# Blog: Track the Bitcoin transactions with Falco

DevFeed: [Blog: Track the Bitcoin transactions with Falco](<https://devfeed.tech/articles/blog-track-the-bitcoin-transactions-with-falco-32525.md>)

Original publisher: [Read original article](<https://falco.org/blog/track-the-bitcoin-transactions-with-falco/>)

Published: 2024-03-13T00:00:00Z

Content type: tutorial

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [Bitcoin](<https://devfeed.tech/topics/bitcoin.md>), [WebSocket](<https://devfeed.tech/topics/websocket.md>), [Blockchain](<https://devfeed.tech/topics/blockchain.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>)

Tags: [bitcoin](<https://devfeed.tech/tags/bitcoin.md>), [falco](<https://devfeed.tech/tags/falco.md>), [helm](<https://devfeed.tech/tags/helm.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [plugin](<https://devfeed.tech/tags/plugin.md>), [websocket](<https://devfeed.tech/tags/websocket.md>)

## AI overview

This tutorial presents a Falco plugin that receives Bitcoin transactions from a public WebSocket stream and shows how to install it, configure its default rules, and monitor transaction events in real time.

## Source excerpt

The number of plugins available for Falco continues to grow thanks to our wonderful community. Thank you all for your help! You can find the list of available plugins here. The vast majority of plugins developed allow Falco to ingest logs from different sources and raise alerts when suspicious elements are identified by its rules. In order to show that any event stream can be a source if you have the right plugin, and to have something fun to show users during my talks, I developed a Falco plugin to track Bitcoin transactions. How does it work? I discovered the site https://www.blockchain.com/ exposes a public flux, accessible via a websocket, by subscribing to it you can retrieve transactions carried out on the blockchain in real time. This is perfect for a Falco plugin as it allows you to test the ingestion of events via a websocket, and serve as a basis for other plugins. I am not going to describe the internal workings of the plugin here, nor how it was developed. If you are interested, you can look at the code here. Alternatively, read our documentation explaining how to create a plugin from A to Z: https://falco.org/docs/concepts/plugins/developers-guide/how-to-develop/. Default rules The plugin comes with its default set of rules, we will use them as a working example. You are free to play with it for your own needs, such as monitoring suspicious movements of your wallet. You can find the Falco rules file provided here. Installation of the plugin We will see the 3 classic ways to install the plugin: via sources with falcoctl in kubernetes via Helm Via sources The prerequisites are: Golang >= 1.19 make Falco >= 0.36 Git We will start by installing download the sources, build and install the plugin: git clone https://github.com/Issif/bitcoin-plugin.git cd bitcoin-plugin sudo make install We will create a falco.yaml file containing: plugins: - name: bitcoin library_path: /usr/share/falco/plugins/libbitcoin.so init_config: '' open_params: '' load_plugins: [bitcoi