poprhythm 7c0340519c falco: tune out calibre sudoers-sed and lsyncd log-truncation false positives ...

Investigated recent Telegram alerts - no intrusion, both new hits trace to
benign one-offs: calibre's linuxserver.io s6-init NOPASSWD setup (same
pattern already whitelisted for obsidian) and lsyncd truncating its own
status log (not evidence-clearing).

2026-08-20 22:18:12 +00:00

..

config

falco: add cryptominer/runtime-security scanner wired into netdata

2026-08-08 17:41:20 +00:00

rules

falco: tune out calibre sudoers-sed and lsyncd log-truncation false positives

2026-08-20 22:18:12 +00:00

docker-compose.yaml

add deploy-stack skill; falco: fix hook-tamper condition, add three more post-incident rules

2026-08-16 14:33:56 +00:00