# Falco Falco is a cloud-native runtime security tool and monitoring agent that observes kernel and other events, applies custom rules, and generates real-time alerts for abnormal behavior and security threats. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Blog: Introducing Falco 0.44.0 DevFeed: [Blog: Introducing Falco 0.44.0]() Original publisher: [Read original article]() Published: 2026-05-26T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [eBPF](), [Kernel](), [Command-line interface](), [Kubernetes]() Tags: [cli](), [deprecated](), [ebpf](), [falco](), [kernel](), [kubernetes](), [release](), [version]() ### AI overview Falco 0.44.0 removes the legacy eBPF probe, gVisor engine, and gRPC output and server. The release adds rule-language list modifiers, a hard capture-file size limit, stricter schema validation, JSON output for listing commands, faster process-tree lookups, and multi-thread safety fixes. It also includes updated libraries, drivers, plugins, and rules. ### Source excerpt Dear Falco Community, we are happy to announce the release of Falco 0.44.0 today! This release completes the deprecation cycle started in 0.42.0 and 0.43.0: the legacy eBPF probe, the gVisor engine, and the gRPC output (along with the gRPC server) are now fully removed from the entire stack. On top of that, 0.44.0 brings new rule-language capabilities, a long-requested safety knob for the capture feature, JSON output for the --list family of commands, a substantial round of performance work on process tree lookups, and a wave of multi-thread safety fixes that lay the groundwork for the upcoming multi-threaded Falco architecture. During this release cycle, we merged: 60 PRs on Falco, including 14 release note-worthy changes 160 PRs on Falco libs, including 54 release note-worthy changes 16 PRs on Falco drivers, including 3 release note-worthy changes We upgraded libs to version 0.25.2 and drivers to 10.2.0+driver. We also ship falcoctl 0.13.0, the container plugin 0.7.1, and the falco-rules ruleset 5.1.0. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Major features and improvements: Comparison operator list modifiers (oneof/anyof/allof) Hard limit on capture file size Stricter rule schema validation Backslash escaping in -o dotted key paths JSON output for the listing CLI commands Faster process tree lookups Multi-thread safety hardening Drivers: The kernel module pre-builds for this release are still being produced and will be available within a couple of days from the release. In the meantime, falcoctl can build the kernel module locally on the host. Drivers: new syscall, kernel 7.0, and BPF iterators Plugins: Container plugin fix for containerd v2.3.0 Plugin library path traversal hardening Event generator: Event generator: HTTP output and new suite namespace Rules: Updated ruleset (falco-rules 5.1.0) Kubernetes: Kubernetes Oper ## Blog: Introducing Prempti: Falco meets AI coding agents DevFeed: [Blog: Introducing Prempti: Falco meets AI coding agents]() Original publisher: [Read original article]() Author: Rule authoring Published: 2026-05-12T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [AI-assisted coding](), [Claude Code](), [Authorization](), [Command-line interface](), [file]() Tags: [ai-coding-agents](), [claude-code](), [falco](), [file](), [network](), [permissions](), [prempti](), [shell]() ### AI overview Falco introduces Prempti, an experimental user-space service for monitoring and enforcing AI coding-agent tool calls. Prempti intercepts file reads, file writes, and shell commands, evaluates them against Falco rules, and returns allow, ask, or deny verdicts. ### Source excerpt Today's developer workflow is increasingly reliant on AI coding agents. Tools like Claude Code sit in your terminal, read your files, run shell commands, make network requests, and write code, all on your behalf. They are fast, capable, and increasingly trusted with real tasks on real machines. But with that trust comes a question worth taking seriously: what exactly is your coding agent doing on your machine? Today, we're introducing an experimental project that brings Falco to this new frontier: Prempti. Agents are a black box at runtime When a coding agent runs a bash command, writes a file, or reads a configuration, those actions happen inside your user session, with your permissions, in your filesystem, against your credentials. Most developers using these tools have no structured visibility into that activity. You see the agent's chat output, but you don't see what's happening under the hood. Here's a simple scenario: you ask your coding agent to refactor a module. It reads your source files. It makes edits. Then, perhaps prompted by a malicious dependency or an unexpected instruction in a file it just parsed, it attempts to read ~/.ssh/known_hosts or write a file to ~/.aws/. Should it be allowed to? Would you even know if it tried? The demo below captures exactly this situation: To run this asciicast without javascript, use asciinema play