# K8smeta

Published articles for K8smeta.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Blog: How to Deploy Falco with k8s-metacollector + k8smeta Plugin

DevFeed: [Blog: How to Deploy Falco with k8s-metacollector + k8smeta Plugin](<https://devfeed.tech/articles/blog-how-to-deploy-falco-with-k8s-metacollector-k8smeta-plugin-32498.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-k8smeta-plugin/>)

Published: 2024-10-14T00:00:00Z

Content type: tutorial

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [container-security](<https://devfeed.tech/topics/container-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [Kubernetes clusters](<https://devfeed.tech/topics/kubernetes-clusters.md>), [monitor](<https://devfeed.tech/topics/monitor.md>)

Tags: [clusters](<https://devfeed.tech/tags/clusters.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [enrichment](<https://devfeed.tech/tags/enrichment.md>), [falco](<https://devfeed.tech/tags/falco.md>), [helm](<https://devfeed.tech/tags/helm.md>), [k8s-metacollector](<https://devfeed.tech/tags/k8s-metacollector.md>), [k8smeta](<https://devfeed.tech/tags/k8smeta.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [monitor](<https://devfeed.tech/tags/monitor.md>), [plugin](<https://devfeed.tech/tags/plugin.md>), [security](<https://devfeed.tech/tags/security.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>)

### AI overview

This tutorial explains how to deploy Falco with the k8s-metacollector and k8smeta plugin on Kubernetes. It shows how these components add Kubernetes metadata such as pod names, namespaces, and deployment details to Falco security alerts, and how Falco's append_output feature can add extra metadata fields without modifying rules.

### Source excerpt

In today's cloud-native world, securing Kubernetes environments has become increasingly critical as containerized workloads gain complexity. Falco is designed to monitor and detect anomalous activities in Kubernetes clusters and container environments. By continuously observing system calls and enriching event data with metadata, Falco ensures that any suspicious behavior is detected in real-time, protecting against threats like privilege escalations, file tampering, and network anomalies. In this tutorial, we will guide you through deploying Falco with two powerful components: k8s-metacollector and the k8smeta plugin. These tools significantly enhance Falco's security event detection by adding important Kubernetes context, such as pod names, namespaces, deployment details, to the alerts. Additionally, we will explore how to leverage the new append_output feature introduced in Falco version 0.39.0. This feature allows you to append extra metadata fields to Falco's output, without the need to modify your rules. By the end of this guide, you will have a Falco setup capable of detecting security issues in Kubernetes with enriched metadata output, ensuring you get a complete picture of your cluster's security posture. Whether you're an experienced Kubernetes administrator or just starting to explore container security, this guide will help you make the most of Falco's capabilities in a Kubernetes environment. What You'll Learn: The purpose and benefits of using the k8s-metacollector and k8smeta plugin to enrich Falco alerts with Kubernetes-specific data. How to deploy Falco with the k8smeta plugin on a Kubernetes cluster. How to configure and use the append_output feature to enhance Falco alerts with additional metadata fields. Prerequisites: A working Kubernetes cluster and some familiarity with Kubernetes concepts. Basic knowledge of Falco and how it works. Helm installed on your system (for easy deployment of Falco). Let's dive in and set up a Falco deployment that w