# Falco - Falco Recent content on Falco This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Blog: Introducing Falco 0.44.0 DevFeed: [Blog: Introducing Falco 0.44.0]() Original publisher: [Read original article]() Published: 2026-05-26T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [eBPF](), [Kernel](), [Command-line interface](), [Kubernetes]() Tags: [cli](), [deprecated](), [ebpf](), [falco](), [kernel](), [kubernetes](), [release](), [version]() ### AI overview Falco 0.44.0 removes the legacy eBPF probe, gVisor engine, and gRPC output and server. The release adds rule-language list modifiers, a hard capture-file size limit, stricter schema validation, JSON output for listing commands, faster process-tree lookups, and multi-thread safety fixes. It also includes updated libraries, drivers, plugins, and rules. ### Source excerpt Dear Falco Community, we are happy to announce the release of Falco 0.44.0 today! This release completes the deprecation cycle started in 0.42.0 and 0.43.0: the legacy eBPF probe, the gVisor engine, and the gRPC output (along with the gRPC server) are now fully removed from the entire stack. On top of that, 0.44.0 brings new rule-language capabilities, a long-requested safety knob for the capture feature, JSON output for the --list family of commands, a substantial round of performance work on process tree lookups, and a wave of multi-thread safety fixes that lay the groundwork for the upcoming multi-threaded Falco architecture. During this release cycle, we merged: 60 PRs on Falco, including 14 release note-worthy changes 160 PRs on Falco libs, including 54 release note-worthy changes 16 PRs on Falco drivers, including 3 release note-worthy changes We upgraded libs to version 0.25.2 and drivers to 10.2.0+driver. We also ship falcoctl 0.13.0, the container plugin 0.7.1, and the falco-rules ruleset 5.1.0. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Major features and improvements: Comparison operator list modifiers (oneof/anyof/allof) Hard limit on capture file size Stricter rule schema validation Backslash escaping in -o dotted key paths JSON output for the listing CLI commands Faster process tree lookups Multi-thread safety hardening Drivers: The kernel module pre-builds for this release are still being produced and will be available within a couple of days from the release. In the meantime, falcoctl can build the kernel module locally on the host. Drivers: new syscall, kernel 7.0, and BPF iterators Plugins: Container plugin fix for containerd v2.3.0 Plugin library path traversal hardening Event generator: Event generator: HTTP output and new suite namespace Rules: Updated ruleset (falco-rules 5.1.0) Kubernetes: Kubernetes Oper ## Blog: Introducing Prempti: Falco meets AI coding agents DevFeed: [Blog: Introducing Prempti: Falco meets AI coding agents]() Original publisher: [Read original article]() Author: Rule authoring Published: 2026-05-12T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [AI-assisted coding](), [Claude Code](), [Authorization](), [Command-line interface](), [file]() Tags: [ai-coding-agents](), [claude-code](), [falco](), [file](), [network](), [permissions](), [prempti](), [shell]() ### AI overview Falco introduces Prempti, an experimental user-space service for monitoring and enforcing AI coding-agent tool calls. Prempti intercepts file reads, file writes, and shell commands, evaluates them against Falco rules, and returns allow, ask, or deny verdicts. ### Source excerpt Today's developer workflow is increasingly reliant on AI coding agents. Tools like Claude Code sit in your terminal, read your files, run shell commands, make network requests, and write code, all on your behalf. They are fast, capable, and increasingly trusted with real tasks on real machines. But with that trust comes a question worth taking seriously: what exactly is your coding agent doing on your machine? Today, we're introducing an experimental project that brings Falco to this new frontier: Prempti. Agents are a black box at runtime When a coding agent runs a bash command, writes a file, or reads a configuration, those actions happen inside your user session, with your permissions, in your filesystem, against your credentials. Most developers using these tools have no structured visibility into that activity. You see the agent's chat output, but you don't see what's happening under the hood. Here's a simple scenario: you ask your coding agent to refactor a module. It reads your source files. It makes edits. Then, perhaps prompted by a malicious dependency or an unexpected instruction in a file it just parsed, it attempts to read ~/.ssh/known_hosts or write a file to ~/.aws/. Should it be allowed to? Would you even know if it tried? The demo below captures exactly this situation: To run this asciicast without javascript, use asciinema play https://asciinema.org/a/857572.json with Asciinema The agent tried to both read and write to sections it's not allowed to, and both were blocked. The agent itself received a structured message explaining why, and showed that to the user. This is detection and enforcement working together at the tool-call level. How Prempti works Prempti runs as a lightweight user-space service alongside your coding agent. It does not require root, kernel modules, or containers. When your agent makes a tool call such as a file write, a shell command, or a file read, Prempti intercepts it before it executes, evaluates it against Falco rules, a ## Blog: Introducing Falco Operator 0.2.0 DevFeed: [Blog: Introducing Falco Operator 0.2.0]() Original publisher: [Read original article]() Published: 2026-03-23T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Kubernetes](), [Deployment](), [observability](), [API](), [configuration]() Tags: [api](), [bug-fixes](), [configuration](), [falco](), [falco-operator](), [kubernetes-operator](), [observability](), [release]() ### AI overview Falco Operator 0.2.0 is announced as its first production-ready release. The Kubernetes operator adds a redesigned API, ecosystem component management, artifact and configuration support, enhanced observability, improved reconciliation, and bug fixes. Falco recommends it for deploying and managing Falco on Kubernetes while continuing to support the existing Helm chart. ### Source excerpt Dear Falco Community, today we are excited to announce the release of Falco Operator 0.2.0, the first production-ready release of the Kubernetes operator for Falco! Since the technical preview announced with Falco 0.41.0, we have been working hard to make the operator robust, extensible, and ready for real-world environments. This release brings a redesigned API, a new Component controller for managing the Falco ecosystem, new artifact management capabilities, enhanced observability, and a significantly improved operational model, all grounded in Kubernetes-native patterns. We merged 58 commits since v0.1.1, delivering major new features, 10 bug fixes, and comprehensive architectural improvements. Thank you to all our contributors and the community for your feedback along the way! Going forward, the Falco Operator is the recommended way to deploy and manage Falco on Kubernetes. While the existing Helm chart remains fully supported, we plan to transition to the operator as the standard deployment method. More details on the transition timeline will follow in a future announcement. To learn everything about the changes, read on! What's new? TL;DR Key features: Ecosystem components - deploy Falcosidekick, Falcosidekick UI, and k8s-metacollector as managed components ConfigMap support for rules and configuration, alongside OCI artifacts and inline definitions Structured API types for inline rules and configuration - YAML objects instead of strings Redesigned OCI artifact API with separate image and registry configuration Reference tracking with finalizers to prevent accidental deletion of Secrets and ConfigMaps Enhanced observability with Kubernetes events and status conditions across all controllers Update strategy support for DaemonSet and Deployment modes Server-Side Apply migration for safer, conflict-free reconciliation Key fixes: Plugin initConfig now supports nested configuration objects RBAC compatibility with Kubernetes 1.32+ Spurious update prevention via mana ## Blog: Falco at KubeCon Europe 2026 -- See You in Amsterdam! 