From afdefb146535748f8e0c174838c552ff76a6a6d0 Mon Sep 17 00:00:00 2001 From: MalinNordqvist Date: Thu, 31 Jul 2025 09:36:33 +0200 Subject: [PATCH 1/2] Config: Updated falco alerts --- .../templates/alerts/falco-alerts.yaml | 31 +++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/helmfile.d/charts/prometheus-alerts/templates/alerts/falco-alerts.yaml b/helmfile.d/charts/prometheus-alerts/templates/alerts/falco-alerts.yaml index 1a8f51b25e..8b65270131 100644 --- a/helmfile.d/charts/prometheus-alerts/templates/alerts/falco-alerts.yaml +++ b/helmfile.d/charts/prometheus-alerts/templates/alerts/falco-alerts.yaml @@ -22,7 +22,34 @@ spec: message: 'Pod: {{`{{ $labels.pod }}`}}, Rule: {{`{{ $labels.rule }}`}}' runbook_url: {{ .Values.runbookUrls.falco.FalcoAlert }} expr: |- - falcosecurity_falcosidekick_falco_events_total != 0 + falcosecurity_falcosidekick_falco_events_total{priority_raw="critical"} > 0 + labels: + severity: critical + + - alert: FalcoAlert + annotations: + message: 'Pod: {{`{{ $labels.pod }}`}}, Rule: {{`{{ $labels.rule }}`}}' + runbook_url: {{ .Values.runbookUrls.falco.FalcoAlert }} + expr: |- + falcosecurity_falcosidekick_falco_events_total{priority_raw="warning"} > 0 labels: severity: warning -{{- end }} + + - alert: FalcoAlert + annotations: + message: 'Pod: {{`{{ $labels.pod }}`}}, Rule: {{`{{ $labels.rule }}`}}' + runbook_url: {{ .Values.runbookUrls.falco.FalcoAlert }} + expr: |- + falcosecurity_falcosidekick_falco_events_total{priority_raw="notice"} > 0 + labels: + severity: medium + + - alert: FalcoAlert + annotations: + message: 'Pod: {{`{{ $labels.pod }}`}}, Rule: {{`{{ $labels.rule }}`}}' + runbook_url: {{ .Values.runbookUrls.falco.FalcoAlert }} + expr: |- + falcosecurity_falcosidekick_falco_events_total{priority_raw="informational"} > 0 + labels: + severity: low +{{- end }} \ No newline at end of file From 7720395fb71c09c0fc2ae2c3a0b10d7682c960ab Mon Sep 17 00:00:00 2001 From: MalinNordqvist Date: Thu, 31 Jul 2025 16:47:35 +0200 Subject: [PATCH 2/2] Ran pre-commit --- .../templates/alerts/falco-alerts.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/helmfile.d/charts/prometheus-alerts/templates/alerts/falco-alerts.yaml b/helmfile.d/charts/prometheus-alerts/templates/alerts/falco-alerts.yaml index 8b65270131..3bfcd0cd52 100644 --- a/helmfile.d/charts/prometheus-alerts/templates/alerts/falco-alerts.yaml +++ b/helmfile.d/charts/prometheus-alerts/templates/alerts/falco-alerts.yaml @@ -31,16 +31,16 @@ spec: message: 'Pod: {{`{{ $labels.pod }}`}}, Rule: {{`{{ $labels.rule }}`}}' runbook_url: {{ .Values.runbookUrls.falco.FalcoAlert }} expr: |- - falcosecurity_falcosidekick_falco_events_total{priority_raw="warning"} > 0 + falcosecurity_falcosidekick_falco_events_total{priority_raw="warning"} > 0 labels: severity: warning - + - alert: FalcoAlert annotations: message: 'Pod: {{`{{ $labels.pod }}`}}, Rule: {{`{{ $labels.rule }}`}}' runbook_url: {{ .Values.runbookUrls.falco.FalcoAlert }} expr: |- - falcosecurity_falcosidekick_falco_events_total{priority_raw="notice"} > 0 + falcosecurity_falcosidekick_falco_events_total{priority_raw="notice"} > 0 labels: severity: medium @@ -49,7 +49,7 @@ spec: message: 'Pod: {{`{{ $labels.pod }}`}}, Rule: {{`{{ $labels.rule }}`}}' runbook_url: {{ .Values.runbookUrls.falco.FalcoAlert }} expr: |- - falcosecurity_falcosidekick_falco_events_total{priority_raw="informational"} > 0 + falcosecurity_falcosidekick_falco_events_total{priority_raw="informational"} > 0 labels: severity: low -{{- end }} \ No newline at end of file +{{- end }}