falco default and k8s-audit rule sets can be patched to allow list certain behaviours.