🐦 DevFeed: [Blog: Falco at KubeCon Europe 2026 -- See You in Amsterdam! 🐦]() Original publisher: [Read original article]() Published: 2026-03-18T00:00:00Z Content type: news Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security](), [Cloud](), [container](), [AI-assisted coding]() Tags: [2026](), [blog](), [cloud-native](), [community](), [conference](), [container](), [europe](), [falco](), [kubecon](), [kubernetes](), [live-event](), [security]() ### AI overview Falco announces its presence at KubeCon + CloudNativeCon Europe 2026 in Amsterdam, including talks, a workshop, booth activities, and a preview of a developing way to run Falco locally so AI coding agents follow new rules. ### Source excerpt We're excited to share that the Falco community will be at KubeCon + CloudNativeCon Europe 2026 in Amsterdam! Whether you're a long-time contributor, a curious user, or just want to say hi, we'd love to see you there. Falco is celebrating 10 years of development and adoption, and we are on the lookout for people who would like to say Happy Birthday to the project or share their best Falco story. Libby Schulze and I will be on the event floor with mic and camera to capture some amazing moments and memories from Falco's 10 years. So bring your best story, and we'll see you at the Falco booth! Sneak peek Psst... we have something really cool brewing that we will show at the Falco booth. You, our amazing reader, is the first to hear about this. It's a way to run Falco locally on your development machine, and make sure your AI coding agents are following new rules that are being defined. We'd love to get your feedback on this as we're currently building it! Here's where you can find us in Amsterdam and everything we have lined up: Project lightning talk Forensics With Falco Speaker: Gerald Combs, Maintainer When: Monday, March 23, 2026 -- 10:27 to 10:32 CET Where: Elicium 2 Falco has recently expanded its capabilities with capture recording, opening the door to seamless integration with forensic analysis tools like Stratoshark. In this lightning talk, Gerald will walk through how the two tools work together to provide deep visibility into container and system activity. He will demonstrate how captured event data can accelerate investigations and discuss key considerations for safely and efficiently deploying these features in production environments. Sysdig-led workshop Hands-On Cloud Native Security Workshop When: Monday, March 23 -- 2:00-4:00 PM CET Run Atomic Red Teamβ„’ tests, then step into the Blue Team role to detect threats and create custom Falcoβ„’ detection rules in this hands-on 90-minute keyboard workshop. Conference talk In Falco's Nest: The Evolution of Cloud Na ## Falco Invites Community Feedback Through a 2026 Survey DevFeed: [Falco Invites Community Feedback Through a 2026 Survey]() Original publisher: [Read original article]() Published: 2026-02-25T00:00:00Z Content type: opinion Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security]() Tags: [2026](), [community](), [falco](), [runtime-security](), [survey]() ### AI overview Falco invites its community to complete a short survey about community connection, priorities, resources, tool integrations, and how people use Falco. The organization says it will share a report of the responses alongside KubeCon Europe 2026. ### Source excerpt New year, new opportunities! As we spread our wings and glide into 2026, we want to make sure this community is one you're proud (and excited!) to be a part of. Falco has always been more than just a project: it's a flock of builders, defenders, contributors, question-askers, doc-writers, rule-tuners, and runtime security enthusiasts. And now we want to hear from you. We've put together a quick community survey (5 minutes or less!) to better understand: How connected you feel to the community What you love about being a part of it What could be better What you'd like to see us focus on this year What resources would make your life easier How you're using Falco and what tools you integrate it with Your feedback directly shapes our focus on what we build, improve, prioritize, and invest in this year - from documentation and content to events, integrations, and contributor experience. A report detailing the responses will be shared at the same time as KubeCon Europe 2026. Whether you're building, using, learning, or just keeping an eye on things, your voice matters. πŸ‘‰ Take the survey here Thanks for being part of the flock. We couldn't do this without you and we're excited to build 2026 together! ## Blog: Introducing Falco 0.43.0 DevFeed: [Blog: Introducing Falco 0.43.0]() Original publisher: [Read original article]() Published: 2026-01-26T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [eBPF](), [Kernel](), [Maintainability]() Tags: [ebpf](), [falco](), [improvements](), [kernel](), [legacy](), [maintainability](), [race-condition](), [release](), [version]() ### AI overview Falco 0.43.0 is a stabilization release that consolidates changes from 0.42.0, adds deprecations, and fixes issues across Falcoctl, plugins, and libraries. It includes updates to Falco libraries and drivers, signature verification fixes, plugin fixes, and the reintroduction of the evt.arg.filename field. The release deprecates the legacy eBPF probe and gVisor engine while directing users toward modern alternatives. ### Source excerpt Dear Falco Community, we are happy to announce the release of Falco 0.43.0 today! This is a stabilization release that consolidates the changes introduced in 0.42.0, including the drop-enter initiative and the capture recording feature. It also introduces several deprecations to improve maintainability and fixes minor issues across falcoctl, plugins, and libs. During this release cycle, we merged: 31 PRs on Falco, including 11 release note-worthy changes 48 PRs on Falco libs, including 17 release note-worthy changes 8 PRs on Falco drivers, including 3 release note-worthy changes We upgraded libs to version 0.23.1 and drivers to 9.1.0+driver. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Deprecations GPG key rotation Container plugin improvements Falcoctl tweaks and improvements Key fixes: evt.arg.filename field reintroduction Falcoctl signature verification fixes overflow and NULL pointer dereferences fixes for the container plugin, shipped with plugins/container/0.6.1 race condition fix for the k8smeta plugin, shipped with plugins/k8smeta/0.4.1 This release also comes with breaking changes that you should be aware of before upgrading. Latest updates Deprecations In Falco 0.43.0, we are announcing the deprecation of three significant components to streamline the project, reduce maintenance burden, and focus on modern, more efficient alternatives. All these components are stable, and considering that the deprecation is first enforced in this version, they could be removed at any future version starting from 0.44.0. Legacy eBPF probe deprecation The "legacy" eBPF probe (configured via engine.kind=ebpf) was the original eBPF implementation in Falco. It required compiling a specific probe for each kernel version, often necessitating the dynamic usage of the falco-driver-loader or pre-built drivers. The Modern eBPF probe (engine.kind=m ## Blog: GPG Key Rotation for Falco Packages (2026) DevFeed: [Blog: GPG Key Rotation for