Skip to content

Commit 3cac61c

Browse files
incertumpoiana
authored andcommitted
update: add debugging advice to readme + add new links
Signed-off-by: Melissa Kilby <[email protected]>
1 parent 3c82a97 commit 3cac61c

File tree

2 files changed

+6
-1
lines changed

2 files changed

+6
-1
lines changed

README.md

+6-1
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,19 @@ Rules tell [Falco](https://github.com/falcosecurity/falco) what to do. These rul
3333

3434
<p align="left">
3535
<img src="docs/images/announce.png" alt="Image" width="20" height="20">&nbsp;&nbsp;
36-
Starting from rules version 3.0.0, the <i>required_engine_version</i> follows semantic versioning and only functions with Falco version >= 0.37.0. Since rules version <a href="#falco-rules-2x">2.0.0</a>, we've modified our rules' shipping and distribution process. With Falco >= 0.37.0, <i>selective rules overrides</i> aim to further streamline the adoption and customization of upstream rules. Since Falco 0.36.0, you can opt to generate logs for each rule per event type when the condition evaluates to true, addressing concerns about rules overshadowing each other, see <a href="https://github.com/falcosecurity/falco/blob/master/falco.yaml">rule_matching</a>. Starting from Falco 0.35.0, you have precise control over the syscalls that are being monitored, see <a href="https://github.com/falcosecurity/falco/blob/master/falco.yaml">base_syscalls</a>. Lastly, keep in mind that the <a href="CONTRIBUTING.md#rules-maturity-framework">Rules Maturity Framework</a> is a best effort on the part of the community, and ultimately, you have to decide if any rules are useful for your use cases. </p>
36+
Beginning with rules version 3.0.0, the <i>required_engine_version</i> follows semantic versioning and requires Falco version 0.37.0 or higher. Since rules version <a href="#falco-rules-2x">2.0.0</a>, we've modified our rules' shipping and distribution process. With Falco >= 0.37.0, <a href="https://falco.org/docs/rules/overriding/">selective rules overrides</a> aim to further streamline the customization of upstream rules. Since Falco 0.36.0, you can now generate rule-specific logs for each event type when the condition is true, preventing rule overshadowing. Check the <a href="https://github.com/falcosecurity/falco/blob/master/falco.yaml">rule_matching</a> documentation for details. Starting from Falco 0.35.0, you have precise control over the syscalls that are being monitored, see <a href="https://github.com/falcosecurity/falco/blob/master/falco.yaml">base_syscalls</a>. Lastly, keep in mind that the <a href="CONTRIBUTING.md#rules-maturity-framework">Rules Maturity Framework</a> is a best effort on the part of the community, and ultimately, you have to decide if any rules are useful for your use cases. </p>
3737
</div>
3838

3939
<p align="left">
4040
<img src="docs/images/cross.png" alt="Image" width="20" height="20">&nbsp;&nbsp;
4141
Be cautious: The <i>main</i> branch has the latest development. Before using rules from the <i>main</i> branch, check for compatibility. Changes like new output fields might cause incompatibilities with the latest stable Falco release. The Falco Project advises using rules only from the release branches. Lastly, we'd like to highlight the importance of regular engineering effort to effectively adopt Falco rules. Considering that each adopter's system and monitoring needs are unique, it's advisable to view the rules as examples.
4242
</p>
4343

44+
<p align="left">
45+
<img src="docs/images/arrow.png" alt="Image" width="20" height="20">&nbsp;&nbsp;
46+
Debugging: Historically, we've noted that issues often arise either from incorrect configurations or genuine bugs, acknowledging that no software is entirely bug-free. The Falco Project continually updates its <a href="https://falco.org/docs/install-operate/">Install and Operate</a> and <a href="https://falco.org/docs/troubleshooting/">Troubleshooting</a> Guides. We kindly suggest reviewing these guides. In the context of Falco rules, missing fields, such as container images, may be anticipated within our imperfection tolerances under certain circumstances. We are committed to addressing and resolving issues within our control.
47+
</p>
48+
4449
</br>
4550

4651
## Falco Rules Files Registry

docs/images/arrow.png

5.96 KB
Loading

0 commit comments

Comments
 (0)