falco

Best Practices

• Use macros to factor out common conditions (container, host, spawned_process)
• Reference built-in lists (shell_binaries, sensitive_file_names) before creating custom ones
• Set priority based on actual impact — CRITICAL for container escapes, WARNING for anomalies
• Tag rules with MITRE ATT&CK technique IDs (mitre_execution, mitre_persistence, etc.)
• Use exceptions to allowlist known-good behaviors rather than disabling entire rules
• Keep conditions specific to reduce false positives — combine container, process, and file filters
• Include %container.id, %container.name, and %proc.cmdline in output for investigation context
• Use append: true to extend default rules instead of replacing them
• Test custom rules with falco --dry-run before deploying
• Separate custom rules into their own files (custom_rules.yaml) to survive upgrades
• Configure output channels (stdout, syslog, HTTP, gRPC) based on SIEM integration needs
• Group related rules by threat category for easier management

Documentation Sources