diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index c05a98ef..86fbcbbd 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -1774,7 +1774,8 @@
     gcr.io/google_containers/hyperkube,
     gcr.io/google_containers/kube-proxy, docker.io/calico/node,
     docker.io/rook/toolbox, docker.io/cloudnativelabs/kube-router, docker.io/consul,
-    docker.io/datadog/docker-dd-agent, docker.io/datadog/agent, docker.io/docker/ucp-agent, docker.io/gliderlabs/logspout
+    docker.io/datadog/docker-dd-agent, docker.io/datadog/agent, docker.io/docker/ucp-agent, docker.io/gliderlabs/logspout,
+    docker.io/netdata/netdata
     ]
 
 - macro: falco_sensitive_mount_containers