# ═══════════════════════════════════════════════════════════════
# Falco custom rules — maintained by the security team
# Edit this file -> git push -> ArgoCD auto-syncs -> Falco hot-reloads (seconds)
# ═══════════════════════════════════════════════════════════════

# ── Override default rule priorities ──
- rule: Terminal shell in container
  append: true
  priority: CRITICAL
  output: "终端 Shell 启动 | 用户=%user.name 容器=%container.name 命令=%proc.cmdline"

- rule: Write below binary dir
  append: true
  priority: WARNING

- rule: Write below etc
  append: true
  priority: WARNING

- rule: Read sensitive file untrusted
  append: true
  priority: WARNING
  output: "敏感文件读取 | 用户=%user.name 文件=%fd.name 命令=%proc.cmdline"

- rule: Launch Package Management Process in Container
  append: true
  priority: WARNING

# ── Whitelist: exclude known-compliant monitoring/ops components ──
# Example whitelist template below. Fill in real false-positive components
# during the testing phase. Format: macro + append: true (appended to the
# upstream default condition)

# - macro: user_known_read_sensitive_files_activities
#   append: true
#   condition: >
#     (proc.name = "datadog-agent" and container.image.repository endswith "datadog/agent")

# - macro: user_known_package_manager_in_container
#   append: true
#   condition: >
#     (proc.name = "apt-get" and container.image.repository startswith "tidbcloud/ci")

# - macro: user_known_write_below_binary_dir_activities
#   append: true
#   condition: >
#     (proc.name = "dpkg" and container.image.repository startswith "tidbcloud/")