falco

Best Practices

• Use descriptive rule names that indicate the security concern
• Set appropriate priority levels (EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG)
• Define macros for reusable condition components
• Use lists for grouping related values (binaries, paths, users)
• Include output templates with relevant context fields
• Tag rules with applicable compliance frameworks (mitre, pci, soc2)
• Use append rules to extend default Falco rules without modifying them
• Use macros for reusable condition components
• Set priority based on security impact severity
• Include relevant context fields in output templates
• Tag rules with MITRE ATT&CK techniques where applicable
• Use lists to maintain groups of related values

Documentation Sources