https://asciinema.org/a/857572.json with Asciinema The agent tried to both read and write to sections it's not allowed to, and both were blocked. The agent itself received a structured message explaining why, and showed that to the user. This is detection and enforcement working together at the tool-call level. How Prempti works Prempti runs as a lightweight user-space service alongside your coding agent. It does not require root, kernel modules, or containers. When your agent makes a tool call such as a file write, a shell command, or a file read, Prempti intercepts it before it executes, evaluates it against Falco rules, a ## Blog: Introducing Falco Operator 0.2.0 DevFeed: [Blog: Introducing Falco Operator 0.2.0]() Original publisher: [Read original article]() Published: 2026-03-23T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Kubernetes](), [Deployment](), [observability](), [API](), [configuration]() Tags: [api](), [bug-fixes](), [configuration](), [falco](), [falco-operator](), [kubernetes-operator](), [observability](), [release]() ### AI overview Falco Operator 0.2.0 is announced as its first production-ready release. The Kubernetes operator adds a redesigned API, ecosystem component management, artifact and configuration support, enhanced observability, improved reconciliation, and bug fixes. Falco recommends it for deploying and managing Falco on Kubernetes while continuing to support the existing Helm chart. ### Source excerpt Dear Falco Community, today we are excited to announce the release of Falco Operator 0.2.0, the first production-ready release of the Kubernetes operator for Falco! Since the technical preview announced with Falco 0.41.0, we have been working hard to make the operator robust, extensible, and ready for real-world environments. This release brings a redesigned API, a new Component controller for managing the Falco ecosystem, new artifact management capabilities, enhanced observability, and a significantly improved operational model, all grounded in Kubernetes-native patterns. We merged 58 commits since v0.1.1, delivering major new features, 10 bug fixes, and comprehensive architectural improvements. Thank you to all our contributors and the community for your feedback along the way! Going forward, the Falco Operator is the recommended way to deploy and manage Falco on Kubernetes. While the existing Helm chart remains fully supported, we plan to transition to the operator as the standard deployment method. More details on the transition timeline will follow in a future announcement. To learn everything about the changes, read on! What's new? TL;DR Key features: Ecosystem components - deploy Falcosidekick, Falcosidekick UI, and k8s-metacollector as managed components ConfigMap support for rules and configuration, alongside OCI artifacts and inline definitions Structured API types for inline rules and configuration - YAML objects instead of strings Redesigned OCI artifact API with separate image and registry configuration Reference tracking with finalizers to prevent accidental deletion of Secrets and ConfigMaps Enhanced observability with Kubernetes events and status conditions across all controllers Update strategy support for DaemonSet and Deployment modes Server-Side Apply migration for safer, conflict-free reconciliation Key fixes: Plugin initConfig now supports nested configuration objects RBAC compatibility with Kubernetes 1.32+ Spurious update prevention via mana ## Blog: Falco at KubeCon Europe 2026 -- See You in Amsterdam! 🐦 DevFeed: [Blog: Falco at KubeCon Europe 2026 -- See You in Amsterdam! 🐦]() Original publisher: [Read original article]() Published: 2026-03-18T00:00:00Z Content type: news Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security](), [Cloud](), [container](), [AI-assisted coding]() Tags: [2026](), [blog](), [cloud-native](), [community](), [conference](), [container](), [europe](), [falco](), [kubecon](), [kubernetes](), [live-event](), [security]() ### AI overview Falco announces its presence at KubeCon + CloudNativeCon Europe 2026 in Amsterdam, including talks, a workshop, booth activities, and a preview of a developing way to run Falco locally so AI coding agents follow new rules. ### Source excerpt We're excited to share that the Falco community will be at KubeCon + CloudNativeCon Europe 2026 in Amsterdam! Whether you're a long-time contributor, a curious user, or just want to say hi, we'd love to see you there. Falco is celebrating 10 years of development and adoption, and we are on the lookout for people who would like to say Happy Birthday to the project or share their best Falco story. Libby Schulze and I will be on the event floor with mic and camera to capture some amazing moments and memories from Falco's 10 years. So bring your best story, and we'll see you at the Falco booth! Sneak peek Psst... we have something really cool brewing that we will show at the Falco booth. You, our amazing reader, is the first to hear about this. It's a way to run Falco locally on your development