Jia:
Question: If we have to create new falco rule, then we need to create under /etc/falco/falco_rules.local.yaml right since only default rules exist in falco_rules.yaml ?
Diegoflores:
Yes I think new Falco release might overwrite the falco_rules.yaml and loose your manual changes