diff --git a/content/en/docs/concepts/rules/_index.md b/content/en/docs/concepts/rules/_index.md index 28773f053..515e165d4 100644 --- a/content/en/docs/concepts/rules/_index.md +++ b/content/en/docs/concepts/rules/_index.md @@ -4,7 +4,7 @@ linktitle: Rules description: Write and customize Falco Rules to secure your environment weight: 20 aliases: -- ../rules +- ../../rules --- A Falco *rules file* is a [YAML](https://www.yaml.org/) file containing mainly three types of elements: diff --git a/content/en/docs/concepts/rules/adoption-rules.md b/content/en/docs/concepts/rules/adoption-rules.md index 1879c2e64..3f5cd5e9e 100644 --- a/content/en/docs/concepts/rules/adoption-rules.md +++ b/content/en/docs/concepts/rules/adoption-rules.md @@ -4,7 +4,7 @@ description: How to adopt Falco rules in real-life production linktitle: Adoption of Falco Rules in Production weight: 100 aliases: -- ../rules/adoption-rules +- ../../rules/adoption-rules --- diff --git a/content/en/docs/concepts/rules/basic-elements.md b/content/en/docs/concepts/rules/basic-elements.md index 6fbe505cd..0e87661b2 100644 --- a/content/en/docs/concepts/rules/basic-elements.md +++ b/content/en/docs/concepts/rules/basic-elements.md @@ -4,7 +4,7 @@ description: Understand Falco Rules, Lists and Macros linktitle: Basics of Falco Rules weight: 10 aliases: -- ../rules/basic-elements +- ../../rules/basic-elements --- ## Rules diff --git a/content/en/docs/concepts/rules/conditions.md b/content/en/docs/concepts/rules/conditions.md index 354763251..727660601 100644 --- a/content/en/docs/concepts/rules/conditions.md +++ b/content/en/docs/concepts/rules/conditions.md @@ -4,7 +4,7 @@ description: Learn how to write conditions for a Falco Rule linktitle: Condition Syntax weight: 40 aliases: -- ../rules/conditions +- ../../rules/conditions --- A condition is a boolean expression related to a single event that has been {{< glossary_tooltip text="detected" term_id="detection" >}} by Falco. You can use {{< glossary_tooltip text="fields" term_id="fields" >}} related to every supported event, but this document focuses on {{< glossary_tooltip text="syscalls" term_id="syscalls" >}} as they're currently the most common. The language supports boolean operators and parentheses as you'd expect. For example a condition like: diff --git a/content/en/docs/concepts/rules/controlling-rules.md b/content/en/docs/concepts/rules/controlling-rules.md index 9fd24a646..64b4b7335 100644 --- a/content/en/docs/concepts/rules/controlling-rules.md +++ b/content/en/docs/concepts/rules/controlling-rules.md @@ -4,7 +4,7 @@ description: Disable default rules or use tags to load Falco Rules selectively linktitle: Controlling Rules weight: 80 aliases: -- ../rules/controlling-rules +- ../../rules/controlling-rules --- ## Disable Default Rules diff --git a/content/en/docs/concepts/rules/custom-ruleset.md b/content/en/docs/concepts/rules/custom-ruleset.md index 53f36c10a..8c3069f1b 100644 --- a/content/en/docs/concepts/rules/custom-ruleset.md +++ b/content/en/docs/concepts/rules/custom-ruleset.md @@ -3,7 +3,7 @@ title: Custom Ruleset description: Start writing your first custom Falco rules weight: 85 aliases: -- ../rules/custom-ruleset +- ../../rules/custom-ruleset --- To write a custom rule for Falco from scratch, it is essential to understand the conditions that need to be met for Falco to trigger an alert. However, this task is complex as it requires considering the potential false positives and negatives arising from the rule. diff --git a/content/en/docs/concepts/rules/default-custom.md b/content/en/docs/concepts/rules/default-custom.md index a19bd4709..03f98fa07 100644 --- a/content/en/docs/concepts/rules/default-custom.md +++ b/content/en/docs/concepts/rules/default-custom.md @@ -4,7 +4,7 @@ description: Falco provides default rules, but you can add your own linktitle: Default and Local Rules weight: 20 aliases: -- ../rules/default-custom +- ../../rules/default-custom --- Falco comes with a default rules file that is loaded if no specific configuration is provided. However, that can be completely customized in several ways, depending on how Falco is installed. There are several ways to specify the location of your custom rules, download them, and keep them up to date. diff --git a/content/en/docs/concepts/rules/exceptions.md b/content/en/docs/concepts/rules/exceptions.md index d82bc03df..1c0158d59 100644 --- a/content/en/docs/concepts/rules/exceptions.md +++ b/content/en/docs/concepts/rules/exceptions.md @@ -4,7 +4,7 @@ description: Add exceptions to Falco Rules to adapt them to your environment linktitle: Rule Exceptions weight: 70 aliases: -- ../rules/exceptions +- ../../rules/exceptions --- ## Introduction diff --git a/content/en/docs/concepts/rules/fd-sip-name.md b/content/en/docs/concepts/rules/fd-sip-name.md index 32aeda551..dde11c6b7 100644 --- a/content/en/docs/concepts/rules/fd-sip-name.md +++ b/content/en/docs/concepts/rules/fd-sip-name.md @@ -4,7 +4,7 @@ description: How fd.sip.name and related fields work linktitle: Resolving Domain Names weight: 100 aliases: -- ../rules/fd-sip-name +- ../../rules/fd-sip-name --- ## Introduction diff --git a/content/en/docs/concepts/rules/fspath.md b/content/en/docs/concepts/rules/fspath.md index 5a8c1d638..d417139fc 100644 --- a/content/en/docs/concepts/rules/fspath.md +++ b/content/en/docs/concepts/rules/fspath.md @@ -4,7 +4,7 @@ description: How fs.path.* fields work linktitle: Accessing File System Paths weight: 100 aliases: -- ../rules/fspath +- ../../rules/fspath --- ## Introduction diff --git a/content/en/docs/concepts/rules/ide-support.md b/content/en/docs/concepts/rules/ide-support.md index 540d2b216..6055200a6 100644 --- a/content/en/docs/concepts/rules/ide-support.md +++ b/content/en/docs/concepts/rules/ide-support.md @@ -4,7 +4,7 @@ description: IDE Support for Falco Rules Files linktitle: IDE Support weight: 250 aliases: -- ../rules/ide-support +- ../../rules/ide-support --- For some Integrated Development Environment (IDE) Editors, there is support for falco rules files that allow for on-the-fly syntax checking and validation of rules content. diff --git a/content/en/docs/concepts/rules/overriding.md b/content/en/docs/concepts/rules/overriding.md index e4fe69f61..4ca4ec41d 100644 --- a/content/en/docs/concepts/rules/overriding.md +++ b/content/en/docs/concepts/rules/overriding.md @@ -4,8 +4,8 @@ description: Overriding Falco rules linktitle: Overriding Rules weight: 50 aliases: -- ../rules/appending -- ../rules/overriding +- ../../rules/appending +- ../../rules/overriding --- ## Overview There may be cases where you need to adjust the behavior of the Falco-supplied {{< glossary_tooltip text="list" term_id="lists" >}}, {{< glossary_tooltip text="macro" term_id="macros" >}}, and {{< glossary_tooltip text="rule" term_id="rules" >}}. diff --git a/content/en/docs/concepts/rules/pmatch-operator.md b/content/en/docs/concepts/rules/pmatch-operator.md index 2cfcbf929..a5f3d998a 100644 --- a/content/en/docs/concepts/rules/pmatch-operator.md +++ b/content/en/docs/concepts/rules/pmatch-operator.md @@ -4,7 +4,7 @@ description: How the pmatch Operator Works linktitle: Using pmatch Operator weight: 100 aliases: -- ../rules/pmatch-operator +- ../../rules/pmatch-operator --- ## Introduction diff --git a/content/en/docs/concepts/rules/special-characters.md b/content/en/docs/concepts/rules/special-characters.md index a7e6f2cf8..a24fbb8b0 100644 --- a/content/en/docs/concepts/rules/special-characters.md +++ b/content/en/docs/concepts/rules/special-characters.md @@ -4,7 +4,7 @@ description: Escape special characters in your Falco Rules linktitle: Escaping Special Characters weight: 90 aliases: -- ../rules/special-characters +- ../../rules/special-characters --- In some cases, rules may need to contain special characters like `(`, spaces, etc. For example, you may need to look for a `proc.name` of `(systemd)`, including the surrounding parentheses. diff --git a/content/en/docs/concepts/rules/style-guide.md b/content/en/docs/concepts/rules/style-guide.md index d9f670ef3..4e82dc801 100644 --- a/content/en/docs/concepts/rules/style-guide.md +++ b/content/en/docs/concepts/rules/style-guide.md @@ -4,7 +4,7 @@ description: Adopt best practices when writing and contributing Falco rules linktitle: Style Guide of Falco Rules weight: 95 aliases: -- ../rules/style-guide +- ../../rules/style-guide --- {{% alert color="warning" %}} diff --git a/content/en/docs/concepts/rules/versioning.md b/content/en/docs/concepts/rules/versioning.md index dfc71c841..813d81a1d 100644 --- a/content/en/docs/concepts/rules/versioning.md +++ b/content/en/docs/concepts/rules/versioning.md @@ -4,7 +4,7 @@ description: Understand how Falco Rules support explicit versioning linktitle: Rules Versioning weight: 200 aliases: -- ../rules/versioning +- ../../rules/versioning --- From time to time, we make changes to the {{< glossary_tooltip text="rules file" term_id="rules-file" >}} format that are not backwards-compatible with older versions of Falco. Similarly, {{< glossary_tooltip text="libsinsp" term_id="libsinsp" >}} and {{< glossary_tooltip text="libscap" term_id="libscap" >}} may define new filtercheck fields, operators, etc. We want to denote that a given set of rules depends on the fields/operators from those libraries.