directories.
+  condition: mkdir and bin_dir_mkdir
+  output: "Directory below known binary directory created (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 # Don't load shared objects coming from unexpected places
@@ -212,19 +218,19 @@
 - rule: syscall_returns_eaccess
   desc: any system call that returns EACCESS. This is not always a strong indication of a problem, hence the INFO priority.
   condition: evt.res = EACCESS
-  output: "System call returned EACCESS (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "System call returned EACCESS (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: INFO
 
 - rule: change_thread_namespace
   desc: an attempt to change a program/thread\'s namespace (commonly done as a part of creating a container) by calling setns.
   condition: syscall.type = setns and not proc.name in (docker, sysdig, dragent)
-  output: "Unexpected setns (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Namespace change (setns) by unexpected program (%user.name %proc.name %evt.type %evt.args)"
   priority: WARNING
 
 - rule: run_shell_untrusted
   desc: an attempt to spawn a shell by a non-shell program. Exceptions are made for trusted binaries.
   condition: proc.name = bash and evt.dir=< and evt.type in (clone, execve) and proc.pname exists and not parent_cron and not proc.pname in (bash, sshd, sudo, docker, su, tmux, screen, emacs, systemd, flock, fs-bash, nginx, monit, supervisord)
-  output: "Unexpected shell (%user.name %proc.name %proc.pname %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Shell spawned by untrusted binary (%user.name %proc.name %proc.pname %evt.type %evt.args)"
   priority: WARNING
 
 # Anything run interactively by root
@@ -235,51 +241,51 @@
 - rule: system_user_interactive
   desc: an attempt to run interactive commands by a system (i.e. non-login) user
   condition: system_users and interactive
-  output: "System user ran an interactive command (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "System user ran an interactive command (%user.name %proc.name %evt.type %evt.args)"
   priority: WARNING
 
 - rule: chmod_sensitive_files
   desc: an attempt to chmod any important binary or sensitive file (e.g. files containing user/password/authentication information)
   condition: syscall.type = chmod and (system_binaries or sensitive_files)
-  output: "chmod on sensitive file/system binary (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Permissions change (chmod) on sensitive file/system binary (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: run_shell_in_container
   desc: an attempt to spawn a shell by a non-shell program in a container. Container entrypoints are excluded.
   condition: container and proc.name = bash and evt.dir=< and evt.type in (clone, execve) and proc.pname exists and not proc.pname in (bash, docker)
-  output: "shell in a container (%user.name %container.id %container.name %proc.name %proc.pname %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Shell spawned in a container other than entrypoint (%user.name %container.id %container.name %proc.name %proc.pname %evt.type %evt.args)"
   priority: WARNING
 
 # sockfamily ip is to exclude certain processes (like 'groups') that communicate on unix-domain sockets
 - rule: system_binaries_network_activity
   desc: any network activity performed by system binaries that are not expected to send or receive any network traffic
   condition: fd.sockfamily = ip and system_binaries
-  output: "network traffic to %proc.name (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Known system binary sent/received network traffic (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: ssh_error_syslog
   desc: any ssh errors (failed logins, disconnects, ...) sent to syslog
   condition: syslog and ssh_error_message and evt.dir = <
-  output: "sshd error (%proc.name %evt.arg.data)"
+  output: "sshd sent error message to syslog (%proc.name %evt.arg.data)"
   priority: WARNING
 
 - rule: non_sudo_suid
   desc: an attempt to change users by calling setuid. sudo/su are excluded. user "root" is also excluded, as setuid calls typically involve dropping privileges.
   condition: evt.type=setuid and evt.dir=> and not user.name=root and not userexec_binaries
-  output: "unexpected setuid call by non-sudo, non-root (%user.name %proc.name %evt.dir %evt.type %evt.args)"
+  output: "Unexpected setuid call by non-sudo, non-root program (%user.name %proc.name %evt.type %evt.args)"
   priority: WARNING
 
