We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for FALCO_IDS

Date	Changes
2024-03-06	Bug-Fix: - Changed the name of the label for `output_fields.tags` from `tags` to `tags_label`.
2023-05-23	Extracted and mapped `host-IP` and `host-name` field from `output` field. Changed event_type from `GENERIC_EVENT` to related `metadata.event_type` wherever possible.
2022-08-26	Mapped `priority` to `resource.attribute.labels` and key is priority. Added Condition to check whether output_fields.email is in the form of email or not before mapping it to target.email.
2022-08-01	Mapped `output` to `metadata.description` Mapped `priority` to `security_result.priority` and `security_result.severity` Mapped `rule` to `security_result.rule_name` Mapped `time` to `date` Mapped `output_fields.bl-ssr` to `target.resource.name` Mapped `output_fields.cloud-project-id` to `observer.cloud.project.id` Mapped `output_fields.cloud-provider` to `target.resource.attribute.cloud.environment` Mapped `output_fields.container.id` to `target.asset.asset_id` Mapped `output_fields.container.image.repository` to `target.file.full_path` Mapped `output_fields.email` to `target.email` Mapped `output_fields.evt.arg.fd` to `resource.attribute.labels` and key is `evt_arg_fd` Mapped `output_fields.evt.arg.filename` to `resource.attribute.labels` and `evt_arg_filename` Mapped `output_fields.evt.arg.mode` to `resource.attribute.labels` and `evt_arg_mode` Mapped `output_fields.fd.name` to `resource.attribute.labels` and `fd_name` Mapped `output_fields.host-ip` to `target.ip` Mapped `output_fields.host-name` to `target.hostname` Mapped `output_fields.k8s.ns.name` to `additional.fields` and key is `k8s_ns_name` Mapped `output_fields.k8s.pod.name` to `additional.fields` and key is `k8s_pod_name` Mapped `output_fields.ol-env` to `resource.attribute.labels` and key is `ol-env` Mapped `output_fields.pod-ip` to `observer.ip` Mapped `output_fields.pod-name` to `observer.hostname` Mapped `output_fields.proc.cmdline` to `target.resource.attribute.labels` and key is `proc_cmdline` Mapped `output_fields.user.loginuid` to `target.user.userid` Mapped `output_fields.user.name` to `principal.user.user_display_name` Mapped `output_fields.ebpf_enabled` to `target.resource.attribute.labels` and key is `ebpf_enabled` Mapped `output_fields.falco.contact` to `principal.user.email_addresses` Mapped `output_fields.falco.host.ip` to `principal.ip` Mapped `output_fields.falco.host.name` to `principal.hostname` Mapped `output_fields.falco.pod.ip` to `observer.ip` Mapped `output_fields.falco.pod.name` to `observer.hostname` Mapped `output_fields.falco.ssrid` to `resource.product_object_id` Mapped `output_fields.tags` to `target.labels` and key is `tags`