Detection rules › Falco
Anonymous Request Allowed
Detect any request made by the anonymous user that was allowed
Stages and Predicates
Stage 1: falco_condition
and
not
or
requestURI eq "/healthz"
requestURI starts_with "/healthz?"
not
or
requestURI eq "/livez"
requestURI starts_with "/livez?"
not
or
requestURI eq "/readyz"
requestURI starts_with "/readyz?"
annotations.authorization_k8s_io/decision eq "allow"
stage eq "ResponseComplete"
user.username eq "system:anonymous"
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
requestURI | eq | /healthz | excludes:requestURI field:"requestURI" value:"/healthz" |
requestURI | starts_with | /healthz? | excludes:requestURI field:"requestURI" value:"/healthz?" |
requestURI | eq | /livez | excludes:requestURI field:"requestURI" value:"/livez" |
requestURI | starts_with | /livez? | excludes:requestURI field:"requestURI" value:"/livez?" |
requestURI | eq | /readyz | excludes:requestURI field:"requestURI" value:"/readyz" |
requestURI | starts_with | /readyz? | excludes:requestURI field:"requestURI" value:"/readyz?" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
annotations.authorization_k8s_io/decision | eq |
| field:"annotations.authorization_k8s_io/decision" kind:eq value:"allow" |
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |
user.username | eq |
| field:"user.username" kind:eq value:"system:anonymous" |