Back to Falco

Conditions

content/en/docs/reference/glossary/conditions.md

latest359 B
Original Source

Criteria to trigger an alert.

<!--more-->

A key part of a {{< glossary_tooltip text="rule" term_id="rules" >}} is the condition field. A condition is a Boolean predicate expressed using the condition syntax. It is possible to express conditions on all supported events using their respective supported {{< glossary_tooltip text="fields" term_id="fields" >}}.