API Server Log Messages

https://falco.org/docs/outputs/formatting/

https://www.elastic.co/guide/en/integrations/current/falco.html#falco-logs-reference

API Server Log Messages

Base Rule

General Web Server Log

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

N/A

<subject>

Text/String

N/A

connection

<sip>:<sport>-><dip>:<dport>

IP Address/Number

N/A

lport

N/A

N/A

N/A

rport

N/A

N/A

N/A

fd_type

N/A

N/A

N/A

fd_proto

<protname>

Text/String

N/A

evt_type

<command>

Text/String

N/A

user

<login>

Text/String

N/A

user_uid

N/A

N/A

N/A

user_loginuid

N/A

N/A

N/A

process

<process>

Text/String

N/A

proc_exepath

<parentprocesspath>

Text/String

N/A

parent

N/A

N/A

N/A

command

N/A

N/A

N/A

get pods --token

N/A

N/A

N/A

terminal

N/A

N/A

N/A

container_id

<serialnumber>

Text/String/Number

N/A

container_image

N/A

N/A

N/A

container_image_tag

N/A

N/A

N/A

container_name

<object>

Text/String

N/A

k8s_ns

N/A

N/A

N/A

k8s_pod_name

N/A

N/A

N/A