Falco Runtime Rule Checklist from Cluster Notes (No Invented Alert Totals)

Prompt

Act as a Falco detection engineer who only uses pasted cluster notes. You compile a runtime-rule checklist the notes already support. You do not invent alert totals, severity ranks, node counts, or CVE severity scores. This is not a live falcoctl apply run and not a compliance auditor certificate.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- Cluster notes I lock (rule stubs, syscall cues, output cues): [ClusterNotes]
- Falco version or chart notes I lock: [Version]
- Cluster or namespace label I may quote (or UNKNOWN): [ClusterLabel]
- Rule names already present (or UNKNOWN): [RuleNames]
- Syscall or event cues already present (or UNKNOWN): [SyscallCues]
- Output channel cues already present (or UNKNOWN): [OutputChannels]
- Priority cues already present (or UNKNOWN): [PriorityCues]
- Words I must not use: [Banned]
- What I must never invent (alert totals, severity ranks, node counts, CVE severity scores): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: ClusterNotes nouns, Version, ClusterLabel, RuleNames, SyscallCues, OutputChannels, PriorityCues, Lang. Forbidden: invented alert totals, severity ranks, node counts, CVE severity scores.
2. Runtime-rule checklist: one checkbox row per RuleNames entry. Attach only SyscallCues named beside that rule in ClusterNotes. Missing syscall write NOT IN INPUTS.
3. Output channel sketch: for each OutputChannels entry, list rules that name it. Do not invent a 38-alert total if absent.
4. Priority caution block: quote PriorityCues only. Critical packs not in ClusterNotes stay NOT IN INPUTS.
5. Refuse list: inventing 38 alert totals, inventing critical severity ranks, inventing 72 node counts, inventing CVE severity score 9.8.
6. Compliance pass: quote Banned and Never hits. Cut them. Print rule and syscall counts from ClusterNotes only. Format as Format.

Constraints:
- Runtime-rule checklist from ClusterNotes only. No invented alert totals.
- Honor Version. No emojis. Not a live Falco sidekick console.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

Falco Runtime Rule Checklist from Cluster Notes (No Invented Alert Totals) - Result

Examples

Example Input

ClusterNotes: rule Detect Harbor Shell as pasted syscall execve as pasted; rule Quay File Write as pasted syscall openat as pasted. Alert invent NONE. Node invent NONE.
Version: Falco as pasted (do not invent unreleased AI threat coach)
ClusterLabel: Harbor Quay staging as pasted
RuleNames: Detect Harbor Shell as pasted; Quay File Write as pasted. Privilege Esc UNKNOWN.
SyscallCues: execve as pasted for Detect Harbor Shell; openat as pasted for Quay File Write. ptrace UNKNOWN.
OutputChannels: channel Slack Harbor Ops as pasted for Detect Harbor Shell; Quay File Write channel NOT IN INPUTS.
PriorityCues: priority Warning as pasted for Detect Harbor Shell. Critical UNKNOWN.
Banned: 38 alerts, critical severity guaranteed, 72 nodes
Never: invent alert totals, invent severity ranks, invent node counts, invent CVE severity scores
Format: ledger + runtime-rule checklist + output sketch + priority caution + refuse + compliance
Lang: English

Example Output

1. Ledger. ClusterNotes: rule Detect Harbor Shell + syscall execve; rule Quay File Write + syscall openat. Alert invent NONE. Node invent NONE. Version Falco. ClusterLabel Harbor Quay staging. RuleNames Detect Harbor Shell; Quay File Write. SyscallCues execve; openat. OutputChannels Slack Harbor Ops for Detect Harbor Shell; Quay File Write channel NOT IN INPUTS. PriorityCues Warning for Detect Harbor Shell. Critical UNKNOWN. Lang English. Forbidden: invented alert totals, severity ranks, node counts, CVE severity scores, 38 alerts, critical severity guaranteed, 72 nodes.

2. Runtime-rule checklist.
[ ] Detect Harbor Shell | syscall execve as pasted.
[ ] Quay File Write | syscall openat as pasted.
Privilege Esc not attached. ptrace not added.

3. Output channel sketch.
channel Slack Harbor Ops | rule Detect Harbor Shell as pasted.
Quay File Write channel | NOT IN INPUTS.
Alert total NOT IN INPUTS so do not invent 38 alerts. Second Slack channel not invented.

4. Priority caution. Warning as pasted for Detect Harbor Shell. Critical UNKNOWN. CVE pack NOT IN INPUTS. Do not invent severity score 9.8 packs.

5. Refuse. 38 alert totals: refused. critical severity ranks: refused. 72 node counts: refused. CVE severity score 9.8: refused. Unreleased AI threat coach: refused.

6. Compliance. Banned hits none. Rules 2. Syscalls 2. Format ledger+runtime-rule checklist+output sketch+priority caution+refuse+compliance. Gaps: Quay File Write channel, Privilege Esc, ptrace, Critical, alert total.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.