# Tune out stock-rule false positives observed on this specific host, so the
# broad netdata "any Falco match" alarm only pages for things worth paging
# for. Uses Falco's own user_* customization macros rather than disabling
# whole rules, so the underlying security check stays active for everything
# else. Add entries here as new noisy defaults turn up - don't let this list
# grow into blinding Falco to anything actually meaningful.

# "Sensitive file opened for reading by non-trusted program" fired every
# ~10s from inbox-zero-db's pg_isready healthcheck touching /etc/shadow -
# NSS/libc user-lookup behavior during process init, not credential
# harvesting. Scoped to just this binary, not a blanket rule disable.
- macro: user_known_read_sensitive_files_activities
  condition: (proc.name = pg_isready)

# "Drop and execute new binary in container" fires on every git push/pull
# to gitea over SSH - gitea's own binary re-executes itself for git-shell
# commands (serv/hook/pre-receive/post-receive), which looks identical to
# drift-detection's "new binary written to the writable layer" pattern.
# Scoped to proc.name=gitea specifically (not the whole container via
# known_drop_and_execute_containers) so this container - the one that was
# actually compromised - still gets checked for any OTHER unexpected
# binary, just not its own expected self-invocation.
- macro: known_drop_and_execute_activities
  condition: (container.image.repository = "docker.gitea.com/gitea" and proc.name = gitea)