apiVersion: v1 data: rules.yaml: |2- - action: Terminate Pod actionner: kubernetes:terminate - action: Label Pod as Suspicious actionner: kubernetes:label parameters: labels: analysis/status: "suspicious" # PR10_STACK_VERSION: v19-live-marker-routing # PR10_TALON_RULESET_ID: routing-v19-live-markers # ============================================================ # ENSEMBLE DE RÈGLES TALON — ROUTAGE SEULEMENT # # Chaque scénario contrôlé possède sa propre règle Talon et son propre # label inoffensif sur le pod. La preuve de routage devient ainsi indépendante # de la corrélation a posteriori dans les journaux texte. # ============================================================ - action: PR10 Routing Canary Marker actionner: kubernetes:label parameters: level: pod labels: falco-talon-routing-ready: "true" - rule: PR10 Routing Canary Playbook description: Preuve inoffensive que l’ensemble de règles de routage est actif. match: rules: - PR10 Response Trigger Talon Active Canary actions: - action: PR10 Routing Canary Marker - action: S01 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s01: "true" - rule: PB1 Routing Validation Playbook S01 description: Acheminer le scénario contrôlé S01 vers PB1. match: rules: - PR10 Route S01 PB1 actions: - action: S01 PB1 Routing Marker - action: S02 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s02: "true" - rule: PB1 Routing Validation Playbook S02 description: Acheminer le scénario contrôlé S02 vers PB1. match: rules: - PR10 Route S02 PB1 actions: - action: S02 PB1 Routing Marker - action: S03 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s03: "true" - rule: PB1 Routing Validation Playbook S03 description: Acheminer le scénario contrôlé S03 vers PB1. match: rules: - PR10 Route S03 PB1 actions: - action: S03 PB1 Routing Marker - action: S04 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s04: "true" - rule: PB1 Routing Validation Playbook S04 description: Acheminer le scénario contrôlé S04 vers PB1. match: rules: - PR10 Route S04 PB1 actions: - action: S04 PB1 Routing Marker - action: S05 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s05: "true" - rule: PB1 Routing Validation Playbook S05 description: Acheminer le scénario contrôlé S05 vers PB1. match: rules: - PR10 Route S05 PB1 actions: - action: S05 PB1 Routing Marker - action: S06 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s06: "true" - rule: PB1 Routing Validation Playbook S06 description: Acheminer le scénario contrôlé S06 vers PB1. match: rules: - PR10 Route S06 PB1 actions: - action: S06 PB1 Routing Marker - action: S07 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s07: "true" - rule: PB1 Routing Validation Playbook S07 description: Acheminer le scénario contrôlé S07 vers PB1. match: rules: - PR10 Route S07 PB1 actions: - action: S07 PB1 Routing Marker - action: S08 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s08: "true" - rule: PB1 Routing Validation Playbook S08 description: Acheminer le scénario contrôlé S08 vers PB1. match: rules: - PR10 Route S08 PB1 actions: - action: S08 PB1 Routing Marker - action: S09 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s09: "true" - rule: PB1 Routing Validation Playbook S09 description: Acheminer le scénario contrôlé S09 vers PB1. match: rules: - PR10 Route S09 PB1 actions: - action: S09 PB1 Routing Marker - action: S10 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s10: "true" - rule: PB1 Routing Validation Playbook S10 description: Acheminer le scénario contrôlé S10 vers PB1. match: rules: - PR10 Route S10 PB1 actions: - action: S10 PB1 Routing Marker - action: S11 PB1 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s11: "true" - rule: PB1 Routing Validation Playbook S11 description: Acheminer le scénario contrôlé S11 vers PB1. match: rules: - PR10 Route S11 PB1 actions: - action: S11 PB1 Routing Marker - action: S12 PB2 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s12: "true" - rule: PB2 Routing Validation Playbook S12 description: Acheminer le scénario contrôlé S12 vers PB2. match: rules: - PR10 Route S12 PB2 actions: - action: S12 PB2 Routing Marker - action: S13 PB2 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s13: "true" - rule: PB2 Routing Validation Playbook S13 description: Acheminer le scénario contrôlé S13 vers PB2. match: rules: - PR10 Route S13 PB2 actions: - action: S13 PB2 Routing Marker - action: S14 PB3 Routing Marker actionner: kubernetes:label parameters: level: pod labels: falco-route-s14: "true" - rule: PB3 Routing Validation Playbook S14 description: Acheminer le scénario contrôlé S14 vers PB3. match: rules: - PR10 Route S14 PB3 actions: - action: S14 PB3 Routing Marker kind: ConfigMap metadata: annotations: meta.helm.sh/release-name: falco-talon meta.helm.sh/release-namespace: falco creationTimestamp: "2026-11-09T06:02:55Z" labels: app.kubernetes.io/instance: falco-talon app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: falco-talon app.kubernetes.io/part-of: falco-talon app.kubernetes.io/version: 0.3.0 helm.sh/chart: falco-talon-0.4.2 name: falco-talon-rules namespace: falco resourceVersion: "3192" uid: ea87d3c6-2c83-4112-9b6d-cbfe6151a7b7