diff --git a/userspace/falco/app/actions/init_inspectors.cpp b/userspace/falco/app/actions/init_inspectors.cpp index 7291cca5..d20d5d2b 100644 --- a/userspace/falco/app/actions/init_inspectors.cpp +++ b/userspace/falco/app/actions/init_inspectors.cpp @@ -56,6 +56,12 @@ static bool populate_filterchecks(const std::shared_ptr& inspector, std::unordered_set& used_plugins, std::map static_fields, std::string& err) { + // Add static filterchecks loaded from config + if(!static_fields.empty()) { + filterchecks.add_filter_check(std::make_unique(static_fields)); + } + + // Add plugin-defined filterchecks, checking that they do not overlap any internal filtercheck std::vector infos; for(const auto& plugin : inspector->get_plugin_manager()->plugins()) { if(!(plugin->caps() & CAP_EXTRACTION)) { @@ -85,9 +91,6 @@ static bool populate_filterchecks(const std::shared_ptr& inspector, used_plugins.insert(plugin->name()); } - if(!static_fields.empty()) { - filterchecks.add_filter_check(std::make_unique(static_fields)); - } return true; }