=== Falco config (modo activo) ===
append_output:
- suggested_output: true
base_syscalls:
  all: false
  custom_set: []
  repair: false
buffer_format_base64: false
buffered_outputs: false
capture:
  default_duration: 5000
  enabled: false
  mode: rules
  path_prefix: /tmp/falco
config_files:
- /etc/falco/config.d
engine:
  kind: modern_ebpf
  modern_ebpf:
    buf_size_preset: 4
    cpus_for_each_buffer: 2
    drop_failed_exit: false
falco_libs:
  snaplen: 80
  thread_table_auto_purging_interval_s: 300
  thread_table_auto_purging_thread_timeout_s: 300
  thread_table_size: 262144
file_output:
  enabled: false
  filename: ./events.txt
  keep_alive: false
grpc:
  bind_address: unix:///run/falco/falco.sock
  enabled: true
  threadiness: 0
grpc_output:
  enabled: true
http_output:
  ca_bundle: ""
  ca_cert: ""
  ca_path: /etc/falco/certs/
  client_cert: /etc/falco/certs/client/client.crt
  client_key: /etc/falco/certs/client/client.key
  compress_uploads: false
  echo: false
  enabled: true
  insecure: false
  keep_alive: false
  max_consecutive_timeouts: 5
  mtls: false
  url: http://falco-falcosidekick:2801
  user_agent: falcosecurity/falco
json_include_message_property: false
json_include_output_fields_property: true
json_include_output_property: true
json_include_tags_property: true
json_output: true
libs_logger:
  enabled: true
  severity: info
load_plugins:

=== Reglas Falco activas (count + ejemplos) ===
total 80
drwxrwxrwx    3 root     root          4096 May 24 06:19 .
drwxr-xr-x    1 root     root          4096 May 24 06:19 ..
-rw-r--r--    1 root     root          3024 May 24 06:19 falco.yaml
-rw-r--r--    1 nonroot  nonroot      63642 May 24 06:19 falco_rules.yaml
drwxrwxrwx    3 root     root          4096 May 24 06:19 rules.d

=== Falco loaded rules list (de logs) ===
{"hostname":"cde-38q702","output":"13:44:34.722181519: Warning Sensitive file read (user=nonroot file=/var/run/secrets/kubernetes.io/serviceaccount/token container=nrr-status-patcher ns=kube-system) container_id=d40851237ecd container_name=nrr-status-patcher container_image_repository=ghcr.io/digitalocean-packages/node-readiness-reporter container_image_tag=v0.3.0 k8s_pod_name=cilium-8tmhn k8s_ns_name=kube-system","output_fields":{"container.id":"d40851237ecd","container.image.repository":"ghcr.io/digitalocean-packages/node-readiness-reporter","container.image.tag":"v0.3.0","container.name":"nrr-status-patcher","evt.time":1779889474722181519,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"kube-system","k8s.pod.name":"cilium-8tmhn","user.name":"nonroot"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:44:34.722181519Z"}
{"hostname":"cde-38q702","output":"13:45:08.855418531: Warning Sensitive file read (user=nonroot file=/var/run/secrets/kubernetes.io/serviceaccount/token container=nrr-status-patcher ns=kube-system) container_id=48628fc537d5 container_name=nrr-status-patcher container_image_repository=ghcr.io/digitalocean-packages/node-readiness-reporter container_image_tag=v0.3.0 k8s_pod_name=cpc-bridge-proxy-ebpf-6vqpg k8s_ns_name=kube-system","output_fields":{"container.id":"48628fc537d5","container.image.repository":"ghcr.io/digitalocean-packages/node-readiness-reporter","container.image.tag":"v0.3.0","container.name":"nrr-status-patcher","evt.time":1779889508855418531,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"kube-system","k8s.pod.name":"cpc-bridge-proxy-ebpf-6vqpg","user.name":"nonroot"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:45:08.855418531Z"}
{"hostname":"cde-38q702","output":"13:45:27.598850928: Warning Sensitive file read (user=root file=/var/run/secrets/kubernetes.io/serviceaccount/token container=cilium-agent ns=kube-system) container_id=2ae259e06e2f container_name=cilium-agent container_image_repository=ghcr.io/digitalocean-packages/cilium container_image_tag=v1.18.9 k8s_pod_name=cilium-8tmhn k8s_ns_name=kube-system","output_fields":{"container.id":"2ae259e06e2f","container.image.repository":"ghcr.io/digitalocean-packages/cilium","container.image.tag":"v1.18.9","container.name":"cilium-agent","evt.time":1779889527598850928,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"kube-system","k8s.pod.name":"cilium-8tmhn","user.name":"root"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:45:27.598850928Z"}
{"hostname":"cde-38q702","output":"13:45:29.721535226: Warning Sensitive file read (user=nonroot file=/var/run/secrets/kubernetes.io/serviceaccount/token container=nrr-status-patcher ns=kube-system) container_id=d40851237ecd container_name=nrr-status-patcher container_image_repository=ghcr.io/digitalocean-packages/node-readiness-reporter container_image_tag=v0.3.0 k8s_pod_name=cilium-8tmhn k8s_ns_name=kube-system","output_fields":{"container.id":"d40851237ecd","container.image.repository":"ghcr.io/digitalocean-packages/node-readiness-reporter","container.image.tag":"v0.3.0","container.name":"nrr-status-patcher","evt.time":1779889529721535226,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"kube-system","k8s.pod.name":"cilium-8tmhn","user.name":"nonroot"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:45:29.721535226Z"}
