Docs: Rule fields

A Falco rule can contain the following keys: Key Required Description Default rule yes A short, unique name for the rule. condition yes A filtering expression that is applied against events to check whether they match the rule. desc yes A longer description of what the rule detects.