Falco Rules

Write and customize Falco Rules to secure your environment

A Falco rules file is a YAML file containing mainly three types of elements:

Element	Description
Rules	Conditions under which an alert should be generated. A rule is accompanied by a descriptive output string that is sent with the alert.
Macros	Rule condition snippets that can be re-used inside rules and even other macros. Macros provide a way to name common patterns and factor out redundancies in rules.
Lists	Collections of items that can be included in rules, macros, or other lists. Unlike rules and macros, lists cannot be parsed as filtering expressions.

Falco rules files can also contain two optional elements related to versioning:

Element	Description
`required_engine_version`	Used to track compatibility between rules content and the falco engine version.
`required_plugin_versions`	Used to track compatibility between rules content and plugin versions.

The Falco organization maintains a rules repository that provides easy-to-install rules and examples for rule writers. You can learn more about the default and custom rulesets in the documentation.

We recommend carefully reading each dedicated guide below. In addition, here is a list of recent Falco blog posts that may be of interest to you and can help guide you in finding the optimal use of Falco and its rules for your use cases:

Basic Elements of Falco Rules

Understand Falco Rules, Lists and Macros

Default and Local Rules Files

Falco provides default rules, but you can add your own

Condition Syntax

Learn how to write conditions for a Falco Rule

Extending Rules

Appending to Lists, Rules, and Macros

Rule Exceptions

Add exceptions to Falco Rules to adapt them to your environment

Controlling Rules

Disable default rules or use tags to load Falco Rules selectively

Custom Ruleset

Start writing your first custom Falco rules

Escaping Special Characters

Escape special characters in your Falco Rules

Style Guide of Falco Rules

Adopt best practices when writing and contributing Falco rules

Accessing File System Paths in Falco Rules

How fs.path.* fields work

Adoption of Falco Rules in Production

How to adopt Falco rules in real-life production

Resolving Domain Names in Falco Rules

How fd.sip.name and related fields work

Rule Format Version

Understand how Falco Rules support explicit versioning

IDE Support

IDE Support for Falco Rules Files

Was this page helpful?

Let us know! You feedback will help us to improve the content and to stay in touch with our users.