# Blog: Introducing Falco 0.37.0

DevFeed: [Blog: Introducing Falco 0.37.0](<https://devfeed.tech/articles/blog-introducing-falco-0-37-0-32482.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-0-37-0/>)

Published: 2024-01-30T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Scalability](<https://devfeed.tech/topics/scalability.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [eBPF](<https://devfeed.tech/topics/ebpf.md>), [x86](<https://devfeed.tech/topics/x86.md>), [Environment Variables](<https://devfeed.tech/topics/environment-variables.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>)

Tags: [ebpf](<https://devfeed.tech/tags/ebpf.md>), [environment-variables](<https://devfeed.tech/tags/environment-variables.md>), [falco](<https://devfeed.tech/tags/falco.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [release](<https://devfeed.tech/tags/release.md>), [scalability](<https://devfeed.tech/tags/scalability.md>), [ux-improvements](<https://devfeed.tech/tags/ux-improvements.md>), [version](<https://devfeed.tech/tags/version.md>), [x86](<https://devfeed.tech/tags/x86.md>)

## AI overview

Falco 0.37.0 is released with changes to Kubernetes metadata enrichment, kernel driver downloading and building, syscall emulation on x86_64, rule overrides, engine configuration, and environment-variable expansion. The release also includes breaking changes and UX improvements.

## Source excerpt

Dear Falco Community, today we are happy to announce the release of Falco 0.37.0! This release brings an improved installation experience, a new way to modify Falco rules, and some great UX improvements. There are, as to be expected, a handful of breaking changes. But, rest assured, we've done all we can to help you with any changes you might need to make. During this release cycle, we merged more than 100 PRs on Falco and more than 160 PRs for libs and drivers, version 0.14.2 and version 7.0.0 respectively. Thank you to our maintainers and contributors, as this would not happen without your support and dedication! To learn all about these changes, read on! What's new? TL;DR Key features: A new way to enrich syscalls with Kubernetes metadata, replacing the old Kubernetes collector. New capabilities in falcoctl to download and build our kernel drivers, replacing the old falco-driver-loader script. Support for 32-bit syscall emulation on x86_64 in all kernel drivers (modern_ebpf, ebpf, kernel module). A new override key to easily modify rules, lists, and macros. Key UX improvements: Introduction of a new engine key in falco.yaml to replace all other methods for opening engines such as FALCO_BPF_PROBE, --modern-bpf, -g, and -e. Expansion of environment variables in falco.yaml even when they are part of a string. This release also comes with breaking changes, we'd suggest to read them before upgrading. If you use helm, make sure to read the Helm chart breaking changes page as well. Major features and improvements The 0.37.0 release contains a number of feature and UX improvements, here are list of some of the key new capabilities. A new way to enrich syscalls with K8s metadata Falco 0.37.0 introduces a new method to enrich syscalls with Kubernetes metadata to help address scalability and other issues with the old collector. Falco always had Kubernetes support, but sometimes we need new approaches to keep up with the bigger and bigger scale that we see in production clus