# Overrides merged on top of Falco's built-in default config.
# Enables the Prometheus /metrics endpoint so netdata can scrape rule-trigger
# counts and alert via the existing Telegram notifier.
webserver:
  enabled: true
  listen_port: 8765
  k8s_healthz_endpoint: /healthz
  prometheus_metrics_enabled: true

metrics:
  enabled: true
  interval: 15s
  output_rule: true
  rules_counters_enabled: true

# Falco's default is "first rule wins" per event type, for performance -
# confirmed by testing: an execve matching both the stock "Drop and execute
# new binary in container" rule AND our custom miner-detect rule only
# emitted the stock rule's alert, silently. `all` disables that
# short-circuit so every matching rule fires independently (added in
# Falco 0.36.0). Accepting the modest extra CPU cost - a security tool
# silently dropping the alert it exists to send is worse.
rule_matching: all