Falco Packages (2026)]() Original publisher: [Read original article]() Published: 2025-12-12T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security](), [Package manager](), [releases](), [apt]() Tags: [announcements](), [apt](), [falco](), [import](), [installation](), [releases](), [rotation](), [rsa](), [security]() ### AI overview Falco maintainers are rotating the 4096-bit RSA GPG key used to sign official RPM and DEB packages because the existing key expires on January 17, 2026. The transition uses a soft launch followed by a hard cut-over, and existing users should update their keyrings before January 12, 2026. ### Source excerpt The GPG key used to sign official Falco packages (RPM and DEB) is set to expire on January 17, 2026. To ensure the security and continuity of our software distribution, the Falco maintainers will be rotating to a new 4096-bit RSA key. We have designed a two-phase "Soft Launch" strategy to make this transition as smooth as possible, providing a one-month transition window before the old key is retired. The Rotation Plan To avoid immediate disruption, we are rolling out the new key in two distinct phases. You can follow the detailed progress in our tracking issue #3750. Phase 1: Soft Launch (Dec 12, 2025) What happens: The new GPG key has been published and added to our repository configuration. Dev Builds: Will begin using the New Key immediately. Stable Builds: No stable releases are planned for this phase. If any hotfixes are released, they will be signed with New Key as well. Key Bundle: The official key URL has been updated to serve a bundle containing both the Old (valid) and New (valid) keys. Phase 2: Hard Cut-Over (Jan 12-17, 2026) What happens: This is the maintenance window where we fully switch to the new key. Mass Resign: All existing stable packages on download.falco.org will be resigned with the New Key. Revocation: The Old Key will be officially revoked and removed from the active bundle. Impact: If you have not updated your keyring by this date, your package manager (apt or yum) will reject updates with a signature verification error. Action Items for Users We strongly recommend all users update their GPG keyring before January 12, 2026 to avoid interruption. New Users If you are installing Falco for the first time following our Install on a host (DEB,RPM) instructions, no action is required. The installation process will guide you to fetch the new key bundle, ensuring you are ready for both phases. Existing Users If you have an existing Falco installation, you must manually import the new key. We have updated the key file at our standard URL to includ ## Blog: Introducing Falco 0.42.0 DevFeed: [Blog: Introducing Falco 0.42.0]() Original publisher: [Read original article]() Published: 2025-10-22T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [container](), [Processes](), [static linking]() Tags: [bug](), [bug-fixes](), [dry-run](), [falco](), [features](), [memory-leak](), [performance](), [recording](), [release](), [static-linking]() ### AI overview Falco 0.42.0 introduces a capture recording feature that generates .scap files when detection rules trigger, including system-call traces for forensic analysis. The release also includes performance improvements, schema validation, configuration changes, and bug fixes. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.42.0! This release brings exciting new capabilities, including the capture feature, significant performance improvements, and important bug fixes that enhance Falco's capabilities. During this release cycle, we merged: 52 PRs on Falco, including 23 release note-worthy changes 110 PRs on Falco libs, including 47 release note-worthy changes 102 PRs on Falco drivers, including 29 release note-worthy changes We upgraded libs to version 0.22.1 and drivers to v9.0.0+driver. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Key features: Capture recording feature; Drop enter initiative for performance; Plugin event schema validation; Thread table auto-purging configuration; Static fields; Key fixes: Fix thread table memory leak when parsing vfork (or equivalent clone/clone3 with CLONE_VFORK) exit from the caller process; Enable handling of multiple actions configured with syscall_event_drops.actions; Disable dry-run restarts when Falco runs with config-watching disabled; Fix abseil-cpp for Alpine build; Fix detection sandbox containers for CRI and containerd runtimes (container plugin); Stability improvements for container plugin and static linking of libgcc/libstdc++ for legacy compatibility; This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.42.0 release contains a new capture feature and significant performance improvements. Here is a list of the key new capabilities. Capture recording feature Falco 0.42.0 introduces the new capture recording feature, now available at sandbox maturity. This capability allows Falco to generate .scap files whenever a detection rule is triggered automatically. Each capture contains a detailed trace of system calls around the event, providing forensic-level ## Blog: Introducing Falco 0.41.0 DevFeed: [Blog: Introducing Falco 0.41.0]() Original publisher: [Read original article]() Published: 2025-05-29T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [eBPF](), [Kubernetes](), [configuration](), [container](), [JSON](), [Prometheus](), [bug](), [Code Modularity]() Tags: [bug-fixes](), [capabilities](), [changes](), [code-modularity](), [configuration](), [container](), [ebpf](), [falco](), [json](), [kubernetes](), [prometheus](), [release](), [ux]() ### AI overview Falco 0.41.0 introduces revised container engine support, an early Kubernetes operator, configurable merge strategies, expanded eBPF driver behavior, new field access options, and JSON output controls. The release also includes fixes for kernel-module crashes, Prometheus metrics, RPM scripts, and configuration overrides. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.41.0! This version brings several new features, performance enhancements, and bug fixes that streamline Falco's detection capabilities. During this release cycle, we merged more than 50 PRs on Falco and around 130 PRs for libs and drivers, version 0.21.0 and version 8.1.0, respectively. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Key features: Reimplemented container engines support from scratch; A Kubernetes operator is taking shape; Falco's config_files configuration gained support to specify the merge strategy; Modern eBPF driver is now capable of trying to load multiple programs for each event; consequently, sendmmsg and recvmmsg will now make use of bpf_loop eBPF helper where available, boosting their performances; New proc.aargs field available, ie: a lookup for an ancestor args field; proc.args gained support for indexed access, to only check a certain argument; json_include_output_fields configuration key for Falco to control whether output fields are included in the JSON message; Ongoing work to improve libs code modularity; Key fixes: Avoid kmod crashing when a CPU gets enabled at runtime; Fixed Falco Prometheus metrics with multiple event sources enabled; Fixed RPM packages evaluation of RPM scripts; -o options do now correctly override included config_files; This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.41.0 release contains a number of features and UX improvements. Here is a list of some of the key new capabilities. Reimplemented container engines support In the Falco 0.41.0 release, the Falco team has completely revised its support for container engines. Key improvements include: Container support is now a plugin; The plugin will attach a listener to the eng ## Blog: Detecting Supply Chain Attacks with Falco Actions DevFeed: [Blog: Detecting Supply Chain Attacks with Falco Actions]() Original publisher: [Read original