{"hostname":"cde-38q702","output":"13:45:58.858594510: Warning Sensitive file read (user=nonroot file=/var/run/secrets/kubernetes.io/serviceaccount/token container=nrr-status-patcher ns=kube-system) container_id=48628fc537d5 container_name=nrr-status-patcher container_image_repository=ghcr.io/digitalocean-packages/node-readiness-reporter container_image_tag=v0.3.0 k8s_pod_name=cpc-bridge-proxy-ebpf-6vqpg k8s_ns_name=kube-system","output_fields":{"container.id":"48628fc537d5","container.image.repository":"ghcr.io/digitalocean-packages/node-readiness-reporter","container.image.tag":"v0.3.0","container.name":"nrr-status-patcher","evt.time":1779889558858594510,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"kube-system","k8s.pod.name":"cpc-bridge-proxy-ebpf-6vqpg","user.name":"nonroot"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:45:58.858594510Z"}
{"hostname":"cde-38q702","output":"13:46:18.021379728: Warning Sensitive file read (user=root file=/var/run/secrets/kubernetes.io/serviceaccount/token container=fluent-bit ns=logging) container_id=740cee06078f container_name=fluent-bit container_image_repository=docker.io/fluent/fluent-bit container_image_tag=3.1 k8s_pod_name=fluent-bit-x9klb k8s_ns_name=logging","output_fields":{"container.id":"740cee06078f","container.image.repository":"docker.io/fluent/fluent-bit","container.image.tag":"3.1","container.name":"fluent-bit","evt.time":1779889578021379728,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"logging","k8s.pod.name":"fluent-bit-x9klb","user.name":"root"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:46:18.021379728Z"}
{"hostname":"cde-38q702","output":"13:46:24.622724248: Warning Sensitive file read (user=nonroot file=/var/run/secrets/kubernetes.io/serviceaccount/token container=nrr-status-patcher ns=kube-system) container_id=d40851237ecd container_name=nrr-status-patcher container_image_repository=ghcr.io/digitalocean-packages/node-readiness-reporter container_image_tag=v0.3.0 k8s_pod_name=cilium-8tmhn k8s_ns_name=kube-system","output_fields":{"container.id":"d40851237ecd","container.image.repository":"ghcr.io/digitalocean-packages/node-readiness-reporter","container.image.tag":"v0.3.0","container.name":"nrr-status-patcher","evt.time":1779889584622724248,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"kube-system","k8s.pod.name":"cilium-8tmhn","user.name":"nonroot"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:46:24.622724248Z"}
{"hostname":"cde-38q702","output":"13:46:27.606599793: Warning Sensitive file read (user=root file=/var/run/secrets/kubernetes.io/serviceaccount/token container=cilium-agent ns=kube-system) container_id=2ae259e06e2f container_name=cilium-agent container_image_repository=ghcr.io/digitalocean-packages/cilium container_image_tag=v1.18.9 k8s_pod_name=cilium-8tmhn k8s_ns_name=kube-system","output_fields":{"container.id":"2ae259e06e2f","container.image.repository":"ghcr.io/digitalocean-packages/cilium","container.image.tag":"v1.18.9","container.name":"cilium-agent","evt.time":1779889587606599793,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"kube-system","k8s.pod.name":"cilium-8tmhn","user.name":"root"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:46:27.606599793Z"}
{"hostname":"cde-38q702","output":"13:46:48.950228749: Warning Sensitive file read (user=nonroot file=/var/run/secrets/kubernetes.io/serviceaccount/token container=nrr-status-patcher ns=kube-system) container_id=48628fc537d5 container_name=nrr-status-patcher container_image_repository=ghcr.io/digitalocean-packages/node-readiness-reporter container_image_tag=v0.3.0 k8s_pod_name=cpc-bridge-proxy-ebpf-6vqpg k8s_ns_name=kube-system","output_fields":{"container.id":"48628fc537d5","container.image.repository":"ghcr.io/digitalocean-packages/node-readiness-reporter","container.image.tag":"v0.3.0","container.name":"nrr-status-patcher","evt.time":1779889608950228749,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"kube-system","k8s.pod.name":"cpc-bridge-proxy-ebpf-6vqpg","user.name":"nonroot"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:46:48.950228749Z"}
{"hostname":"cde-38q702","output":"13:47:14.721479526: Warning Sensitive file read (user=nonroot file=/var/run/secrets/kubernetes.io/serviceaccount/token container=nrr-status-patcher ns=kube-system) container_id=d40851237ecd container_name=nrr-status-patcher container_image_repository=ghcr.io/digitalocean-packages/node-readiness-reporter container_image_tag=v0.3.0 k8s_pod_name=cilium-8tmhn k8s_ns_name=kube-system","output_fields":{"container.id":"d40851237ecd","container.image.repository":"ghcr.io/digitalocean-packages/node-readiness-reporter","container.image.tag":"v0.3.0","container.name":"nrr-status-patcher","evt.time":1779889634721479526,"fd.name":"/var/run/secrets/kubernetes.io/serviceaccount/token","k8s.ns.name":"kube-system","k8s.pod.name":"cilium-8tmhn","user.name":"nonroot"},"priority":"Warning","rule":"PCI - Sensitive File Read","source":"syscall","tags":["filesystem","pci_dss","req_10.2.4"],"time":"2026-05-27T13:47:14.721479526Z"}
