Sensitive File Opened Log Messages

https://falco.org/docs/outputs/formatting/

https://www.elastic.co/guide/en/integrations/current/falco.html#falco-logs-reference

Sensitive File Opened Log Messages

Base Rule

File Opened

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

N/A

<subject>

Text/String

N/A

file

<objectname>

Text/String

N/A

gparent

N/A

N/A

N/A

ggparent

N/A

N/A

N/A

gggparent

N/A

N/A

N/A

evt_type

<command>

Text/String

N/A

user

<login>

Text/String

N/A

user_uid

N/A

N/A

N/A

user_loginuid

N/A

N/A

N/A

process

<process>

Text/String

N/A

proc_exepath

<parentprocesspath>

Text/String

N/A

parent

N/A

N/A

N/A

command

N/A

N/A

N/A

terminal

N/A

N/A

N/A

container_id

<serialnumber>

Text/String/Number

N/A

container_image

N/A

N/A

N/A

container_image_tag

N/A

N/A

N/A

container_name

<object>

Text/String

N/A

k8s_ns

N/A

N/A

N/A

k8s_pod_name

N/A

N/A

N/A