Where Does Falco Store Config and Rules?
Falco reads falco.yaml in /etc/falco with custom rules layered from rules.d beside it.
Last updated
Falco configures from YAML in /etc/falco. The falco.yaml file picks the engine, outputs, and which rule files load. Custom detections belong in rules.d files that layer over shipped defaults.
Container installs mount these paths from ConfigMaps instead. Rule syntax versions with the engine, so match custom rules to the running Falco. Validate with falco check before deploying changes.
Where Falco stores this, by platform
/etc/falco/falco.yaml
Engine, outputs, and rule file list live here. Custom rules go in rules.d files beside it. Validate with falco check after edits.
Frequently asked questions
How do I add a custom Falco rule?
Write it into a rules.d file with a distinct name, then validate and reload. Keep upstream files untouched so upgrades merge cleanly. Test against recorded captures first.
Where does Falco send alerts?
Wherever falco.yaml outputs point, such as stdout, files, or webhooks. Container setups forward to logging stacks. Check the outputs section for the active sinks.
Notice an outdated path? Let us know.