article]() Published: 2025-03-19T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [supply chain attacks](), [GitHub Actions](), [Security](), [GitHub](), [Containers](), [Kubernetes](), [Linux Kernel]() Tags: [cicd](), [falco](), [github-action](), [github-actions](), [kubernetes](), [linux](), [linux-kernel](), [pull-request](), [runtime-security](), [security](), [software-supply-chain](), [supply-chain-attacks](), [supplychain]() ### AI overview This tutorial explains how to use Falco Actions in GitHub Actions workflows to detect suspicious behavior and software supply chain attacks in CI/CD pipelines. It covers runtime monitoring, custom rules, workflow setup, findings, and generated reports. ### Source excerpt The recently discovered CVE for the GitHub action tj-actions/changed-files brought to light a topic that is really critical for companies: supply chain attacks. With that, we want to discuss and show a bit about how Falco can help your organization detect this kind of attack and other suspect behaviors inside your CI/CD pipeline. What is Falco? Falco is a cloud native security tool that provides runtime security across hosts, containers, Kubernetes, and cloud environments. It leverages custom rules on Linux kernel events and other data sources through plugins, enriching event data with contextual metadata to deliver real-time alerts. Falco enables the detection of abnormal behavior, potential security threats, and compliance violations. What is Falco Actions? Falco Actions enable you to run Falco in GitHub Actions to detect suspicious behavior in your CI/CD workflows. If you run it in a pull request, the action will create a comment with the findings. Thanks to ad-hoc Falco rules specific to this use case, these GitHub actions can monitor your GitHub runner and detect software supply chain attacks. Using Falco Actions To have Falco inside your pipeline, you need to add these two actions: falcosecurity/falco-actions/start falcosecurity/falco-actions/stop Below you can see an example: name: CI on: push: pull_request: jobs: build: runs-on: ubuntu-latest permissions: contents: read actions: read steps: - uses: actions/checkout@v4 - name: Start Falco uses: falcosecurity/falco-actions/start@main with: mode: live falco-version: '0.40.0' verbose: true - name: My Custom Step run: | echo "This is my custom step" - name: Stop Falco uses: falcosecurity/falco-actions/start@main with: mode: live verbose: true OBS: main is being used here only to simplify how it works, you should always pin your dependencies to a specific commit SHA. After the execution, you will be able to see the results at the github action summary. If you want a more detailed report, you can use the action fal ## Blog: Detecting Threats in OVHcloud MKS Audit Logs with Falco DevFeed: [Blog: Detecting Threats in OVHcloud MKS Audit Logs with Falco]() Original publisher: [Read original article]() Published: 2025-03-13T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Kubernetes](), [Security](), [threat detection](), [Kubernetes clusters](), [kubectl](), [Cloud](), [Open Source](), [api server](), [container](), [Amazon EKS](), [Amazon Elastic Kubernetes Service]() Tags: [api](), [audit](), [auditlogs](), [container](), [falco](), [kubectl](), [kubernetes](), [linux](), [logs](), [mks](), [ovhcloud](), [plugin](), [security](), [threat-detection]() ### AI overview This article explains how Falco uses the OVHcloud MKS Audit Logs plugin to detect anomalies, suspicious activity, and policy violations in Kubernetes clusters. It describes Falco's event processing and outlines the required setup involving OVHcloud Logs Data Platform, a data stream, and an MKS cluster. ### Source excerpt Detecting threats in a Kubernetes cluster can be challenging, we generally don't know where and how to start. The good news is that we have an amount of valuable logs that can help us to know what is happened in the cluster. Indeed, each action requested or done by a user or an app, in a cluster, is recorded in Audit Logs. Kubernetes events are key to understanding the behavior of a cluster. We already provide plugins that let you parse Audit Logs and use Falco to detect threats from GKE, EKS and AKS clusters. With our latest plugin, you'll now have the same powerful threat detection capabilities for your OVHcloud MKS clusters πŸŽ‰. What is Falco? Falco is an Open Source cloud-native runtime security tool. It provides near real-time threat detection for cloud, container, and Kubernetes workloads by leveraging runtime insights. Falco can monitor events from various sources, including the Linux kernel, and enrich them with metadata from the Kubernetes API server, container runtime, and more. Falco can receive Events, compare them to a set of Rules to determine the actions to perform and generate Alerts to different endpoints. What is the OVH MKS Audit Logs plugin? The OVH audit logs plugin (k8saudit-ovh) extends Falco's capabilities to OVHcloud Managed Kubernetes Service (MKS) clusters, providing you with the same security insights and threat detection Falco already offers for GKE, EKS and AKS environments. With this plugin, you can seamlessly integrate MKS Audit Logs into Falco's event processing pipeline, enabling it to identify anomalies, suspicious activities, and policy violations within your MKS-based workloads. Concretely, when a user executes some kubectl commands in an OVHcloud MKS cluster, Audit Logs will be generated. Falco is listening to them, and depending on the configured rules to follow, it will generate some alerts. Using OVH MKS Audit Logs plugin In order to use the OVH MKS Audit Logs plugin, you must follow several steps: deploy an OVHcloud LDP (Logs ## Blog: Falco plugin for collecting AKS audit logs DevFeed: [Blog: Falco plugin for collecting AKS audit logs]() Original publisher: [Read original article]() Published: 2025-03-09T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Azure Kubernetes Service](), [Falco](), [Kubernetes](), [Security](), [threat detection](), [api server](), [Containers](), [Cloud Native Ecosystem](), [Kernel]() Tags: [aks](), [audit](), [auditlogs](), [azure](), [azure-kubernetes-service](), [falco](), [kubernetes](), [logs](), [plugin](), [security](), [threat-detection]() ### AI overview The article introduces a Falco plugin for collecting Azure Kubernetes Service (AKS) audit logs. It explains how Falco uses runtime and Kubernetes data for threat detection and outlines the required Event Hub configuration and storage setup for using the plugin. ### Source excerpt Troubleshooting Kubernetes events is challenging due to the multitude of data sources involved: container logs, Kubernetes events, cloud logs, and more. Among these sources, Kubernetes audit logs are especially valuable for identifying threats, as every action passing through the Kubernetes API server is recorded there. We already provide plugins that let you parse and use Falco to detect threats in audit logs from GKE and EKS clusters. With our latest plugin, you'll now have the same powerful threat detection capabilities for your Azure AKS clusters. What is Falco? Falco is a Cloud Native Computing Foundation project that provides runtime threat detection. Out of the box, Falco examines syscalls to alert you to any suspicious activity. And, since containers share the same kernel as their host, Falco can monitor not only activity on the host but also activity on all of the containers running on that host. Moreover, Falco pulls data from both Kubernetes and the container runtime to add additional context to its alerts. With Falco running on your GKE clusters you can be notified of a wide variety of events, such as: Did someone start a container with high privileges? Has someone shelled into a running container? Has an executable been added to the container after it was deployed? These