 - rule: user_mgmt_binaries
   desc: activity by any programs that can manage users, passwords, or permissions. sudo and su are excluded. Activity in containers is also excluded--some containers create custom users on top of a base linux distribution at startup.
   condition: not proc.name in (su, sudo) and not container and (adduser_binaries or login_binaries or passwd_binaries or shadowutils_binaries)
-  output: "user-management binary command run (%user.name %proc.name %evt.dir %evt.type %evt.args)"
+  output: "User management binary command run outside of container (%user.name %proc.name %evt.type %evt.args)"
   priority: WARNING
 
 # (we may need to add additional checks against false positives, see: https://bugs.launchpad.net/ubuntu/+source/rkhunter/+bug/86153)
 - rule: create_files_below_dev
   desc: creating any files below /dev other than known programs that manage devices. Some rootkits hide files in /dev.
   condition: (evt.type = creat or evt.arg.flags contains O_CREAT) and proc.name != blkid and fd.directory = /dev and fd.name != /dev/null
-  output: "file created in /dev (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "File created below /dev by untrusted program (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 # Elasticsearch ports
@@ -293,13 +299,13 @@
 - rule: elasticsearch_unexpected_network_inbound
   desc: inbound network traffic to elasticsearch on a port other than the standard ports
   condition: user.name = elasticsearch and inbound and not elasticsearch_port
-  output: "Unexpected Elasticsearch inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to Elasticsearch on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: elasticsearch_unexpected_network_outbound
   desc: outbound network traffic from elasticsearch on a port other than the standard ports
   condition: user.name = elasticsearch and outbound and not elasticsearch_cluster_port
-  output: "Unexpected Elasticsearch outbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Outbound network traffic from Elasticsearch on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 
@@ -314,13 +320,13 @@
 - rule: activemq_unexpected_network_inbound
   desc: inbound network traffic to activemq on a port other than the standard ports
   condition: user.name = activemq and inbound and not activemq_port
-  output: "Unexpected ActiveMQ inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to ActiveMQ on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: activemq_unexpected_network_outbound
   desc: outbound network traffic from activemq on a port other than the standard ports
   condition: user.name = activemq and outbound and not activemq_cluster_port
-  output: "Unexpected ActiveMQ outbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Outbound network traffic from ActiveMQ on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 
@@ -342,13 +348,13 @@
 - rule: cassandra_unexpected_network_inbound
   desc: inbound network traffic to cassandra on a port other than the standard ports
   condition: user.name = cassandra and inbound and not cassandra_port
-  output: "Unexpected Cassandra inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to Cassandra on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: cassandra_unexpected_network_outbound
   desc: outbound network traffic from cassandra on a port other than the standard ports
   condition: user.name = cassandra and outbound and not (cassandra_ssl_cluster_port or cassandra_cluster_port)
-  output: "Unexpected Cassandra outbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Outbound network traffic from Cassandra on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 # Couchbase ports
@@ -403,13 +409,13 @@
 - rule: couchbase_unexpected_network_inbound
   desc: inbound network traffic to couchbase on a port other than the standard ports
   condition: user.name = couchbase and inbound and not couchbase_port
-  output: "Unexpected Couchbase inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to Couchbase on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: couchbase_unexpected_network_outbound
   desc: outbound network traffic from couchbase on a port other than the standard ports
   condition: user.name = couchbase and outbound and not couchbase_internal_port
-  output: "Unexpected Couchbase inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Outbound network traffic from Couchbase on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 
@@ -431,13 +437,13 @@
 - rule: etcd_unexpected_network_inbound
   desc: inbound network traffic to etcd on a port other than the standard ports
   condition: user.name = etcd and inbound and not (etcd_client_port or etcd_peer_port)
-  output: "Unexpected Etcd inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to Etcd on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: etcd_unexpected_network_outbound
   desc: outbound network traffic from etcd on a port other than the standard ports
   condition: user.name = etcd and outbound and not couchbase_internal_port
-  output: "Unexpected Etcd outbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Outbound network traffic from Etcd on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 
@@ -450,13 +456,13 @@
 - rule: fluentd_unexpected_network_inbound
