Practical Cloud Native Security with Falco

Chapter 13. Writing Falco Rules

Welcome to Part IV of the book! Now that you’ve learned what Falco is and does (Part I), understand the intricacies of its architecture (Part II), and are a pro at deploying and running it (Part III), it’s time, once more, to step up your game.

The final part of this book (Chapters 13 through 15) is about going beyond what comes out of the box. You will learn how to customize Falco for your specific needs and how, if you desire, you can contribute your improvements to the project so that the community can benefit from them. This is where you get to unleash your creativity.

We’ve already covered rules extensively in the book, in particular in Chapter 7. But you unlock the true power of Falco when you become capable of creating your own rules and adapting the existing ones to your environment—which is what we’re going to show you how to do here.

This chapter assumes you have a good understanding of fields and filters (covered in Chapter 6) and of the basics of rules and rules files (Chapter 7). If you feel you need a refresher, just go back to those chapters. We’ll wait for you here until you’re ready.

Customizing the Default Falco Rules

Although Falco’s default set of rules is rich and constantly expanding, it’s not uncommon to encounter situations where those rules require customization. Here are some examples:

• You want to expand the scope of a rule or increase its coverage.

• You want to tighten the number of rules that Falco loads to decrease ...