Rule files, each given as the YAML list of rules, macros and lists that Falco reads. The attribute name becomes the file name. Files are loaded after the stock rules, in the lexical order of their names. Overrides of a stock rule or macro (override or append) must therefore come from here, not from the stock file itself. Prefix the names with a number to control the order. See the rules reference for the format.

{ }

{
  "50-local" = [
    {
      rule = "Write below /etc by a build";
      desc = "A build modified /etc";
      condition = "evt.type in (open, openat, openat2) and evt.is_open_write=true and fd.name startswith /etc/ and proc.name = nix-daemon";
      output = "Build wrote to /etc (file=%fd.name proc=%proc.name)";
      priority = "WARNING";
    }
  ];
}