Author Falco Rule and Attach to Policy
A 3-step recipe with Sysdig. We can help you get access.
Recipe · 3 steps
Author Falco Rule and Attach to Policy
with Sysdig · Cybersecurity Management
Create a Falco rule and wire it into an enforcing policy.
- Create the custom Falco rule from the supplied condition.
- Read the rule back by id to confirm it persisted.
- Create a falco-type policy that references the new rule by name.
What you'll need to have ready
- bearerToken: Sysdig API bearer token used for Authorization.
- ruleName: Name of the custom Falco rule.
- condition: Falco condition expression that triggers the rule.
- output: Output message emitted when the rule fires.
- priority: Falco priority level (e.g. WARNING, CRITICAL).
- policyName: Name of the policy that will enforce the rule.
For your developer
Arazzo workflow sysdig:author-falco-rule-and-attach-policy, 3 operations: createFalcoRule → getFalcoRule → createPolicy. Specs on APIs.io.