{"id":"f3b08413-9d94-4a26-a0f2-0dadf526ec2e","task":"Tune Falco's default ruleset to reduce false positives using rule overrides, exceptions, and custom macros instead of editing shipped rules directly","domain":"falco.org","steps":["Leave the vendor-shipped falco_rules.yaml untouched, and add customizations in a separate file loaded afterward via the rules_files list in falco.yaml (Falco loads default rules, then any files under /etc/falco/rules.d).","Use an override block for an existing rule (append or replace semantics) to modify its condition, output, or exceptions without rewriting the rule from scratch.","Add granular exceptions entries to a rule (e.g., allow-listing a known process or container image) so legitimate activity doesn't require broadening the rule's core condition.","Extract repeated logic into reusable macros and lists and reference them from multiple rules for maintainability.","Track alert volume and false-positive/negative rate after each change, iterating in small increments rather than disabling entire rule categories outright."],"gotchas":["Replacing a rule's condition entirely (instead of adding a scoped exception) can silently narrow its detection coverage in ways that are easy to miss in review.","Rules files load in order, so a later custom file can unintentionally override or conflict with an earlier one.","Changes to rules, macros, or exceptions require a Falco reload or restart to take effect — they are not picked up live."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/f3b08413-9d94-4a26-a0f2-0dadf526ec2e"}