From 1858572c4d6ed258c294263b2f55dd8ffbde8201 Mon Sep 17 00:00:00 2001
From: poprhythm <james.kolpack@gmail.com>
Date: Sat, 8 Aug 2026 22:48:05 +0000
Subject: [PATCH] falco/netdata: tune out gitea SSH false positive, make alert
 text self-explanatory

- 'Drop and execute new binary in container' fired on every git push/pull
  to gitea over SSH (gitea's own binary re-executing itself for git-shell
  hooks looks like container drift). Scoped exception via
  known_drop_and_execute_activities to proc.name=gitea on that specific
  image, not a blanket container whitelist, so other unexpected binaries
  in that container still get caught.
- netdata alarm text was a static generic blurb requiring a manual
  'docker logs falco' every time to find out what actually happened.
  Now interpolates ${label:rule_name}/${label:priority} (exposed by
  Falco's Prometheus metric) so the Telegram message names the specific
  rule directly. Note: literal double-quotes in the info/summary text
  broke netdata's alarm-notify.sh (silent delivery failure, exit 1) -
  avoided.
- Added netdata/health.d and netdata/go.d to the repo for documentation;
  netdata does not auto-deploy these from git, same as gitea's app.ini -
  copy to /srv/netdata/config/ manually and restart the container.
---
 falco/rules/tune-noise.yaml       | 11 +++++++++++
 netdata/go.d/prometheus.conf      |  3 +++
 netdata/health.d/falco-miner.conf | 12 ++++++++++++
 3 files changed, 26 insertions(+)
 create mode 100644 netdata/go.d/prometheus.conf
 create mode 100644 netdata/health.d/falco-miner.conf

diff --git a/falco/rules/tune-noise.yaml b/falco/rules/tune-noise.yaml
index a3916e1..4dc31e8 100644
--- a/falco/rules/tune-noise.yaml
+++ b/falco/rules/tune-noise.yaml
@@ -11,3 +11,14 @@
 # harvesting. Scoped to just this binary, not a blanket rule disable.
 - macro: user_known_read_sensitive_files_activities
   condition: (proc.name = pg_isready)
+
+# "Drop and execute new binary in container" fires on every git push/pull
+# to gitea over SSH - gitea's own binary re-executes itself for git-shell
+# commands (serv/hook/pre-receive/post-receive), which looks identical to
+# drift-detection's "new binary written to the writable layer" pattern.
+# Scoped to proc.name=gitea specifically (not the whole container via
+# known_drop_and_execute_containers) so this container - the one that was
+# actually compromised - still gets checked for any OTHER unexpected
+# binary, just not its own expected self-invocation.
+- macro: known_drop_and_execute_activities
+  condition: (container.image.repository = "docker.gitea.com/gitea" and proc.name = gitea)
diff --git a/netdata/go.d/prometheus.conf b/netdata/go.d/prometheus.conf
new file mode 100644
index 0000000..b5851cf
--- /dev/null
+++ b/netdata/go.d/prometheus.conf
@@ -0,0 +1,3 @@
+jobs:
+  - name: falco
+    url: http://falco:8765/metrics
diff --git a/netdata/health.d/falco-miner.conf b/netdata/health.d/falco-miner.conf
new file mode 100644
index 0000000..b496332
--- /dev/null
+++ b/netdata/health.d/falco-miner.conf
@@ -0,0 +1,12 @@
+ template: falco_rule_match
+       on: prometheus.falco.falcosecurity_falco_rules_matches_total
+    class: Security
+     type: System
+component: Falco
+    units: matches
+    every: 10s
+   lookup: sum -120s unaligned
+     crit: $this > 0
+  summary: Falco rule fired - ${label:rule_name}
+     info: Falco priority ${label:priority} rule ${label:rule_name} matched on this host. Run: docker logs falco to see which container/process/command triggered it. If the rule name mentions crypto miner or miner pool port, treat it as an active compromise and investigate immediately.
+       to: sysadmin