Understand Falco Rules, Lists and Macros
A Falco rules file is a YAML file containing mainly three types of elements:
|Rules||Conditions under which an alert should be generated. A rule is accompanied by a descriptive output string that is sent with the alert.|
|Macros||Rule condition snippets that can be re-used inside rules and even other macros. Macros provide a way to name common patterns and factor out redundancies in rules.|
|Lists||Collections of items that can be included in rules, macros, or other lists. Unlike rules and macros, lists cannot be parsed as filtering expressions.|
Falco rules files can also contain two optional elements related to versioning:
|Used to track compatibility between rules content and the falco engine version.|
|Used to track compatibility between rules content and plugin versions.|
Falco provides default rules, but you can add your own
Falco provides default macros to enhance your rules
Learn how to write conditions for a Falco Rule
Appending to Lists, Rules, and Macros
Add exceptions to Falco Rules to adapt them to your environment
Disable default rules or use tags to load Falco Rules selectively
Escape special characters in your Falco Rules
How fd.sip.name and related fields work
Understand how Falco Rules support explicit versioning
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.