# Talon Published articles for Talon. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Blog: Falco Talon v0.3.0 DevFeed: [Blog: Falco Talon v0.3.0]() Original publisher: [Read original article]() Published: 2025-02-11T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Amazon S3](), [MinIO](), [Command-line interface](), [Kubernetes]() Tags: [aws](), [aws-s3](), [cli](), [falco](), [kubernetes](), [minio](), [release](), [talon](), [version]() ### AI overview Falco Talon 0.3.0 adds a kubernetes:sysdig action that captures syscalls when suspicious events occur in a pod and exports the resulting artifact to AWS S3 or MinIO. The release also describes configuring capture duration and buffer size, and exploring captures with the sysdig CLI or Stratoshark. ### Source excerpt Today, we announce the release of Falco Talon 0.3.0 🦅! Three updates in a row, after Falco and Falcosidekick, it's time for Falco Talon to know a new version. What's new? The key feature this release brings is the new actionner kubernetes:sysdig. For those who are not familiar with sysdig, it's a CLI tool that allows to capture and record the syscalls, like tcpdump does for the network packets. Old brother of Falco, they share the same libs and filters. With this new integration, when a suspicious event occurs in a pod, Talon triggers a capture and then exports the created artifact to AWS S3 or Minio. You can configure the duration and the amount of bytes captured for each syscall. Check out the docs to discover more settings. See this example rule: - action: Capture the syscalls actionner: kubernetes:sysdig parameters: buffer_size: 2048 duration: 20 output: target: minio:s3 parameters: bucket: falco-talon prefix: /sysdig/ After the action has been completed, you'll find the capture in Minio: And you can run the CLI tool sysdig to explore it: ❯ sysdig -r 2025-01-23T13-26-41Z_default_cncf-597d69dbd4-h9fcb_sysdig.scap.gz evt.type=execve and evt.dir=">" 18563 14:26:38.376178286 0 bash (616444.616444) > execve filename=/usr/bin/apt 19163 14:26:38.394972623 0 apt (616445.616445) > execve filename=/usr/bin/dpkg 19599 14:26:38.399546432 0 apt (616446.616446) > execve filename=/usr/lib/apt/methods/http 20319 14:26:38.408846350 0 apt (616447.616447) > execve filename=/usr/lib/apt/methods/http 21775 14:26:38.453363037 0 apt (616448.616448) > execve filename=/usr/lib/apt/methods/gpgv 22335 14:26:38.461330752 0 apt (616449.616449) > execve filename=/usr/lib/apt/methods/gpgv 29434 14:26:38.481292691 0 gpgv (616451.616451) > execve filename=/usr/bin/apt-key 29604 14:26:38.486522901 0 apt-key (616453.616453) > execve filename=/usr/bin/apt-config 30183 14:26:38.494442117 0 apt-config (616454.616454) > execve filename=/usr/bin/dpkg 30422 14:26:38.497278722 0 apt-key (616455.616455) ## Blog: Falco Talon v0.2.0 DevFeed: [Blog: Falco Talon v0.2.0]() Original publisher: [Read original article]() Published: 2024-11-27T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Google Cloud Platform (GCP)](), [Kubernetes](), [Cloud]() Tags: [announce](), [authentication](), [authorization](), [blog](), [falco](), [gcp](), [google-cloud](), [helm](), [kubernetes](), [release](), [talon]() ### AI overview Falco Talon 0.2.0 is a minor release adding GCP function actions, Google Cloud Storage output, new Kubernetes action parameters, a smaller tcpdump action image, and a fix that removes the requirement for an existing config.yaml file when checking rule syntax. ### Source excerpt Today we announce the release of Falco Talon 0.2.0 🦅! Falco Talon 0.2.0 is a minor release that includes new actionners and outputs, add parameters to existing actionners, along one small fix on the check and print commands. Features Add gcp:function actionner: Now users can call GCP function to automate GCP tasks, with authentication and authorization out of the box. - action: Invoke GCP function actionner: gcp:function additional_contexts: - aws parameters: gcp_function_name: simple-http-function gcp_function_location: us-central1 Add gcp:gcs output Now users can send output directly to GCP Google Cloud Storage, same way as s3 and minio existing outputs. Add ignore_standalone_pods parameter for kubernetes:terminate actionner Allow to wait until the completion of kubernetes:drain by configuring max_wait_period and wait_period_excluded_namespaces Use smaller image for the kubernetes:tcpdump actionner Fixes An existing config.yaml file is not required anymore to check the syntax of your rules files. Try it! 🏎 In case you just want to try out the Falco Talon 0.2.0, you can install the helm chart following the instructions on the documentation Let's meet 🤝 We meet every Wednesday in our community calls, if you want to know the latest and the greatest, you should join us there! If you have any questions Join the #falco channel on the Kubernetes Slack Join the Falco mailing list Thanks to all the amazing contributors! Enjoy 😎, Igor ## Blog: Introducing Falco Talon v0.1.0 DevFeed: [Blog: Introducing Falco Talon v0.1.0]() Original publisher: [Read original article]() Published: 2024-09-09T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Kubernetes clusters](), [No-code](), [function as a service](), [Security]() Tags: [blog](), [faas](), [falco](), [kubernetes](), [kubernetes-clusters](), [no-code](), [release](), [security](), [talon](), [version]() ### AI overview This release introduces Falco Talon v0.1.0, a response engine for managing threats in Kubernetes clusters. It is designed to let users define rules and react to Falco events without building and maintaining custom FaaS-based response systems. ### Source excerpt More than 7 years ago, frustrated by the lack of integrations between Falco and third parties, I created Falcosidekick. The tool evolved much more than expected, with the help of dozens of contributors, individuals or for companies, to have now almost 70 different integrations, and more are coming. Its baby brother came few years later, Falcosidekick UI, helping people to visualize in real time the alerts leveraged by Falco and fine tuning their rules. A frustation remained after all. With Falco, we have an amazing tool to detect suspicious events in our Linux hosts, VM and Kubernetes clusters, with Falcosidekick, we can easily notify our Dev/Secops, index the alerts in some SIEM, etc. But a last piece was missing: how to react to these events? With the integrations of well known FaaS in Falcosidekick, we started a series of blog posts to show how to create from scratch what we call a "response engine". All these systems are modular, flexible, robust, but they all require a considerable amount of work from the user, to deal with the Falco payload format, the errors, the retries, the authentication to the API (AWS, Kubernetes Control Plane), the logs, the metrics, etc. Not all users and companies have the skills and/or the budget to maintain such an architecture. To answer these needs, we designed and created Falco Talon. The the first version is officially out!. What is Falco Talon? Falco Talon is a Response Engine for managing threats in Kubernetes clusters. It enhances the solutions proposed by the Falco community with a no-code tailor-made solution. With easy rules, you can react to events from Falco in milliseconds. Why did we created Falco Talon? Over the years, the Falco community proposed different methods to react to the Falco Events, what we call a response engine. All these methods rely on a 3rd party FaaS (Function as a Service) and come with drawbacks, all actions must be developped by the users to manage: The errors The Falco event format The authentica