Falco container runtime alert events are delivered to a Logstore with the following fields.
|
Field |
Description |
|
output |
Detailed information about the alert event. |
|
output_fields |
The values of the event fields that triggered the alert. |
|
priority |
The severity level of the alert. |
|
rule |
The name of the Falco rule that triggered the alert. |
|
tags |
Tags associated with the alert event. |
|
time |
The time when the alert was generated. |
该文章对您有帮助吗？