template: falco_rule_match
       on: prometheus.falco.falcosecurity_falco_rules_matches_total
    class: Security
     type: System
component: Falco
    units: matches
    every: 10s
   lookup: sum -120s unaligned
     crit: $this > 0
  summary: Falco rule fired - ${label:rule_name}
     info: Falco priority ${label:priority} rule ${label:rule_name} matched on this host. Run: docker logs falco to see which container/process/command triggered it. If the rule name mentions crypto miner or miner pool port, treat it as an active compromise and investigate immediately.
       to: sysadmin