<group name="linux,docker,falco">
    <rule id="200360" level="3">
        <decoded_as>json</decoded_as>
        <field name="output">\.+</field>
        <field name="priority">\.+</field>
        <field name="rule">\.+</field>
        <field name="source">\.+</field>
        <description>Docker Container Log, Event: $(rule)</description>
        <options>no_full_log</options>
    </rule>
</group>
