github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-17 16:21:31 +00:00
Code Issues Projects Releases Wiki Activity

cleanup(config): add info about performance impact wrt rule_matching

Browse Source 
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Melissa Kilby 2023-09-01 08:18:26 -07:00 committed by poiana
parent 08237b946f
commit 79577237a1
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
falco.yaml
View File

@ -137,7 +137,9 @@
# #
# With Falco 0.36 and beyond, it's now possible to apply multiple rules that match # With Falco 0.36 and beyond, it's now possible to apply multiple rules that match
# the same event type, eliminating concerns about rule prioritization based on the # the same event type, eliminating concerns about rule prioritization based on the
# "first match wins" principle. Read more under the `rule_matching` configuration. # "first match wins" principle. However, enabling the `all` matching option may result
# in a performance penalty. We recommend carefully testing this alternative setting
# before deploying it in production. Read more under the `rule_matching` configuration.
rules_file: rules_file:
- /etc/falco/falco_rules.yaml - /etc/falco/falco_rules.yaml
- /etc/falco/falco_rules.local.yaml - /etc/falco/falco_rules.local.yaml
@ -306,6 +308,12 @@ outputs:
# trigger, possibly shadowing other rules. # trigger, possibly shadowing other rules.
# In case `all` is used as value, rules still trigger in the order they were # In case `all` is used as value, rules still trigger in the order they were
# defined. # defined.
#
# Effectively, with this setting, it is now possible to apply multiple rules that match
# the same event type. This eliminates concerns about rule prioritization based on the
# "first match wins" principle. However, enabling the `all` matching option may result in
# a performance penalty. We recommend carefully testing this alternative setting before
# deploying it in production.
rule_matching: first rule_matching: first