diff --git a/Falco-Configuration.md b/Falco-Configuration.md index 3c05d71..8101fef 100644 --- a/Falco-Configuration.md +++ b/Falco-Configuration.md @@ -30,7 +30,6 @@ a list containing these sub-keys: * `enabled: [true|false]`: if true, falco alerts will be sent via syslog - ####`file_output` a list containing these sub-keys: @@ -45,3 +44,12 @@ a list containing thse sub-keys: * `enabled: [true|false]`: if true, falco alerts will be sent to standard output +####`program_output` + +a list containing these sub-keys: + +* `enabled: [true|false]`: if true, falco alerts will be sent to a program +* `program: `: the program to run for each alert. This is started via a shell, so you can specify a command pipeline to allow for additional formatting. + + +