apiVersion: v1
data:
  rules.yaml: |2-

    - action: Terminate Pod
      actionner: kubernetes:terminate

    - action: Label Pod as Suspicious
      actionner: kubernetes:label
      parameters:
        labels:
          analysis/status: "suspicious"


    # PR10_STACK_VERSION: v14-scenario-routing
    # PR10_TALON_RULESET_ID: passive-v15-live-sync
    # Talon demeure en ligne pendant les expériences de détection, mais cette règle
    # ne peut jamais correspondre à un véritable événement Falco.

    - action: Passive Marker Never Executed
      actionner: kubernetes:label
      parameters:
        level: pod
        labels:
          falco-passive-marker: "unexpected"

    - rule: PR10 Passive Never Match
      description: Configuration Talon en mode observation seulement.
      match:
        rules:
          - PR10 __PASSIVE_NEVER_MATCH__
      actions:
        - action: Passive Marker Never Executed
kind: ConfigMap
metadata:
  annotations:
    meta.helm.sh/release-name: falco-talon
    meta.helm.sh/release-namespace: falco
  creationTimestamp: "2026-11-09T06:02:55Z"
  labels:
    app.kubernetes.io/instance: falco-talon
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: falco-talon
    app.kubernetes.io/part-of: falco-talon
    app.kubernetes.io/version: 0.3.0
    helm.sh/chart: falco-talon-0.4.2
  name: falco-talon-rules
  namespace: falco
  resourceVersion: "2025"
  uid: ea87d3c6-2c83-4112-9b6d-cbfe6151a7b7