Why are the default rules marked as deprecated?

[chmreid]

What to document

In the default falco rules file here, around line 550 a comment says "These macros will be removed soon. Only keeping them to maintain compatiblity with some widely used rules files." I am confused about why these are being removed, since there are many useful rules in that file. Is the plan to move those rules to a different file that will still be available but not enabled by default? The rules documentation page does not mention anything about deprecation of the default rule set so it would be helpful to add some clarification to that page. Appreciate the help!

[chmreid]

Doing a git blame shows that that comment was added back in 2018 by @mstemm (#326) during a significant rewrite of the rules file.

[chmreid]

Oh, I see - I missed a comment about 100 lines later that says end of deprecated section, so the deprecated comment applies to a few rules, not all the rules: https://github.com/falcosecurity/falco/blob/master/rules/falco_rules.yaml#L635