# Falcosidekick Published articles for Falcosidekick. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Blog: Falcosidekick 2.31.0 DevFeed: [Blog: Falcosidekick 2.31.0]() Original publisher: [Read original article]() Published: 2025-02-04T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [OpenTelemetry](), [Helm charts](), [Prometheus]() Tags: [changelog](), [charts](), [falco](), [falcosidekick](), [helm-charts](), [observability](), [opentelemetry](), [prometheus](), [release](), [updated](), [upgrade](), [version]() ### AI overview Falcosidekick 2.31.0 adds OTLP metrics forwarding to OpenTelemetry collectors, improves logging and Loki output options, allows NATS/STAN subject customization, and fixes issues involving labels, ClusterPolicyReport creation, HTTP headers, and Prometheus custom fields. Updated Helm charts are also available. ### Source excerpt The year 2025 is well started now. We saw a few days ago the first release of Falco for the year. It's to let fly out a new version of Falcosidekick, the 2.31.0. New output This release comes with a new output only, the last pillar of the observability with [OpenTelemetry].(https://opentelemetry.io/) that missing in Falcosidekick. OTLP Metrics You can now forward the Falco Events to the OpenTelemetery collector or any received understanding the protocol. New features Here's a non exhaustive list of the great features and enhancements which come with this new release: Better logger It was a ToDo for a while (even years), but it's now completed. The log system used by Falcosidekick has been replaced, without any breaking change for the users, but opening the door to more enhancements in the future. More default labels for Loki The log lines forwarded to Loki contain now by default the source namespace and pod name, if present in the alert. It will allow to filter more easily the events you want to display in your dashboards. Thanks to @afreyermuth98. Payload format for Loki Some users asked for the possibility to forward the Falco alerts in their JSON format to Loki. You can now use the setting loki.format for. NATS/STAN subject The template for the subject where to push the messages for NATS/STAN was hardcoded, it can now be overridden with nats/stan.subjecttemplate. See the example config file. Fixes Fix the missing templated fields as labels in Loki payload (PR#1091) Fix the creation error of a ClusterPolicyReport (PR#1100) Fix the missing custom headers for HTTP requests for Loki (PR#1107 thanks to @lsroe) Fix the wrong key format of custom fields for Prometheus (PR#1110 thanks to @rubensf) Conclusion You can find the full changelog here. The respective Helm charts are already updated and allow you to test by yourself all these great new features. Just issue the helm repo update; helm upgrade --reuse-values -n falco command to do so. Once again, thanks to all the ## Blog: Falcosidekick 2.30.0 DevFeed: [Blog: Falcosidekick 2.30.0]() Original publisher: [Read original article]() Published: 2024-12-04T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Cloud Native Ecosystem](), [elasticsearch](), [Prometheus]() Tags: [api](), [batching](), [cloud-native](), [compression](), [elasticsearch](), [falco](), [falcosidekick](), [http](), [prometheus](), [release]() ### AI overview Falcosidekick 2.30.0 adds Webex, OTLP Metrics, and Datadog Logs integrations. The release also improves throughput and Elasticsearch integration, updates Prometheus metric naming, supports multiple AlertManager hosts, and fixes several bugs. ### Source excerpt A few days after a new release of Falco Talon, our response engine, it's time for our favorite proxy forwarder to do the same. New outputs A new release means new integrations. Thanks to our contributors for their helps. Webex Notify your team on Webex with the integration developed by @k0rventen. OTLP Metrics The adoption of Open Telemetry is bigger and bigger in the Cloud Native ecosystem, @ekoops introduced the OTLP Metrics in Falcosidekick. Datalog Logs The Falco alerts can be forwarded to Datadog as events for a while in Falcosidekick, you can now use their Logs service thanks to @yohboy. New features Here's a non exhaustive list of the great features and enhancements which come with this new release: x3 throughput @alekmaus spotted a bottleneck with the http client used to forward the events to the outputs. His fix increases up to 300% the throughput!!! Better integration with Elasticsearch @alekmaus worked hard to improve the integration with Elasticsearch. In addition improvments for the clients, new settings have been introduced, like the possibility to specify an ingest pipeline or an api key, to enable batching and compression. See the docs to know them all. Better consistency for the Prometheus metrics Falco recently integrated a direct endpoint to expose metrics in the Prometheus format. After a lot of discussions between the maintainers and the community, a convention has been chosen for the names of the metrics. This release adapts the metrics exposed by Falcosidekick to follow this convention and have a consistency accross the different components of the ecosystem. Breaking changes: The renaming of the metrics might impact the queries for your alerts and dashboards. Multi hosts for AlertManager You can now specify a list of servers for the AlertManager output, which is a requirement when it's deployed in HA mode. Fixes The contributors fixed several bugs, here's a non exhaustive list of the more important ones: Fix PolicyReports created in the same n ## Blog: Falcosidekick 2.29.0 DevFeed: [Blog: Falcosidekick 2.29.0]() Original publisher: [Read original article]() Published: 