falco

Validate rules file before reload Lint rule syntax offline before applying; note: nonzero exit on error, use in CI gate falco -r /etc/falco/falco_rules.yaml --validate #falco#security#ci#k8s Filter critical alerts from logs Pull only Critical Falco events from JSON output; requires json_output: true in falco.yaml kubectl logs -l app.kubernetes.io/name=falco -n falco | jq 'select(.priority=="Critical")' #falco#security#observability#k8s Install rules from artifact registry Pull and manage versioned rules/plugins via OCI; modern: replaces manual rule file copying falcoctl artifact install falco-rules:latest && falcoctl artifact list #falco#security#gitops#k8s Run a timed capture window Run Falco for 60s then exit; great for ad-hoc triage on a suspect node falco -M 60 -o json_output=true 2>/dev/null | jq -c '{rule,output_fields}' #falco#security#troubleshooting#debug List supported event fields Discover filter fields for writing custom rule conditions and outputs falco --list | grep -E 'k8s\.|container\.|proc\.' | sort #falco#security#debug Custom rule for shell in container Minimal custom rule with condition/output/priority; loaded from rules.d drop-in dir cat > /etc/falco/rules.d/shell.yaml <<'EOF' - rule: Shell in container desc: A shell was spawned in a container condition: container and proc.name in (bash, sh, zsh) output: "Shell spawned (pod=%k8s.pod.name cmd=%proc.cmdline)" priority: WARNING EOF #falco#security#k8s