poprhythm 31f09721cd falco: tune out host-reboot false positives from 2026-09-16 boot burst ...

Host rebooted 2026-09-16 17:47 UTC, recreating every container at once and
producing 70 alerts in a single burst - all traced to benign init-time
patterns that will recur on every future reboot: systemd-executor's PAM
reads during boot, firefly-iii/fidi's s6 healthcheck shell, and romm's own
loopback redis/app connection at container start.

2026-09-16 23:19:54 +00:00

..

cloud-metadata-probe.yaml

falco: scope cloud-metadata-probe past netdata's own auto-detection curl

2026-08-16 14:40:39 +00:00

db-spawned-process.yaml

add deploy-stack skill; falco: fix hook-tamper condition, add three more post-incident rules

2026-08-16 14:33:56 +00:00

git-hook-tamper.yaml

falco: fix git-hook-tamper false-positiving on every gitea push

2026-08-16 15:41:05 +00:00

miner-detect.yaml

falco: add cryptominer/runtime-security scanner wired into netdata

2026-08-08 17:41:20 +00:00

miner-pool-ports.yaml

falco: exclude loopback destinations from miner-pool-port rule

2026-08-25 21:44:03 +00:00

ssh-persistence.yaml

add deploy-stack skill; falco: fix hook-tamper condition, add three more post-incident rules

2026-08-16 14:33:56 +00:00

tune-noise.yaml

falco: tune out host-reboot false positives from 2026-09-16 boot burst

2026-09-16 23:19:54 +00:00

unexpected-child-of-git.yaml

falco: add rules for git hook tampering and unexpected pack-service children

2026-08-16 14:24:29 +00:00