are just a few examples. Falco has over 80 rules that can be used to make you aware of not only external threats but also when clusters aren't being operated in accordance with industry best practices. What is the AKS audit logs plugin? The AKS audit logs plugin extends Falco's capabilities to Microsoft Azure Kubernetes Service (AKS) clusters, providing you with the same security insights and threat detection Falco already offers for GKE and EKS environments. With this plugin, you can seamlessly integrate AKS audit logs into Falco's event processing pipeline, enabling it to identify anomalies, suspicious activities, and policy violations within your AKS-based workloads. Using AKS audit ## Blog: Falco Talon v0.3.0 DevFeed: [Blog: Falco Talon v0.3.0]() Original publisher: [Read original article]() Published: 2025-02-11T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Amazon S3](), [MinIO](), [Command-line interface](), [Kubernetes]() Tags: [aws](), [aws-s3](), [cli](), [falco](), [kubernetes](), [minio](), [release](), [talon](), [version]() ### AI overview Falco Talon 0.3.0 adds a kubernetes:sysdig action that captures syscalls when suspicious events occur in a pod and exports the resulting artifact to AWS S3 or MinIO. The release also describes configuring capture duration and buffer size, and exploring captures with the sysdig CLI or Stratoshark. ### Source excerpt Today, we announce the release of Falco Talon 0.3.0 πŸ¦…! Three updates in a row, after Falco and Falcosidekick, it's time for Falco Talon to know a new version. What's new? The key feature this release brings is the new actionner kubernetes:sysdig. For those who are not familiar with sysdig, it's a CLI tool that allows to capture and record the syscalls, like tcpdump does for the network packets. Old brother of Falco, they share the same libs and filters. With this new integration, when a suspicious event occurs in a pod, Talon triggers a capture and then exports the created artifact to AWS S3 or Minio. You can configure the duration and the amount of bytes captured for each syscall. Check out the docs to discover more settings. See this example rule: - action: Capture the syscalls actionner: kubernetes:sysdig parameters: buffer_size: 2048 duration: 20 output: target: minio:s3 parameters: bucket: falco-talon prefix: /sysdig/ After the action has been completed, you'll find the capture in Minio: And you can run the CLI tool sysdig to explore it: ❯ sysdig -r 2025-01-23T13-26-41Z_default_cncf-597d69dbd4-h9fcb_sysdig.scap.gz evt.type=execve and evt.dir=">" 18563 14:26:38.376178286 0 bash (616444.616444) > execve filename=/usr/bin/apt 19163 14:26:38.394972623 0 apt (616445.616445) > execve filename=/usr/bin/dpkg 19599 14:26:38.399546432 0 apt (616446.616446) > execve filename=/usr/lib/apt/methods/http 20319 14:26:38.408846350 0 apt (616447.616447) > execve filename=/usr/lib/apt/methods/http 21775 14:26:38.453363037 0 apt (616448.616448) > execve filename=/usr/lib/apt/methods/gpgv 22335 14:26:38.461330752 0 apt (616449.616449) > execve filename=/usr/lib/apt/methods/gpgv 29434 14:26:38.481292691 0 gpgv (616451.616451) > execve filename=/usr/bin/apt-key 29604 14:26:38.486522901 0 apt-key (616453.616453) > execve filename=/usr/bin/apt-config 30183 14:26:38.494442117 0 apt-config (616454.616454) > execve filename=/usr/bin/dpkg 30422 14:26:38.497278722 0 apt-key (616455.616455) ## Blog: Falcosidekick 2.31.0 DevFeed: [Blog: Falcosidekick 2.31.0]() Original publisher: [Read original article]() Published: 2025-02-04T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [OpenTelemetry](), [Helm charts](), [Prometheus]() Tags: [changelog](), [charts](), [falco](), [falcosidekick](), [helm-charts](), [observability](), [opentelemetry](), [prometheus](), [release](), [updated](), [upgrade](), [version]() ### AI overview Falcosidekick 2.31.0 adds OTLP metrics forwarding to OpenTelemetry collectors, improves logging and Loki output options, allows NATS/STAN subject customization, and fixes issues involving labels, ClusterPolicyReport creation, HTTP headers, and Prometheus custom fields. Updated Helm charts are also available. ### Source excerpt The year 2025 is well started now. We saw a few days ago the first release of Falco for the year. It's to let fly out a new version of Falcosidekick, the 2.31.0. New output This release comes with a new output only, the last pillar of the observability with [OpenTelemetry].(https://opentelemetry.io/) that missing in Falcosidekick. OTLP Metrics You can now forward the Falco Events to the OpenTelemetery collector or any received understanding the protocol. New features Here's a non exhaustive list of the great features and enhancements which come with this new release: Better logger It was a ToDo for a while (even years), but it's now completed. The log system used by Falcosidekick has been replaced, without any breaking change for the users, but opening the door to more enhancements in the future. More default labels for Loki The log lines forwarded to Loki contain now by default the source namespace and pod name, if present in the alert. It will allow to filter more easily the events you want to display in your dashboards. Thanks to @afreyermuth98. Payload format for Loki Some users asked for the possibility to forward the Falco alerts in their JSON format to Loki. You can now use the setting loki.format for. NATS/STAN subject The template for the subject where to push the messages for NATS/STAN was hardcoded, it can now be overridden with nats/stan.subjecttemplate. See the example config file. Fixes Fix the missing templated fields as labels in Loki payload (PR#1091) Fix the creation error of a ClusterPolicyReport (PR#1100) Fix the missing custom headers for HTTP requests for Loki (PR#1107 thanks to @lsroe) Fix the wrong key format of custom fields for Prometheus (PR#1110 thanks to @rubensf) Conclusion You can find the full changelog here. The respective Helm charts are already updated and allow you to test by yourself all these great new features. Just issue the helm repo update; helm upgrade --reuse-values -n falco command to do so. Once again, thanks to all the ## Blog: Introducing Falco 0.40.0 DevFeed: [Blog: Introducing Falco 0.40.0]() Original publisher: [Read original article]() Published: 2025-01-28T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Docker](), [Processes](), [Usability](), [Security]() Tags: [bug-fixes](), [docker](), [docker-images](), [falco](), [improvements](), [new-features](), [performance](), [process](), [release](), [version](), [x86-64]() ### AI overview Falco 0.40.0 introduces streamlined Docker images, a reintroduced static x86_64 build using musl, process metadata filters, support for sendmmsg and recvmmsg syscall parameters, and plugin-suggested output fields. The release also includes performance, usability, and bug-fix improvements, along with breaking changes for upgraders. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.40.0! This version brings several new features, performance improvements, and bug fixes that streamline Falco's detection capabilities. During this release cycle, we merged more than 52 PRs on Falco and more than 150 PRs for libs and drivers, version 0.20.0 and version 8.0.0 respectively. Thank you to our maintainers and contributors, as this would not happen without your support and dedication! To learn all about these changes, read on! What's new? TL;DR Key features: Streamlined Falco docker images; Falco static build has been reintroduced for x86_64 binary using musl; New process filters allow to filter events based on process metadata; Added support for sendmmsg and recvmmsg syscalls parameters; Plugins suggested output fields are now available in the Falco engine; This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.40.0 release contains a number of features and UX improvements. Here is a list of some of the key new capabilities. Streamlined Falco docker images In the Falco 0.40.0 release, the Falco team has streamlined the Docker images to improve usability and performance. The new images are designed to be more efficient and easier to use, providing a better experience for users deploying Falco in containerized environments. Key improvements include: Reduced Image Size: The new images are smaller, which reduces the time required to pull and deploy them. Optimized Layers: The layers in the Docker images have been optimized to improve build times and caching efficiency. Enhanced Security: The images have been hardened to enhance security, reducing potential vulnerabilities. These changes make it easier to deploy and manage Falco in various environments. Introducing new process filters A new set of process filters are made available in this release: proc.pgid, proc.pgid.name, proc.pgid.exe, proc.pgid.exepath, pr ## Blog: Falcosidekick 2.30.0 DevFeed: [Blog: Falcosidekick 2.30.0]() Original publisher: [Read original article]() Published: 2024-12-04T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Cloud Native Ecosystem](), [elasticsearch](), [Prometheus]() Tags: [api](), [batching](), [cloud-native](), [compression](), [elasticsearch](), [falco](), [falcosidekick](), [http](), [prometheus](), [release]() ### AI overview Falcosidekick 2.30.0 adds Webex, OTLP Metrics, and Datadog Logs integrations. The release also improves throughput and Elasticsearch integration, updates Prometheus metric naming, supports multiple AlertManager hosts, and fixes several bugs. ### Source excerpt A few days after a new release of Falco Talon, our response engine, it's time for our favorite proxy forwarder to do the same. New outputs A new release means new integrations. Thanks to our contributors for their helps. Webex Notify your team on Webex with the integration developed by @k0rventen. OTLP Metrics The adoption of Open Telemetry is bigger and bigger in the Cloud Native ecosystem, @ekoops introduced the OTLP Metrics in Falcosidekick. Datalog Logs The Falco alerts can be forwarded to Datadog as events for a while in Falcosidekick, you can now use their Logs service thanks to @yohboy. New features Here's a non exhaustive list of the great features and enhancements which come with this new release: x3 throughput @alekmaus spotted a bottleneck with the http client used to forward the events to the outputs. His fix increases up to 300% the throughput!!! Better integration with Elasticsearch @alekmaus worked hard to improve the integration with Elasticsearch. In addition improvments for the clients, new settings have been introduced, like the possibility to specify an ingest pipeline or an api key, to enable batching and compression. See the docs to know them all. Better consistency for the Prometheus metrics Falco recently integrated a direct endpoint to expose metrics in the Prometheus format. After a lot of discussions between the maintainers and the community, a convention has been chosen for the names of the metrics. This release adapts the metrics exposed by Falcosidekick to follow this convention and have a consistency accross the different components of the ecosystem. Breaking changes: The renaming of the metrics might impact the queries for your alerts and dashboards. Multi hosts for AlertManager You can now specify a list of servers for the AlertManager output, which is a requirement when it's deployed in HA mode. Fixes The contributors fixed several bugs, here's a non exhaustive list of the more important ones: Fix PolicyReports created in the same n ## Blog: Falco Talon v0.2.0 DevFeed: [Blog: Falco Talon v0.2.0]() Original publisher: [Read original article]() Published: 2024-11-27T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Google Cloud Platform (GCP)](), [Kubernetes](), [Cloud]() Tags: [announce](), [authentication](), [authorization](), [blog](), [falco](), [gcp](), [google-cloud](), [helm](), [kubernetes](), [release](), [talon]() ### AI overview Falco Talon 0.2.0 is a minor release adding GCP function actions, Google Cloud Storage output, new Kubernetes action parameters, a smaller tcpdump action image, and a fix that removes the requirement for an existing config.yaml file when checking rule syntax. ### Source excerpt Today we announce the release of Falco Talon 0.2.0 πŸ¦…! Falco Talon 0.2.0 is a minor release that includes new actionners and outputs, add parameters to existing actionners, along one small fix on the check and print commands. Features Add gcp:function actionner: Now users can call GCP function to automate GCP tasks, with authentication and authorization out of the box. - action: Invoke GCP function actionner: gcp:function additional_contexts: - aws parameters: gcp_function_name: simple-http-function gcp_function_location: us-central1 Add gcp:gcs output Now users can send output directly to GCP Google Cloud Storage, same way as s3 and minio existing outputs. Add ignore_standalone_pods parameter for kubernetes:terminate actionner Allow to wait until the completion of kubernetes:drain by configuring max_wait_period and wait_period_excluded_namespaces Use smaller image for the kubernetes:tcpdump actionner Fixes An existing config.yaml file is not required anymore to check the syntax of your rules files. Try it! 🏎 In case you just want to try out the Falco Talon 0.2.0, you can install the helm chart following the instructions on the documentation Let's meet 🀝 We meet every Wednesday in our community calls, if you want to know the latest and the greatest, you should join us there! If you have any questions Join the #falco channel on the Kubernetes Slack Join the Falco mailing list Thanks to all the amazing contributors! Enjoy 😎, Igor ## Blog: Introducing Falco 0.39.2 DevFeed: [Blog: Introducing Falco 0.39.2]() Original publisher: [Read original article]() Published: 2024-11-21T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [eBPF](), [Kernel](), [Gke](), [Docker](), [Process]() Tags: [aws](), [container-images](), [docker](), [ebpf](), [falco](), [gke](), [kernel](), [release]() ### AI overview Falco 0.39.2 is a small patch release that fixes modern eBPF driver issues, including compatibility with GKE and kernel versions 6.11.4 and later. ### Source excerpt Today we announce the release of Falco 0.39.2 πŸ¦…! Fixes Falco's 0.39.2 is a small patch release that includes some important bugfixes for modern eBPF driver: check cred field is not NULL before the access; this enables Falco back with modern eBPF driver to work on GKE address verifier issues on kernel versions >=6.11.4: there was a kernel-breaking change in the tail call ebpf API merged into the 6.11.4 to fix a CVE. Adapt our code to work again on these new versions. Thanks to everyone in the community for helping us spot these annoying bugs and improving Falco every day πŸ›! You make Falco successful πŸ¦…! Thanks as always to the Falco maintainers for their support and effort during the entire release process. Try it! 🏎 As usual, in case you just want to try out the stable Falco 0.39.2, you can install its packages following the process outlined in the docs: CentOS/Amazon Linux Debian/Ubuntu openSUSE Linux binary package Prefer to use a container image? No problem at all! 