Contents of falco.yaml. See the configuration reference for all keys. Only what is set here is written, not the example file shipped with Falco, so a key you leave out takes Falco’s built-in default. The module sets rules_files, load_plugins and plugins so that the stock rules and the container plugin are loaded. Lists you add to these are appended to them; use lib.mkForce to replace them. Output goes to the journal by default. syslog_output and the webserver are disabled, since the former would log every alert twice and the latter listens on all interfaces upstream.

{ }

{
  json_output = true;
  priority = "warning";
  file_output = {
    enabled = true;
    filename = "/var/log/falco/events.json";
  };
}