Reference Library for Coding Agent Falco Threat Detection Rules
Sysdig Secure enables you to create and customize Threat Detection Rules to secure your environment.
This topic provides all the fields that apply to Falco rules for the coding-agent source (Claude, Codex, Gemini, and related tooling activity).
Fields
Field Class: Coding Agent
| Name | Type | Description |
|---|---|---|
coding_agent.name | CHARBUF | Coding agent identifier (e.g., claude_code, codex, gemini): classified at the session-root exec on syscall/file events, or reported by the interceptor on coding_agent-source hook events |
coding_agent.cwd | CHARBUF | Working directory of the coding-agent session |
coding_agent.real_cwd | CHARBUF | Resolved (canonical) working directory of the coding-agent session: on a coding_agent-source hook event the agent-reported cwd with symlinks and . / .. resolved; elsewhere it mirrors coding_agent.cwd |
coding_agent.model | CHARBUF | Model used by the session, read lazily from the session transcript (Claude and Codex) |
coding_agent.session_title | CHARBUF | Session title, read lazily from the session transcript (Claude and Codex) |
coding_agent.account | CHARBUF | Account signed in to the coding-agent session |
coding_agent.org | CHARBUF | Organization associated with the coding-agent session |
coding_agent.session_root_pid | UINT64 | PID of the session-root process (the recognized coding agent the process subtree is rooted at); on a coding_agent-source hook event, the session root the event is attributed to |
ai_platform.name | CHARBUF | Self-hosted AI app/workflow platform this process belongs to (n8n, langflow, flowise, open_webui, anythingllm): classified at the platform root’s exec and inherited by its subtree |
ai_platform.root_pid | UINT64 | PID of the AI platform root the process subtree is rooted at |
ai_platform.instance_id | CHARBUF | Identity of one AI platform launch on this host (name:root_pid:root_start_time). Distinguishes launches that reuse a PID, but is HOST-LOCAL: group on (machineId, ai_platform.instance_id) when counting launches across a fleet |
coding_agent.mcp_servers | LIST(CHARBUF) | MCP servers the session currently has configured, served per session on every event (cross-agent: Claude, Codex, Gemini) |
coding_agent.mcp.added_servers | LIST(CHARBUF) | MCP servers added in a coding-agent config write (cross-agent: Claude, Codex, Gemini) |
coding_agent.mcp.added_command | CHARBUF | Command of an MCP server added in a coding-agent config write (cross-agent: Claude, Codex, Gemini) |
coding_agent.mcp.added_args | LIST(CHARBUF) | Args of an MCP server added in a coding-agent config write (cross-agent: Claude, Codex, Gemini) |
coding_agent.mcp.removed_servers | LIST(CHARBUF) | MCP servers removed in a coding-agent config write (cross-agent: Claude, Codex, Gemini) |
coding_agent.extensions.added | LIST(CHARBUF) | Claude desktop extensions added in an extension-inventory write |
coding_agent.extensions.removed | LIST(CHARBUF) | Claude desktop extensions removed in an extension-inventory write |
coding_agent.connectors.added | LIST(CHARBUF) | Remote MCP connectors newly surfaced in a Cowork session |
coding_agent.connectors.removed | LIST(CHARBUF) | Remote MCP connectors no longer surfaced in a Cowork session |
coding_agent.plugins.added | LIST(CHARBUF) | Plugins installed in an install-record write, as |
coding_agent.plugins.removed | LIST(CHARBUF) | Plugins removed in an install-record write, as |
coding_agent.change.added_hooks | LIST(CHARBUF) | Command hooks added in a coding-agent config write (cross-agent: Claude ~/.claude/settings.json, Codex ~/.codex/hooks.json) |
coding_agent.change.channel | CHARBUF | How a Claude config write was made (intent-ledger attribution; “cli” when CLI-attributed) |
coding_agent.change.command | CHARBUF | Command that wrote the Claude config (intent-ledger attribution) |
coding_agent.change.target | CHARBUF | Which Claude config an attributed change targeted (claude_mcp, claude_hooks, claude_settings, claude_agent) |
coding_agent.allow_permissions_added | LIST(CHARBUF) | Permissions newly allowed in a Claude settings write |
coding_agent.trusted_projects_added | LIST(CHARBUF) | Projects newly granted trust_level=trusted in Codex config.toml |
coding_agent.command | CHARBUF | Name of a custom command/prompt, derived from the file path (Claude command or Codex prompt; no file read) |
coding_agent.skill | CHARBUF | Name of a Claude skill, derived from the file path (no file read) |
coding_agent.plugin | CHARBUF | Name of a Claude plugin, derived from the file path (no file read) |
coding_agent.approval_mode | CHARBUF | Session’s effective permission/approval mode: Claude’s self-reported hook value on a hook event, else the session’s effective mode read from its transcript — Codex’s approval policy (CLI, profile and config merged) or Claude’s permission mode, whichever the session belongs to |
coding_agent.sandbox_mode | CHARBUF | Session’s effective Codex sandbox mode (CLI, profile and config merged) |
ssh.added_keys.fingerprints | LIST(CHARBUF) | Fingerprints of keys added to ~/.ssh/authorized_keys |
ssh.added_keys.types | LIST(CHARBUF) | Types of keys added to ~/.ssh/authorized_keys |
ssh.added_keys.comments | LIST(CHARBUF) | Comments of keys added to ~/.ssh/authorized_keys |
ssh.change.channel | CHARBUF | How an ~/.ssh/authorized_keys write was made (intent-ledger attribution; “cli” when CLI-attributed) |
ssh.change.command | CHARBUF | Command that added the SSH authorized_keys entry (intent-ledger attribution) |
coding_agent.tool.name | CHARBUF | Name of the tool invoked in a coding-agent hook event |
coding_agent.tool.input | CHARBUF | Tool input payload from a coding-agent hook event, with free-text fields redacted |
coding_agent.tool.input_command | CHARBUF | Command extracted from the tool input of a coding-agent hook event |
coding_agent.tool.file_path | CHARBUF | File path targeted by the tool in a coding-agent hook event |
coding_agent.tool.real_file_path | CHARBUF | Resolved (canonical) file path targeted by the tool in a coding-agent hook event |
coding_agent.tool.mcp_server | CHARBUF | MCP server backing the tool invoked in a coding-agent hook event |
coding_agent.tool.mcp_tool | CHARBUF | Tool exposed by the MCP server, without the mcp__ |
coding_agent.tool.invocation_id | CHARBUF | Tool-use identifier from a coding-agent hook event |
coding_agent.hook_event_name | CHARBUF | Name of the coding-agent hook event (e.g., PreToolUse, PostToolUse) |
coding_agent.session_id | CHARBUF | The agent’s own session identifier: reported by a coding_agent-source hook event, or recovered per session (–resume argv, the agent’s per-pid record, or the transcript file name) on syscall/file events — the join key between the two lanes |
