# Tune out stock-rule false positives observed on this specific host, so the
# broad netdata "any Falco match" alarm only pages for things worth paging
# for. Uses Falco's own user_* customization macros rather than disabling
# whole rules, so the underlying security check stays active for everything
# else. Add entries here as new noisy defaults turn up - don't let this list
# grow into blinding Falco to anything actually meaningful.

# "Sensitive file opened for reading by non-trusted program" fired every
# ~10s from inbox-zero-db's pg_isready healthcheck touching /etc/shadow -
# NSS/libc user-lookup behavior during process init, not credential
# harvesting. Scoped to just this binary, not a blanket rule disable.
- macro: user_known_read_sensitive_files_activities
  condition: (proc.name = pg_isready)