diff --git a/falco/rules/tune-noise.yaml b/falco/rules/tune-noise.yaml
index a3916e1..4dc31e8 100644
--- a/falco/rules/tune-noise.yaml
+++ b/falco/rules/tune-noise.yaml
@@ -11,3 +11,14 @@
 # harvesting. Scoped to just this binary, not a blanket rule disable.
 - macro: user_known_read_sensitive_files_activities
   condition: (proc.name = pg_isready)
+
+# "Drop and execute new binary in container" fires on every git push/pull
+# to gitea over SSH - gitea's own binary re-executes itself for git-shell
+# commands (serv/hook/pre-receive/post-receive), which looks identical to
+# drift-detection's "new binary written to the writable layer" pattern.
+# Scoped to proc.name=gitea specifically (not the whole container via
+# known_drop_and_execute_containers) so this container - the one that was
+# actually compromised - still gets checked for any OTHER unexpected
+# binary, just not its own expected self-invocation.
+- macro: known_drop_and_execute_activities
+  condition: (container.image.repository = "docker.gitea.com/gitea" and proc.name = gitea)
diff --git a/netdata/go.d/prometheus.conf b/netdata/go.d/prometheus.conf
new file mode 100644
index 0000000..b5851cf
--- /dev/null
+++ b/netdata/go.d/prometheus.conf
@@ -0,0 +1,3 @@
+jobs:
+  - name: falco
+    url: http://falco:8765/metrics
diff --git a/netdata/health.d/falco-miner.conf b/netdata/health.d/falco-miner.conf
new file mode 100644
index 0000000..b496332
--- /dev/null
+++ b/netdata/health.d/falco-miner.conf
@@ -0,0 +1,12 @@
+ template: falco_rule_match
+       on: prometheus.falco.falcosecurity_falco_rules_matches_total
+    class: Security
+     type: System
+component: Falco
+    units: matches
+    every: 10s
+   lookup: sum -120s unaligned
+     crit: $this > 0
+  summary: Falco rule fired - ${label:rule_name}
+     info: Falco priority ${label:priority} rule ${label:rule_name} matched on this host. Run: docker logs falco to see which container/process/command triggered it. If the rule name mentions crypto miner or miner pool port, treat it as an active compromise and investigate immediately.
+       to: sysadmin