falco.yaml

# File containing Falco rules, loaded at startup.
rules_file: /etc/falco_rules.yaml

# Whether to output events in json or text
json_output: false

# Send information logs to stderr and/or syslog Note these are *not* security
# notification logs! These are just Falco lifecycle (and possibly error) logs.
log_stderr: false
log_syslog: true


# Where security notifications should go.
# Multiple outputs can be enabled.

syslog_output:
  enabled: true

file_output:
  enabled: false
  filename: ./events.txt

stdout_output:
  enabled: false