reduce low priority Falco Slack alerts

2026-08-15 14:13:53 -04:00
parent 4484865bbf
commit 2ca1b150cc
2 changed files with 6 additions and 0 deletions
@@ -29,6 +29,8 @@ kubectl create secret generic falco-alerting \
 ```

 The `webhook-url` key is injected into Falcosidekick as `SLACK_WEBHOOKURL`.
+Falcosidekick sends only `WARNING` and higher priority events to Slack through
+`SLACK_MINIMUMPRIORITY`. Lower-priority events remain available in Falco logs.
 The Secret is intentionally not included in the Falco
 Kustomization because ArgoCD must not manage or render the credential from
 Git.