mirror of
https://github.com/Ed1s0nZ/CyberStrikeAI.git
synced 2026-03-31 00:09:29 +02:00
61 lines
1.5 KiB
YAML
61 lines
1.5 KiB
YAML
name: "falco"
|
||
command: "falco"
|
||
enabled: true
|
||
short_description: "运行时安全监控工具"
|
||
description: |
|
||
Falco是一个运行时安全监控工具，用于检测容器和主机中的异常行为。
|
||
|
||
**主要功能：**
|
||
- 运行时监控
|
||
- 异常检测
|
||
- 规则引擎
|
||
- 实时告警
|
||
|
||
**使用场景：**
|
||
- 运行时安全监控
|
||
- 异常检测
|
||
- 安全事件响应
|
||
- 合规性监控
|
||
parameters:
|
||
- name: "config_file"
|
||
type: "string"
|
||
description: "Falco配置文件"
|
||
required: false
|
||
flag: "--config"
|
||
format: "flag"
|
||
default: "/etc/falco/falco.yaml"
|
||
- name: "rules_file"
|
||
type: "string"
|
||
description: "自定义规则文件"
|
||
required: false
|
||
flag: "--rules"
|
||
format: "flag"
|
||
- name: "json_output"
|
||
type: "bool"
|
||
description: "以JSON格式输出（等同于 -o json_output=true）"
|
||
required: false
|
||
flag: "-o json_output=true"
|
||
format: "flag"
|
||
default: true
|
||
- name: "duration"
|
||
type: "int"
|
||
description: "监控持续时间（秒）"
|
||
required: false
|
||
flag: "--duration"
|
||
format: "flag"
|
||
default: 60
|
||
- name: "additional_args"
|
||
type: "string"
|
||
description: |
|
||
额外的falco参数。用于传递未在参数列表中定义的falco选项。
|
||
|
||
**示例值：**
|
||
- 根据工具特性添加常用参数示例
|
||
|
||
**注意事项：**
|
||
- 多个参数用空格分隔
|
||
- 确保参数格式正确，避免命令注入
|
||
- 此参数会直接追加到命令末尾
|
||
required: false
|
||
format: "positional"
|