   desc: inbound network traffic to fluentd on a port other than the standard ports
   condition: user.name = td-agent and inbound and not (fluentd_forward_port or fluentd_http_port)
-  output: "Unexpected Fluentd inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to Fluentd on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: tdagent_unexpected_network_outbound
   desc: outbound network traffic from fluentd on a port other than the standard ports
   condition: user.name = td-agent and outbound and not fluentd_forward_port
-  output: "Unexpected Fluentd outbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Outbound network traffic from Fluentd on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 # Gearman ports
@@ -464,7 +470,7 @@
 - rule: gearman_unexpected_network_outbound
   desc: outbound network traffic from gearman on a port other than the standard ports
   condition: user.name = gearman and outbound and outbound and not fd.sport = 4730
-  output: "Unexpected Gearman outbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Outbound network traffic from Gearman on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 # Zookeeper
@@ -499,13 +505,13 @@
     hbase_master_info_port or hbase_regionserver_port or
     hbase_regionserver_info_port or hbase_rest_port or hbase_rest_info_port or
     hbase_regionserver_thrift_port or hbase_thrift_info_port)
-  output: "Unexpected HBase inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to HBase on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: hbase_unexpected_network_outbound
   desc: outbound network traffic from hbase on a port other than the standard ports
   condition: user.name = hbase and outbound and not (zookeeper_port or hbase_master_port or hbase_regionserver_port)
-  output: "Unexpected HBase outbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Outbound network traffic from HBase on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 
@@ -513,20 +519,20 @@
 - rule: kafka_unexpected_network_inbound
   desc: inbound network traffic to kafka on a port other than the standard ports
   condition: user.name = kafka and inbound and fd.sport != 9092
-  output: "Unexpected Kafka inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to Kafka on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 # Memcached ports
 - rule: memcached_unexpected_network_inbound
   desc: inbound network traffic to memcached on a port other than the standard ports
   condition: user.name = memcached and inbound and fd.sport != 11211
-  output: "Unexpected Memcached inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to Memcached on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: memcached_network_outbound
   desc: any outbound network traffic from memcached. memcached never initiates outbound connections.
   condition: user.name = memcached and outbound
-  output: "Unexpected Memcached outbound connection (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Unexpected Memcached outbound connection (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 
@@ -543,31 +549,31 @@
 - rule: mongodb_unexpected_network_inbound
   desc: inbound network traffic to mongodb on a port other than the standard ports
   condition: user.name = mongodb and inbound and not (mongodb_server_port or mongodb_shardserver_port or mongodb_configserver_port or mongodb_webserver_port)
-  output: "Unexpected MongoDB inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to MongoDB on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 # MySQL ports
 - rule: mysql_unexpected_network_inbound
   desc: inbound network traffic to mysql on a port other than the standard ports
   condition: user.name = mysql and inbound and fd.sport != 3306
-  output: "Unexpected MySQL inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to MySQL on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 - rule: http_server_unexpected_network_inbound
   desc: inbound network traffic to a http server program on a port other than the standard ports
   condition: http_server_binaries and inbound and fd.sport != 80 and fd.sport != 443
-  output: "Unexpected HTTP server inbound port (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
+  output: "Inbound network traffic to HTTP Server on unexpected port (%user.name %proc.name %evt.type %evt.args %fd.name)"
   priority: WARNING
 
 # fs-bash is a restricted version of bash suitable for use in curl <curl> | sh installers.
 - rule: installer_bash_starts_network_server
   desc: an attempt by any program that is a child of fs-bash to start listening for network connections
   condition: evt.type=listen and proc.aname=fs-bash
-  output: "unexpected listen call by a child process of fs-bash (%proc.name %evt.args)"
+  output: "Unexpected listen call by a child process of fs-bash (%proc.name %evt.type %evt.args)"
   priority: WARNING
 
 - rule: installer_bash_starts_session
   desc: an attempt by any program that is a child of fs-bash to start a new session (process group)
   condition: evt.type=setsid and proc.aname=fs-bash
-  output: "unexpected setsid call by a child process of fs-bash (%proc.name %evt.args)"
+  output: "Unexpected setsid call by a child process of fs-bash (%proc.name %evt.type %evt.args)"
   priority: WARNING