# Blog: Falco Talon v0.3.0

DevFeed: [Blog: Falco Talon v0.3.0](<https://devfeed.tech/articles/blog-falco-talon-v0-3-0-32505.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-talon-v0-3-0/>)

Published: 2025-02-11T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [MinIO](<https://devfeed.tech/topics/minio.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [aws-s3](<https://devfeed.tech/tags/aws-s3.md>), [cli](<https://devfeed.tech/tags/cli.md>), [falco](<https://devfeed.tech/tags/falco.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [minio](<https://devfeed.tech/tags/minio.md>), [release](<https://devfeed.tech/tags/release.md>), [talon](<https://devfeed.tech/tags/talon.md>), [version](<https://devfeed.tech/tags/version.md>)

## AI overview

Falco Talon 0.3.0 adds a kubernetes:sysdig action that captures syscalls when suspicious events occur in a pod and exports the resulting artifact to AWS S3 or MinIO. The release also describes configuring capture duration and buffer size, and exploring captures with the sysdig CLI or Stratoshark.

## Source excerpt

Today, we announce the release of Falco Talon 0.3.0 🦅! Three updates in a row, after Falco and Falcosidekick, it's time for Falco Talon to know a new version. What's new? The key feature this release brings is the new actionner kubernetes:sysdig. For those who are not familiar with sysdig, it's a CLI tool that allows to capture and record the syscalls, like tcpdump does for the network packets. Old brother of Falco, they share the same libs and filters. With this new integration, when a suspicious event occurs in a pod, Talon triggers a capture and then exports the created artifact to AWS S3 or Minio. You can configure the duration and the amount of bytes captured for each syscall. Check out the docs to discover more settings. See this example rule: - action: Capture the syscalls actionner: kubernetes:sysdig parameters: buffer_size: 2048 duration: 20 output: target: minio:s3 parameters: bucket: falco-talon prefix: /sysdig/ After the action has been completed, you'll find the capture in Minio: And you can run the CLI tool sysdig to explore it: ❯ sysdig -r 2025-01-23T13-26-41Z_default_cncf-597d69dbd4-h9fcb_sysdig.scap.gz evt.type=execve and evt.dir=">" 18563 14:26:38.376178286 0 bash (616444.616444) > execve filename=/usr/bin/apt 19163 14:26:38.394972623 0 apt (616445.616445) > execve filename=/usr/bin/dpkg 19599 14:26:38.399546432 0 apt (616446.616446) > execve filename=/usr/lib/apt/methods/http 20319 14:26:38.408846350 0 apt (616447.616447) > execve filename=/usr/lib/apt/methods/http 21775 14:26:38.453363037 0 apt (616448.616448) > execve filename=/usr/lib/apt/methods/gpgv 22335 14:26:38.461330752 0 apt (616449.616449) > execve filename=/usr/lib/apt/methods/gpgv 29434 14:26:38.481292691 0 gpgv (616451.616451) > execve filename=/usr/bin/apt-key 29604 14:26:38.486522901 0 apt-key (616453.616453) > execve filename=/usr/bin/apt-config 30183 14:26:38.494442117 0 apt-config (616454.616454) > execve filename=/usr/bin/dpkg 30422 14:26:38.497278722 0 apt-key (616455.616455)