Skip to content

Commit

Permalink
update: add debugging advice to readme + add new links
Browse files Browse the repository at this point in the history
Signed-off-by: Melissa Kilby <[email protected]>
  • Loading branch information
incertum committed Jan 30, 2024
1 parent 69a423f commit b3ecf78
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,19 @@ Rules tell [Falco](https://github.com/falcosecurity/falco) what to do. These rul

<p align="left">
<img src="docs/images/announce.png" alt="Image" width="20" height="20">&nbsp;&nbsp;
Starting from rules version 3.0.0, the <i>required_engine_version</i> follows semantic versioning and only functions with Falco version >= 0.37.0. Since rules version <a href="#falco-rules-2x">2.0.0</a>, we've modified our rules' shipping and distribution process. With Falco >= 0.37.0, <i>selective rules overrides</i> aim to further streamline the adoption and customization of upstream rules. Since Falco 0.36.0, you can opt to generate logs for each rule per event type when the condition evaluates to true, addressing concerns about rules overshadowing each other, see <a href="https://github.com/falcosecurity/falco/blob/master/falco.yaml">rule_matching</a>. Starting from Falco 0.35.0, you have precise control over the syscalls that are being monitored, see <a href="https://github.com/falcosecurity/falco/blob/master/falco.yaml">base_syscalls</a>. Lastly, keep in mind that the <a href="CONTRIBUTING.md#rules-maturity-framework">Rules Maturity Framework</a> is a best effort on the part of the community, and ultimately, you have to decide if any rules are useful for your use cases. </p>
Beginning with rules version 3.0.0, the <i>required_engine_version</i> follows semantic versioning and requires Falco version 0.37.0 or higher. Since rules version <a href="#falco-rules-2x">2.0.0</a>, we've modified our rules' shipping and distribution process. With Falco >= 0.37.0, <a href="https://falco.org/docs/rules/overriding/">selective rules overrides</a> aim to further streamline the customization of upstream rules. Since Falco 0.36.0, you can now generate rule-specific logs for each event type when the condition is true, preventing rule overshadowing. Check the <a href="https://github.com/falcosecurity/falco/blob/master/falco.yaml">rule_matching</a> documentation for details. Starting from Falco 0.35.0, you have precise control over the syscalls that are being monitored, see <a href="https://github.com/falcosecurity/falco/blob/master/falco.yaml">base_syscalls</a>. Lastly, keep in mind that the <a href="CONTRIBUTING.md#rules-maturity-framework">Rules Maturity Framework</a> is a best effort on the part of the community, and ultimately, you have to decide if any rules are useful for your use cases. </p>
</div>

<p align="left">
<img src="docs/images/cross.png" alt="Image" width="20" height="20">&nbsp;&nbsp;
Be cautious: The <i>main</i> branch has the latest development. Before using rules from the <i>main</i> branch, check for compatibility. Changes like new output fields might cause incompatibilities with the latest stable Falco release. The Falco Project advises using rules only from the release branches. Lastly, we'd like to highlight the importance of regular engineering effort to effectively adopt Falco rules. Considering that each adopter's system and monitoring needs are unique, it's advisable to view the rules as examples.
</p>

<p align="left">
<img src="docs/images/arrow.png" alt="Image" width="20" height="20">&nbsp;&nbsp;
Debugging: Historically, we've noted that issues often arise either from incorrect configurations or genuine bugs, acknowledging that no software is entirely bug-free. The Falco Project continually updates its <a href="https://falco.org/docs/install-operate/">Install and Operate</a> and <a href="https://falco.org/docs/troubleshooting/">Troubleshooting</a> Guides. We kindly suggest reviewing these guides. In the context of Falco rules, missing fields, such as container images, may be anticipated within our imperfection tolerances under certain circumstances. We are committed to addressing and resolving issues within our control.
</p>

</br>

## Falco Rules Files Registry
Expand Down
Binary file added docs/images/arrow.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit b3ecf78

Please sign in to comment.