How to eanble and use Incubating Falco Rules or Sandbox Falco Rules?

[yf-0dyssey]

What to document

Hello, everyone! I 've read the offical documents about rules. I want to use some rules of incubating & sandbox rules. I only find how to disable some rules of Stable rules( https://falco.org/docs/rules/controlling-rules/#disable-default-rules). But I didn't find documents about how to selectively use some rules of incubating & sandbox rules. Could you kindly supply these documents url? Thanks a lot!

[doublez13]

https://falco.org/docs/reference/rules/default-rules/

By default, only the stable rules are loaded by Falco, you can install the sandbox or incubating rules by referencing them in the Helm chart:

helm install falco falcosecurity/falco \
--set "falcoctl.config.artifact.install.refs={falco-rules:3,falco-incubating-rules:4,falco-sandbox-rules:4}" \
--set "falcoctl.config.artifact.follow.refs={falco-rules:3,falco-incubating-rules:4,falco-sandbox-rules:4}" \
--set "falco.rules_files={/etc/falco/k8s_audit_rules.yaml,/etc/falco/rules.d,/etc/falco/falco_rules.yaml,/etc/falco/falco-incubating_rules.yaml,/etc/falco/falco-sandbox_rules.yaml}"

Where the option falcoctl.config.artifact.install.refs governs which rules are downloaded at startup, falcoctl.config.artifact.follow.refs identifies which rules are automatically updated and falco.rules_files indicates which rules are loaded by the engine.

Or something like this in your helm values file:

falco:
  rules_files:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco_rules.local.yaml
    - /etc/falco/falco-incubating_rules.yaml
    - /etc/falco/rules.d


falcoctl:
  config:
    artifact:
      install:
        refs:
          - falco-rules:3
          - falco-incubating-rules:4
      follow:
        refs:
          - falco-rules:3
          - falco-incubating-rules:4 

[yf-0dyssey]

https://falco.org/docs/reference/rules/default-rules/

By default, only the stable rules are loaded by Falco, you can install the sandbox or incubating rules by referencing them in the Helm chart:

helm install falco falcosecurity/falco \
--set "falcoctl.config.artifact.install.refs={falco-rules:3,falco-incubating-rules:4,falco-sandbox-rules:4}" \
--set "falcoctl.config.artifact.follow.refs={falco-rules:3,falco-incubating-rules:4,falco-sandbox-rules:4}" \
--set "falco.rules_files={/etc/falco/k8s_audit_rules.yaml,/etc/falco/rules.d,/etc/falco/falco_rules.yaml,/etc/falco/falco-incubating_rules.yaml,/etc/falco/falco-sandbox_rules.yaml}"

Where the option falcoctl.config.artifact.install.refs governs which rules are downloaded at startup, falcoctl.config.artifact.follow.refs identifies which rules are automatically updated and falco.rules_files indicates which rules are loaded by the engine.

Or something like this in your helm values file:

falco:
  rules_files:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco_rules.local.yaml
    - /etc/falco/falco-incubating_rules.yaml
    - /etc/falco/rules.d


falcoctl:
  config:
    artifact:
      install:
        refs:
          - falco-rules:3
          - falco-incubating-rules:4
      follow:
        refs:
          - falco-rules:3
          - falco-incubating-rules:4 

Thanks your rely. I'll read these docs and try it.