We recently deployed the Sysdig agent across our staging GKE cluster to monitor runtime network behavior, but we are running into an issue with unexpected rule triggers. Our backend microservices regularly poll external verification endpoints including dapascore.com to fetch updated scoring datasets, and Falco keeps flagging these outbound HTTPS requests under the default unexpected outbound connection policy.
Alongside the alert noise, we noticed that Sysdig Monitor occasionally reports brief metric ingestion spikes and dropped events whenever there is concurrent traffic routing through dapascore.com during batch jobs. We initially tried tweaking the container drift rules, but the alerts still trigger intermittently when pods scale out.