First Rule Wins / Rule Priority

[ossie-git]

What to document

The fact that given an event, only the first rule / match triggers isn't currently documented. This is confusing (and makes writing rules more difficult).

For example, if a user runs the "ls" command with the below rules, only the first rule will run

- rule: ls run
  desc: ls run
  condition: spawned_process and proc.name=ls
  output: ls run
  priority: INFO
  tags: [process]
 
- rule: ls run - 2
  desc: ls run - 2
  condition: spawned_process and proc.name=ls
  output: ls run - 2
  priority: INFO
  tags: [process]

This is unexpected behavior and not documented anywhere. It would be great if this behavior was documented in:

• the official documentation
• the corresponding rules files as a reminder

to make it clear to users that this is Falco's behavior

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[poiana]

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

[poiana]

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.