# Blog: Introducing Falco Talon v0.1.0

DevFeed: [Blog: Introducing Falco Talon v0.1.0](<https://devfeed.tech/articles/blog-introducing-falco-talon-v0-1-0-32503.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-talon-v0-1-0/>)

Published: 2024-09-09T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [Kubernetes clusters](<https://devfeed.tech/topics/kubernetes-clusters.md>), [No-code](<https://devfeed.tech/topics/no-code.md>), [function as a service](<https://devfeed.tech/topics/function-as-a-service.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [faas](<https://devfeed.tech/tags/faas.md>), [falco](<https://devfeed.tech/tags/falco.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [kubernetes-clusters](<https://devfeed.tech/tags/kubernetes-clusters.md>), [no-code](<https://devfeed.tech/tags/no-code.md>), [release](<https://devfeed.tech/tags/release.md>), [security](<https://devfeed.tech/tags/security.md>), [talon](<https://devfeed.tech/tags/talon.md>), [version](<https://devfeed.tech/tags/version.md>)

## AI overview

This release introduces Falco Talon v0.1.0, a response engine for managing threats in Kubernetes clusters. It is designed to let users define rules and react to Falco events without building and maintaining custom FaaS-based response systems.

## Source excerpt

More than 7 years ago, frustrated by the lack of integrations between Falco and third parties, I created Falcosidekick. The tool evolved much more than expected, with the help of dozens of contributors, individuals or for companies, to have now almost 70 different integrations, and more are coming. Its baby brother came few years later, Falcosidekick UI, helping people to visualize in real time the alerts leveraged by Falco and fine tuning their rules. A frustation remained after all. With Falco, we have an amazing tool to detect suspicious events in our Linux hosts, VM and Kubernetes clusters, with Falcosidekick, we can easily notify our Dev/Secops, index the alerts in some SIEM, etc. But a last piece was missing: how to react to these events? With the integrations of well known FaaS in Falcosidekick, we started a series of blog posts to show how to create from scratch what we call a "response engine". All these systems are modular, flexible, robust, but they all require a considerable amount of work from the user, to deal with the Falco payload format, the errors, the retries, the authentication to the API (AWS, Kubernetes Control Plane), the logs, the metrics, etc. Not all users and companies have the skills and/or the budget to maintain such an architecture. To answer these needs, we designed and created Falco Talon. The the first version is officially out!. What is Falco Talon? Falco Talon is a Response Engine for managing threats in Kubernetes clusters. It enhances the solutions proposed by the Falco community with a no-code tailor-made solution. With easy rules, you can react to events from Falco in milliseconds. Why did we created Falco Talon? Over the years, the Falco community proposed different methods to react to the Falco Events, what we call a response engine. All these methods rely on a 3rd party FaaS (Function as a Service) and come with drawbacks, all actions must be developped by the users to manage: The errors The Falco event format The authentica