# Blog: Introducing Falco 0.39.0

DevFeed: [Blog: Introducing Falco 0.39.0](<https://devfeed.tech/articles/blog-introducing-falco-0-39-0-32487.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-0-39-0/>)

Published: 2024-10-01T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [version](<https://devfeed.tech/topics/version.md>), [Regular expression](<https://devfeed.tech/topics/regular-expression.md>), [Unix](<https://devfeed.tech/topics/unix.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [User experience (UX)](<https://devfeed.tech/topics/ux.md>), [Library](<https://devfeed.tech/topics/library.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [bug-fixes](<https://devfeed.tech/tags/bug-fixes.md>), [falco](<https://devfeed.tech/tags/falco.md>), [improvements](<https://devfeed.tech/tags/improvements.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [library](<https://devfeed.tech/tags/library.md>), [new-features](<https://devfeed.tech/tags/new-features.md>), [regex](<https://devfeed.tech/tags/regex.md>), [release](<https://devfeed.tech/tags/release.md>), [unix](<https://devfeed.tech/tags/unix.md>), [version](<https://devfeed.tech/tags/version.md>)

## AI overview

Falco 0.39.0 introduces new operators for basename extraction and regular-expression matching, appendable output fields, schema validation for configuration and rules files, improved Kubernetes engine selection, and other performance and UX improvements. The release also includes bug fixes and breaking changes.

## Source excerpt

Dear Falco Community, today we are happy to announce the release of Falco 0.39.0! This version brings several new features, performance improvements, and bug fixes that streamline Falco's detection capabilities. During this release cycle, we merged more than 50 PRs on Falco and more than 100 PRs for libs and drivers, version 0. 18.0 and version 7.3.0 respectively. Thank you to our maintainers and contributors, as this would not happen without your support and dedication! To learn all about these changes, read on! What's new? TL;DR Key features: Basename operator retrieves the basename of a given path; New fields added in proc and fd classes #1916 #1936; Regular expression operator can be used to match values in string fields; Append output allows to add output text or fields to a subset of loaded rules; Schema validation for config and rules files allows Falco to warn users when unknown keys are used; Improved engine selection in Kubernetes environments driver loader will automatically pick the most compatible driver for each node in the cluster. This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.39.0 release contains a number of feature and UX improvements, here are list of some of the key new capabilities. New Operators The basename() transformer operator extracts the base name, i.e. the filename without directory, of the input field. Note that the behavior ofbasename() in Falco is slightly different from the Unix basename program. For instance, basename (proc.exepath) will evaluate to "cat" for /usr/bin/cat but will evaluate to an empty string ("") for /usr/bin/. This allows, for instance, to write expressions like basename(proc.exepath) = cat to match against the original executable name even if it has been symlinked without knowing the full path, or any other file name based detection. The regex operator checks if a string field matches a regular expression. Please note that the rege