Falco JSON alert

Falco JSON alert. Rule match output from Falco with structured output_fields.

Source and collection

Configured Falco JSON output destination.

Enable JSON output and record engine, source, ruleset and driver configuration.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 3c6a888c46eba7b4628bf9a7d77b70875c49679ae6ef2b8e9c4079af506dc8c1

{"hostname":"97ade2b595f0","output":"2024-05-07T18:54:19.341081180+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=9656db3bb358 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-07T18:54:19.341081180Z", "output_fields": {"container.id":"9656db3bb358","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715108059341081180,"evt.type":"openat","fd.name":"/etc/shadow","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`hostname`	str
`output`	str
`priority`	str
`rule`	str
`source`	str
`tags`	array
`tags[0]`	str
`time`	str
`output_fields.container.id`	str
`output_fields.container.name`	str
`output_fields.evt.time.iso8601`	int
`output_fields.evt.type`	str
`output_fields.fd.name`	str
`output_fields.proc.cmdline`	str
`output_fields.proc.exepath`	str
`output_fields.proc.name`	str
`output_fields.proc.pname`	str
`output_fields.proc.tty`	int
`output_fields.user.loginuid`	int
`output_fields.user.name`	str
`output_fields.user.uid`	int

rule: Matched rule name.
source: Event source.
priority: Rule priority, not a confirmed incident verdict.
output_fields: Rule-selected event fields.

Investigation uses

Review rule, priority, source and output_fields with runtime context.
Correlate process and container identifiers with orchestrator audit and workload inventory.

Validation boundaries

A rule match is an investigative lead; sources and rule output fields vary.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Falco Outputs | Falco

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.