Falco-rules
YAML-config för Falco runtime-security. Rules definierar conditions (syscall-pattern, process-name, file-path), output-message, priority (INFO/WARNING/ERROR/CRITICAL). Default-ruleset 100+ rules för common threats.
Exempel-rule: condition: spawned_process and shell_procs and proc.tty != 0 → alert when shell spawns interactively i container. Macros + lists for reuse. Falcosidekick forwards events to Slack/PagerDuty/Splunk. Custom rules for app-specific threats. Modern security-team: maintain Falco-rules in git, deploy via CI/CD, version-controlled like other-IaC. Open source: 100s of community-contributed rules. Falco Sandbox (community-driven): rules for specific threats (npm-malware, cryptojackers, lateral-movement-patterns).