Improve rules onboarding docs based on community feedback

[incertum]

Follow up item from falcosecurity/falco#2791 (comment) discussion.

CC @enote-kane

[incertum]

Here is another question falcosecurity/rules#184 -> I think we could improve docs also in this regard.

[incertum]

Plus we haven't updated the docs yet to highlight the new rules matching options, see at the bottom of https://falco.org/docs/rules/style-guide/ CC @loresuso

[incertum]

Potentially also improve docs around enabling and disabling rules, e.g. see falcosecurity/falco#2920 (comment). At the moment it is also unclear if we want to add enabling/disabling capabilities to falco.yaml in addition to having the cmd args as option? @leogr do you have additional thoughts?

[incertum]

Lastly once falcosecurity/falco#1340 lands docs need to updated in this regard as well.

[leogr]

I've noticed this right now. I guess I can help with this, but I must find some cycles.

/assign

cc @LucaGuerra

[incertum]

@leogr and @LucaGuerra falcosecurity/libs#1575 (review)

Almost feel there should be a dedicated page Rules Container & Kubernetes Enrichment https://falco.org/docs/rules/

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[leogr]

@incertum
I had lost track of this. What's missing?

[incertum]

I believe we improved a few things and in particular re-wrote the outputs formatting page https://falco.org/docs/outputs/formatting/.