diff --git a/Falco-Configuration.md b/Falco-Configuration.md index aaa37c7..1c64b8c 100644 --- a/Falco-Configuration.md +++ b/Falco-Configuration.md @@ -24,6 +24,12 @@ You can also specify multiple rules files on the command line via one or more `- whether to use JSON output for alert messages. +#### `json_include_output_property: [true|false]` + +When using json output, whether or not to include the "output" property +itself (e.g. "File below a known binary directory opened for writing +(user=root ....") in the json output. + #### `log_stderr: [true|false]` if true, log messages describing falco's activity will be logged to stderr. Note these are *not* alert messages--these are log messages for falco itself.