🐳 You can read more about running Falco with Docker in the docs. You can also find the Falcosecurity container images on the public AWS ECR gallery: falco falco-no-driver falco-driver-loader Let's meet 🀝 We meet every Wednesday in our community calls, if you want to know the latest and the greatest, you should join us there! If you have any questions Join the #falco channel on the Kubernetes Slack Join the Falco mailing list Thanks to all the amazing contributors! Enjoy 😎, Federico ## Blog: How to Deploy Falco with k8s-metacollector + k8smeta Plugin DevFeed: [Blog: How to Deploy Falco with k8s-metacollector + k8smeta Plugin]() Original publisher: [Read original article]() Published: 2024-10-14T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Kubernetes](), [container-security](), [Security](), [Deployment](), [Kubernetes clusters](), [monitor]() Tags: [clusters](), [container-security](), [deployment](), [enrichment](), [falco](), [helm](), [k8s-metacollector](), [k8smeta](), [kubernetes](), [monitor](), [plugin](), [security](), [tutorial]() ### AI overview This tutorial explains how to deploy Falco with the k8s-metacollector and k8smeta plugin on Kubernetes. It shows how these components add Kubernetes metadata such as pod names, namespaces, and deployment details to Falco security alerts, and how Falco's append_output feature can add extra metadata fields without modifying rules. ### Source excerpt In today's cloud-native world, securing Kubernetes environments has become increasingly critical as containerized workloads gain complexity. Falco is designed to monitor and detect anomalous activities in Kubernetes clusters and container environments. By continuously observing system calls and enriching event data with metadata, Falco ensures that any suspicious behavior is detected in real-time, protecting against threats like privilege escalations, file tampering, and network anomalies. In this tutorial, we will guide you through deploying Falco with two powerful components: k8s-metacollector and the k8smeta plugin. These tools significantly enhance Falco's security event detection by adding important Kubernetes context, such as pod names, namespaces, deployment details, to the alerts. Additionally, we will explore how to leverage the new append_output feature introduced in Falco version 0.39.0. This feature allows you to append extra metadata fields to Falco's output, without the need to modify your rules. By the end of this guide, you will have a Falco setup capable of detecting security issues in Kubernetes with enriched metadata output, ensuring you get a complete picture of your cluster's security posture. Whether you're an experienced Kubernetes administrator or just starting to explore container security, this guide will help you make the most of Falco's capabilities in a Kubernetes environment. What You'll Learn: The purpose and benefits of using the k8s-metacollector and k8smeta plugin to enrich Falco alerts with Kubernetes-specific data. How to deploy Falco with the k8smeta plugin on a Kubernetes cluster. How to configure and use the append_output feature to enhance Falco alerts with additional metadata fields. Prerequisites: A working Kubernetes cluster and some familiarity with Kubernetes concepts. Basic knowledge of Falco and how it works. Helm installed on your system (for easy deployment of Falco). Let's dive in and set up a Falco deployment that w ## Blog: Introducing Falco 0.39.1 DevFeed: [Blog: Introducing Falco 0.39.1]() Original publisher: [Read original article]() Published: 2024-10-09T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [bug](), [Parsing](), [JSON Schema](), [Docker](), [Amazon Web Services]() Tags: [aws](), [bug](), [docker](), [falco](), [json-schema](), [parsing](), [release]() ### AI overview Falco 0.39.1 is a small patch release that fixes a plugin event-parsing crash, a command-line parsing bug involving commas in object definitions, and a JSON Schema issue allowing null plugin init_config values. ### Source excerpt Today we announce the release of Falco 0.39.1 πŸ¦…! Fixes Falco's 0.39.1 is a small patch release that includes some important bugfixes: Fixed a crash when using plugin with event parsing capabilities (eg: k8smeta plugin) Fixed a bug while parsing -o key={object} command line arguments, when the object definition contains a comma Improved config json schema to allow null init_config for plugin info Thanks to everyone in the community for helping us with spotting these annoying bugs and improving Falco every day πŸ›! You make Falco successful πŸ¦…! Thanks as always to the Falco maintainers for their support and effort during the entire release process. Try it! 🏎 As usual, in case you just want to try out the stable Falco 0.39.1, you can install its packages following the process outlined in the docs: CentOS/Amazon Linux Debian/Ubuntu openSUSE Linux binary package Prefer to use a container image? No problem at all! 🐳 You can read more about running Falco with Docker in the docs. You can also find the Falcosecurity container images on the public AWS ECR gallery: falco falco-no-driver falco-driver-loader Let's meet 🀝 We meet every Wednesday in our community calls, if you want to know the latest and the greatest you should join us there! If you have any questions Join the #falco channel on the Kubernetes Slack Join the Falco mailing list Thanks to all the amazing contributors! Enjoy 😎, Federico ## Blog: Introducing Falco 0.39.0 DevFeed: [Blog: Introducing Falco 0.39.0]() Original publisher: [Read original article]() Published: 2024-10-01T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [version](), [Regular expression](), [Unix](), [Kubernetes](), [User experience (UX)](), [Library]() Tags: [blog](), [bug-fixes](), [falco](), [improvements](), [kubernetes](), [library](), [new-features](), [regex](), [release](), [unix](), [version]() ### AI overview Falco 0.39.0 introduces new operators for basename extraction and regular-expression matching, appendable output fields, schema validation for configuration and rules files, improved Kubernetes engine selection, and other performance and UX improvements. The release also includes bug fixes and breaking changes. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.39.0! This version brings several new features, performance improvements, and bug fixes that streamline Falco's detection capabilities. During this release cycle, we merged more than 50 PRs on Falco and more than 100 PRs for libs and drivers, version 0. 18.0 and version 7.3.0 respectively. Thank you to our maintainers and contributors, as this would not happen without your support and dedication! To learn all about these changes, read on! What's new? TL;DR Key features: Basename operator retrieves the basename of a given path; New fields added in proc and fd classes #1916 #1936; Regular expression operator can be used to match values in string fields; Append output allows to add output text or fields to a subset of loaded rules; Schema validation for config and rules files allows Falco to warn users when unknown keys are used; Improved engine selection in Kubernetes environments driver loader will automatically pick the most compatible driver for each node in the cluster. This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.39.0 release contains a number of feature and UX improvements, here are list of some of the key new capabilities. New Operators The basename() transformer operator extracts the base name, i.e. the filename without directory, of the input field. Note that the behavior ofbasename() in Falco is slightly different from the Unix basename program. For instance, basename (proc.exepath) will evaluate to "cat" for /usr/bin/cat but will evaluate to an empty string ("") for /usr/bin/. This allows, for instance, to write expressions like basename(proc.exepath) = cat to match against the original executable name even if it has been symlinked without knowing the full path, or any other file name based detection. The regex operator checks if a string field matches a regular expression. Please note that the rege ## Blog: Introducing Falco Talon v0.1.0 DevFeed: [Blog: Introducing Falco Talon v0.1.0]() Original publisher: [Read original article]() Published: 2024-09-09T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Kubernetes clusters](), [No-code](), [function as a service](), [Security]() Tags: [blog](), [faas](), [falco](), [kubernetes](), [kubernetes-clusters](), [no-code](), [release](), [security](), [talon](), [version]() ### AI overview This release introduces Falco Talon v0.1.0, a response engine for managing threats in Kubernetes clusters. It is designed to let users define rules and react to Falco events without building and maintaining custom FaaS-based response systems. ### Source excerpt More than 7 years ago, frustrated by the lack of integrations between Falco and third parties, I created Falcosidekick. The tool evolved much more than expected, with the help of dozens of contributors, individuals or for companies, to have now almost 70 different integrations, and more are coming. Its baby brother came few years later, Falcosidekick UI, helping people to visualize in real time the alerts leveraged by Falco and fine tuning their rules. A frustation remained after all. With Falco, we have an amazing tool to detect suspicious events in our Linux hosts, VM and Kubernetes clusters, with Falcosidekick, we can easily notify our Dev/Secops, index the alerts in some SIEM, etc. But a last piece was missing: how to react to these events? With the integrations of well known FaaS in Falcosidekick, we started a series of blog posts to show how to create from scratch what we call a "response engine". All these systems are modular, flexible, robust, but they all require a considerable amount of work from the user, to deal with the Falco payload format, the errors, the retries, the authentication to the API (AWS, Kubernetes Control Plane), the logs, the metrics, etc. Not all users and companies have the skills and/or the budget to maintain such an architecture. To answer these needs, we designed and created Falco Talon. The the first version is officially out!. What is Falco Talon? Falco Talon is a Response Engine for managing threats in Kubernetes clusters. It enhances the solutions proposed by the Falco community with a no-code tailor-made solution. With easy rules, you can react to events from Falco in milliseconds. Why did we created Falco Talon? Over the years, the Falco community proposed different methods to react to the Falco Events, what we call a response engine. All these methods rely on a 3rd party FaaS (Function as a Service) and come with drawbacks, all actions must be developped by the users to manage: The errors The Falco event format The authentica ## Blog: Introducing Falco 0.38.2 DevFeed: [Blog: Introducing Falco 0.38.2]() Original publisher: [Read original article]() Published: 2024-08-19T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [bug](), [Linux](), [rhel 9](), [Prometheus](), [Docker](), [container images]() Tags: [bugfixes](), [container-images](), [docker](), [falco](), [linux](), [prometheus](), [release](), [rhel-9]() ### AI overview Falco 0.38.2 is a patch release that fixes crashes, networking comparison bugs, missing flags, Linux 6.10 kernel module build issues, and possible kernel module crashes on RHEL 9. It also adds troubleshooting logs and changes experimental Prometheus metric labels to support groupBy queries. ### Source excerpt Today we announce the release of Falco 0.38.2 πŸ¦…! Fixes Falco's 0.38.2 is a patch release that includes the most important bugfixes addressed this summer β˜€: Fixed a crash when using transformer operators (e.g. tolower()) with a parameter that evaluates to an empty string Fixed a bug and a regression that could result in incorrect comparison between ipv4 addresses and ipv6 subnets and vice versa Fixed an issue that could result in missing exe_upper_layer flag Fixed kernel module build for Linux 6.10 Fixed a bug that may result in kernel module crashes on recent versions of RHEL 9 Added additional logging to better troubleshoot hard to reproduce issues like "could not parse param ... for event ... of type ...: expected length X, found Y" This patch also introduces a small change with the format of the new experimental Prometheus metrics to make them easier to use. Metrics are now distinguished by the file_name or rule_name labels, in line with Prometheus best practices and supporting groupBy queries. Thanks to everyone in the community for helping us with spotting these annoying bugs and improving Falco every day πŸ›! You make Falco successful πŸ¦…! Thanks as always to the Falco maintainers for their support and effort during the entire release process. Try it! 🏎 As usual, in case you just want to try out the stable Falco 0.38.2, you can install its packages following the process outlined in the docs: CentOS/Amazon Linux Debian/Ubuntu openSUSE Linux binary package Prefer to use a container image? No problem at all! 🐳 You can read more about running Falco with Docker in the docs. You can also find the Falcosecurity container images on the public AWS ECR gallery: falco falco-no-driver falco-driver-loader Let's meet 🀝 We meet every Wednesday in our community calls, if you want to know the latest and the greatest you should join us there! If you have any questions Join the #falco channel on the Kubernetes Slack Join the Falco mailing list Thanks to all the amazing contributor ## Blog: Halfway Through GSoC 2024: My Progress and Plans with Falco DevFeed: [Blog: Halfway Through GSoC 2024: My Progress and Plans with Falco]() Original publisher: [Read original article]() Published: 2024-07-24T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [benchmarking](), [Testing](), [ci]() Tags: [benchmarking](), [container](), [continuous-integration](), [falco](), [gsoc](), [mentorship](), [midterm](), [testing](), [yaml]() ### AI overview A GSoC 2024 mentee describes progress improving Falco's event-generator for testing and benchmarking. The project includes declarative YAML-based Falco rule testing, a container runner, and planned CI pipelines to assess threat-detection correctness and performance. ### Source excerpt Hello Falco community, I'm Kiriti, a current GSoC mentee under Falco Security. I have been working diligently to improve the testing and benchmarking capabilities of Falco's event-generator project. Now that we've reached the midterm of GSoC, I'm eager to share the journey so far. In this blog, I'll delve into the details of my contributions, particularly focusing on two key PRs that have been merged, and outline my plans for the remainder of the program. My Project: Enhancing Falco's Event-Generator The event-generator is a vital utility within the Falco ecosystem, designed to test Falco's detection capabilities. My Google Summer of Code project focuses on upgrading the event-generator to enhance its testing and benchmarking capabilities, reliability, and consistency. Additionally, I am developing new Continuous Integration (CI) pipelines based on the upgraded event-generator. The ultimate goal is to evolve the event-generator into the standard tool for systematically assessing the correctness and performance of Falco's threat detection capabilities during every release and development cycle. My Journey So Far: Before being selected for GSoC, I contributed to the event-generator repository. I am grateful to Leonardo Grasso and Federico Di Pierro, who played a vital role in getting my PRs merged during the pre-GSoC contribution phase. These contributions helped me understand the event-generator codebase. I am also thankful to my mentors, Jason Dellaluce and Aldo Lacuku, for selecting me as a GSoC mentee. I will share my complete story of getting selected to GSoC in future. After my selection, Jason, Aldo, and I collectively designed a plan to enhance the event-generator. The community bonding period was crucial in designing and understanding the implementation plan. You can view our idea here, which we will implement during this GSoC period. Once the coding period began, we managed to merge two key PRs before the midterm. These PRs partially added support for testin [Next page]()