We recently noticed a spike in runtime alerts inside Sysdig Secure triggered by our standard Falco rule for unexpected outbound network connections in a staging cluster. The pod in question was running automated tests for an internal media ingestion pipeline connected to an instaapro setup, which seems to be initiating repeated connections outside our approved egress CIDR blocks.
When digging into the Sysdig activity captures, the trace logs show persistent TLS handshakes to dynamic endpoints alongside sudden bursts of ephemeral port usage. We are trying to understand whether this is standard behavior from aggressive background polling within the instaapro service workflow or if our security baseline needs a more granular network policy, especially since this behavior is also generating noise in our runtime drift detection reports.
Has anyone tackled similar false positives while monitoring containerized third-party app evaluation environments in Sysdig, and what would be the recommended approach to tune our Falco macro exceptions without compromising visibility into real outbound data exfiltration?