# File containing Falco rules, loaded at startup.
rules_file: /etc/falco_rules.yaml

# Whether to output events in json or text
json_output: false

# Send information logs to stderr and/or syslog Note these are *not* security
# notification logs! These are just Falco lifecycle (and possibly error) logs.
log_stderr: true
log_syslog: true


# Where security notifications should go.
# Multiple outputs can be enabled.

syslog_output:
  enabled: true

file_output:
  enabled: false
  filename: ./events.txt

stdout_output:
  enabled: true

program_output:
  enabled: false
  program: mail -s "Falco Notification" someone@example.com

# File containing Falco rules, loaded at startup.
rules_file: /etc/falco_rules.yaml

# Whether to output events in json or text
json_output: false

# Send information logs to stderr and/or syslog Note these are *not* security
# notification logs! These are just Falco lifecycle (and possibly error) logs.
log_stderr: true
log_syslog: true


# Where security notifications should go.
# Multiple outputs can be enabled.

syslog_output:
  enabled: true

file_output:
  enabled: false
  filename: ./events.txt

stdout_output:
  enabled: true

# Possible additional things you might want to do with program output:
#   - send to a slack webhook:
#         program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"
#   - logging (alternate method than syslog):
#         program: logger -t falco-test

program_output:
  enabled: false
  program: mail -s "Falco Notification" someone@example.com

Add notes on how to post to slack webhooks.
Add notes on how to post to slack webhooks.

Add comments for program_output that show how to post to a slack webhook
and an alernate logging method--came up in one of the github issues.
