Here are the fields supported by Falco. These fields can be used in the condition key of a Falco rule and well as the output key. Any fields included in the output key of a rule will also be included in the alert’s output_fields object when json_output is set to true .
Docs: Supported Fields for Conditions and Outputs
calendar_today
January 1, 2001
domain
falco