You are viewing documentation for Falco version: v0.38.2

Falco v0.38.2 documentation is no longer actively maintained. The version you are currently viewing is a static snapshot. For up-to-date documentation, see the latest version.

Falco Rules

Write and customize Falco Rules to secure your environment

A Falco rules file is a YAML file containing mainly three types of elements:

ElementDescription
RulesConditions under which an alert should be generated. A rule is accompanied by a descriptive output string that is sent with the alert.
MacrosRule condition snippets that can be re-used inside rules and even other macros. Macros provide a way to name common patterns and factor out redundancies in rules.
ListsCollections of items that can be included in rules, macros, or other lists. Unlike rules and macros, lists cannot be parsed as filtering expressions.

Falco rules files can also contain two optional elements related to versioning:

ElementDescription
required_engine_versionUsed to track compatibility between rules content and the falco engine version.
required_plugin_versionsUsed to track compatibility between rules content and plugin versions.

The Falco organization maintains a rules repository that provides easy-to-install rules and examples for rule writers. You can learn more about the default and custom rulesets in the documentation.

We recommend carefully reading each dedicated guide below. In addition, here is a list of recent Falco blog posts that may be of interest to you and can help guide you in finding the optimal use of Falco and its rules for your use cases:

Basic Elements of Falco Rules

Understand Falco Rules, Lists and Macros

Default and Local Rules Files

Falco provides default rules, but you can add your own

Condition Syntax

Learn how to write conditions for a Falco Rule

Overriding Rules

Overriding Falco rules

Rule Exceptions

Add exceptions to Falco Rules to adapt them to your environment

Controlling Rules

Disable default rules or use tags to load Falco Rules selectively

Custom Ruleset

Start writing your first custom Falco rules

Escaping Special Characters

Escape special characters in your Falco Rules

Style Guide of Falco Rules

Adopt best practices when writing and contributing Falco rules

Accessing File System Paths in Falco Rules

How fs.path.* fields work

Adoption of Falco Rules in Production

How to adopt Falco rules in real-life production

Resolving Domain Names in Falco Rules

How fd.sip.name and related fields work

Using the pmatch Operator to Match File System Paths

How the pmatch Operator Works

Rule Format Version

Understand how Falco Rules support explicit versioning

IDE Support

IDE Support for Falco Rules Files