List supported event fields falco

Custom rule for shell in container cat > /etc/falco/rules.d/shell.yaml <<'EOF' - rule: Shell in container desc: A shell was spawned in a container condition: container and proc.name in (bash, sh, zsh) output: "Shell spawned (pod=%k8s.pod.name cmd=%proc.cmdline)" priority: WARNING EOF Validate rules file before reload falco -r /etc/falco/falco_rules.yaml --validate Filter critical alerts from logs kubectl logs -l app.kubernetes.io/name=falco -n falco | jq 'select(.priority=="Critical")' Install rules from artifact registry falcoctl artifact install falco-rules:latest && falcoctl artifact list Run a timed capture window falco -M 60 -o json_output=true 2>/dev/null | jq -c '{rule,output_fields}'