2024-07-02T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [releases](), [Falco](), [Security](), [observability](), [Traces](), [dynatrace]() Tags: [apm](), [falco](), [falcosidekick](), [observability](), [release](), [releases](), [security](), [traces]() ### AI overview Falcosidekick 2.29.0 introduces new outputs and features after nearly a year without a release. The release adds integrations with Dynatrace, Sumo Logic, OTLP traces, Quickwit, and Falco Talon, and updates the Kubernetes Policy Report output. OTLP trace export works only for syscall-related events. ### Source excerpt Almost 1 year without a release of Falcosidekick, but version 2.29.0 is finally here. Thanks to all contributors for their patience, you made amazing contributions and we're happy to finally have them available for all users. Like for every releases, a small recap about its adoption. Falcosidekick continues to be adopted, even if the rate is not as high as before, but we're sure it will explode once again with this new fresh version. Once more, Falcosidekick expands Falco's integrability with a lot of new outputs. That and the introduction of many new features has been possible thanks to the hard work of the community. You can find a comprehensive list of these in the changelog. New outputs More and more systems are integrated as outputs in Falcosidekick, more and more often directly by the companies themselves and not their end users. It shows Falco and Falcosidekick are seen as major components in the security fields, and trusted as de facto standards. Dynatrace Mario Kahlhofer, aka @blu3r4y, from Dynatrace, integrated the well known observability and security platform he works for. You can even read his blog post about, to discover how to correlate the Falco events with their APM agent events. Sumologic Carlo Mencarelli, aka @mencarellic, did the exporter of the Falco events to Sumologic, the SaaS platform for your logs. OTLP Traces It started as an internal hackaton at Grafana Labs and became a real integration thanks to JuanJo Ciarlante (@jjo). You can now export the Falco event as traces, to have an automatic correlation between the detected events. [!WARNING] It works only for the syscall related events. Quickwit After a demo of Falco at a CNCF Meetup, the Quickwit team wanted to add their product as a new output for Falcosidekick, and they did it. You can now easily index your Falco events in their search engine thanks to the work of Idriss Neumann (@idrissneumann). Falco Talon New born in the Falco ecosystem, trying to complete the last missing piece: the r ## Blog: Integrate Runtime Security into Your Environment with Falcosidekick DevFeed: [Blog: Integrate Runtime Security into Your Environment with Falcosidekick]() Original publisher: [Read original article]() Published: 2023-10-24T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security](), [threat detection](), [Kubernetes](), [Cloud Native Ecosystem](), [Open Source](), [Tooling](), [AWS Lambda](), [Cloud Functions](), [Cloud Run](), [Kafka](), [RabbitMQ]() Tags: [aws-lambda](), [cloud-functions](), [cloud-native](), [cloud-run](), [falco](), [falcosidekick](), [integrations](), [kafka](), [kubernetes](), [notifications](), [rabbitmq](), [runtime-security](), [security](), [tool]() ### AI overview This article explains how Falcosidekick extends Falco's limited default output options by forwarding runtime-security events to services such as Slack, PagerDuty, email, AWS Lambda, cloud functions, and message queues. It describes configurable notifications and automated responses for suspicious activity in cloud, container, and Kubernetes environments. ### Source excerpt If you're looking to integrate runtime security into your existing environment, Falco is an obvious choice. Falco is a Cloud Native Computing Foundation backed open source project that provides real-time threat detection for cloud, container, and Kubernetes workloads. With over 80 million downloads Falco has been adopted by some of the largest companies in the world. However, what many Falco users discover early on is that Falco's default event output is rather limited. Out of the box, Falco can only send output to five different endpoints: syslog, stdout, stderr, and gRPC or HTTPS endpoints. While these outputs might be enough to get you started, most practitioners want to integrate Falco with the tooling they already use. This is where Falcosidekick comes in. Falcosidekick is a companion (i.e. a side-kick ;)) project for Falco that allows Falco events to be forwarded to 60 different services (with more being added all the time) allowing practitioners to monitor and react to Falco events with the tools they are already using. For example, if you'd like to receive immediate notifications of suspicious activity you can forward Falco events to chat programs such as Slack or Telegram, alerting platforms like PagerDuty or AlertManager, or, of course, email. In order to minimize noise, you can expressly set the level on which to notify, for example, warning-level events might be delivered via email, while critical or higher-level events are sent via chat or directed to your alerting platform. If you want to programmatically address certain events, Falcosidekick integrates with a bunch of different services including functions as a service platforms like AWS Lambda, GCP Cloud Run and Cloud Functions, or Knative. Alerts can also be sent to message queues like Amazon SNS, Apache Kafka, or RabbitMQ. These integrations offer almost endless possibilities for building out response systems for events. For instance, let's say you're running Falco on your Kubernetes cluster, and F