Falco — 运行时安全 — Arcivéo

Falco

运行中

24 小时内事件数: 28

严重

24 小时内事件数

警告数

通知数: 4

热门规则

合计: 28

热门规则

Read sensitive file untrusted 5

Write below etc 1

Run shell untrusted 1

Terminal shell in container 0

Detect outbound connections to common miner pools 0

最近事件 28

                            warning
                            2026-08-14T03:55:32 warning A Read sensitive file untrusted (user=root command=sh pid=5117)
                        

                            warning
                            2026-08-14T03:24:00 warning A Terminal shell in container (user=root command=sh pid=9599)
                        

                            warning
                            2026-08-14T03:01:20 warning A Detect outbound connections to common miner pools (user=root command=sh pid=4628)
                        

                            warning
                            2026-08-14T03:36:50 warning A Run shell untrusted (user=root command=sh pid=2883)
                        

                            notice
                            2026-08-14T02:59:32 notice A Read sensitive file untrusted (user=root command=sh pid=2798)
                        

                            warning
                            2026-08-14T02:08:52 warning A Write below etc (user=root command=sh pid=6344)
                        

                            notice
                            2026-08-14T02:50:20 notice A Write below etc (user=root command=sh pid=9074)
                        

                            warning
                            2026-08-13T23:15:46 warning A Detect outbound connections to common miner pools (user=root command=sh pid=5582)
                        

                            warning
                            2026-08-14T00:56:12 warning A Read sensitive file untrusted (user=root command=sh pid=9896)
                        

                            warning
                            2026-08-13T20:30:11 warning A Detect outbound connections to common miner pools (user=root command=sh pid=4194)
                        

                            notice
                            2026-08-14T00:18:22 notice A Write below etc (user=root command=sh pid=6276)
                        

                            notice
                            2026-08-13T22:07:56 notice A Read sensitive file untrusted (user=root command=sh pid=1228)
                        

                            warning
                            2026-08-14T02:22:44 warning A Run shell untrusted (user=root command=sh pid=6179)
                        

调优：屏蔽误报

面板不会修改 Falco 配置——只显示代码片段和命令，供您通过 SSH 在服务器上执行。

1. 创建包含排除项的覆盖文件：

# /etc/falco/rules.d/local-tuning.yaml
- rule: <上方列表中的精确规则名称>
  condition: and not fd.name = /path/to/exclude
  append: true

2. 检查并重启 Falco：

sudo nano /etc/falco/rules.d/local-tuning.yaml
sudo falco --validate /etc/falco/rules.d/local-tuning.yaml
sudo systemctl restart falco 2>/dev/null || sudo systemctl restart falco-modern-bpf

请使用准确的规则名称。如果列表中显示的是消息文本而非名称，请在 falco.yaml 中启用 JSON 输出（json_output: true），面板即可获取准确的规则名称。

演示模式