Docs: Condition Syntax

A Falco rule’s condition defines the filter that determines which events are detected by the rule. This condition is a boolean expression that evaluates to true or false for each event. If it evaluates to true , the rule triggers and generates an alert .