github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-05 00:31:38 +00:00
Code Issues Projects Releases Wiki Activity

Updated Falco Rules (markdown)

Mark Stemm
2019-01-22 14:30:19 -08:00
parent e392ea023a
commit 997eb076ea
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Falco-Rules.md

@@ -33,7 +33,7 @@ A Rule is a node containing the following keys:
* _rule_: a short unique name for the rule
* _condition_: a filtering expression that is applied against events to see if they match the rule.
* _desc_: a longer description of what the rule detects
* _output_ and _priority_: The output format specifies the message that should be output if a matching event occurs, and follows the Sysdig [output format syntax](http://www.sysdig.org/wiki/sysdig-user-guide/#output-formatting). The priority is a case-insensitive representation of severity and should be one of "emergency", "alert", "critical", "error", "warning", "notice", "informational", or "debug".
* _output_ and _priority_: The output format specifies the message that should be output if a matching event occurs, and follows the Sysdig [output format syntax](https://github.com/draios/sysdig/wiki/Sysdig-User-Guide#output-formatting). The priority is a case-insensitive representation of severity and should be one of "emergency", "alert", "critical", "error", "warning", "notice", "informational", or "debug".
* (optional) _enabled_: can be either `true` or `false`. If `enabled=false`, a rule will not be loaded nor will it be matched against any events. The default for `enabled` is `true`.
* (optional) _tags_: a list of tags applied to the rule. More on this below.
* (optional) _warn_evttypes_: can be either `true` or `false`. If `warn_evttypes=false`, falco will suppress warnings related to a rule not having an event type (See [here](#rule-condition-best-practices)). The default for `warn_evttypes` is `true`.