machine, and make sure your AI coding agents are following new rules that are being defined. We'd love to get your feedback on this as we're currently building it! Here's where you can find us in Amsterdam and everything we have lined up: Project lightning talk Forensics With Falco Speaker: Gerald Combs, Maintainer When: Monday, March 23, 2026 -- 10:27 to 10:32 CET Where: Elicium 2 Falco has recently expanded its capabilities with capture recording, opening the door to seamless integration with forensic analysis tools like Stratoshark. In this lightning talk, Gerald will walk through how the two tools work together to provide deep visibility into container and system activity. He will demonstrate how captured event data can accelerate investigations and discuss key considerations for safely and efficiently deploying these features in production environments. Sysdig-led workshop Hands-On Cloud Native Security Workshop When: Monday, March 23 -- 2:00-4:00 PM CET Run Atomic Red Teamβ„’ tests, then step into the Blue Team role to detect threats and create custom Falcoβ„’ detection rules in this hands-on 90-minute keyboard workshop. Conference talk In Falco's Nest: The Evolution of Cloud Na ## Falco Invites Community Feedback Through a 2026 Survey DevFeed: [Falco Invites Community Feedback Through a 2026 Survey]() Original publisher: [Read original article]() Published: 2026-02-25T00:00:00Z Content type: opinion Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security]() Tags: [2026](), [community](), [falco](), [runtime-security](), [survey]() ### AI overview Falco invites its community to complete a short survey about community connection, priorities, resources, tool integrations, and how people use Falco. The organization says it will share a report of the responses alongside KubeCon Europe 2026. ### Source excerpt New year, new opportunities! As we spread our wings and glide into 2026, we want to make sure this community is one you're proud (and excited!) to be a part of. Falco has always been more than just a project: it's a flock of builders, defenders, contributors, question-askers, doc-writers, rule-tuners, and runtime security enthusiasts. And now we want to hear from you. We've put together a quick community survey (5 minutes or less!) to better understand: How connected you feel to the community What you love about being a part of it What could be better What you'd like to see us focus on this year What resources would make your life easier How you're using Falco and what tools you integrate it with Your feedback directly shapes our focus on what we build, improve, prioritize, and invest in this year - from documentation and content to events, integrations, and contributor experience. A report detailing the responses will be shared at the same time as KubeCon Europe 2026. Whether you're building, using, learning, or just keeping an eye on things, your voice matters. πŸ‘‰ Take the survey here Thanks for being part of the flock. We couldn't do this without you and we're excited to build 2026 together! ## Blog: Introducing Falco 0.43.0 DevFeed: [Blog: Introducing Falco 0.43.0]() Original publisher: [Read original article]() Published: 2026-01-26T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [eBPF](), [Kernel](), [Maintainability]() Tags: [ebpf](), [falco](), [improvements](), [kernel](), [legacy](), [maintainability](), [race-condition](), [release](), [version]() ### AI overview Falco 0.43.0 is a stabilization release that consolidates changes from 0.42.0, adds deprecations, and fixes issues across Falcoctl, plugins, and libraries. It includes updates to Falco libraries and drivers, signature verification fixes, plugin fixes, and the reintroduction of the evt.arg.filename field. The release deprecates the legacy eBPF probe and gVisor engine while directing users toward modern alternatives. ### Source excerpt Dear Falco Community, we are happy to announce the release of Falco 0.43.0 today! This is a stabilization release that consolidates the changes introduced in 0.42.0, including the drop-enter initiative and the capture recording feature. It also introduces several deprecations to improve maintainability and fixes minor issues across falcoctl, plugins, and libs. During this release cycle, we merged: 31 PRs on Falco, including 11 release note-worthy changes 48 PRs on Falco libs, including 17 release note-worthy changes 8 PRs on Falco drivers, including 3 release note-worthy changes We upgraded libs to version 0.23.1 and drivers to 9.1.0+driver. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Deprecations GPG key rotation Container plugin improvements Falcoctl tweaks and improvements Key fixes: evt.arg.filename field reintroduction Falcoctl signature verification fixes overflow and NULL pointer dereferences fixes for the container plugin, shipped with plugins/container/0.6.1 race condition fix for the k8smeta plugin, shipped with plugins/k8smeta/0.4.1 This release also comes with breaking changes that you should be aware of before upgrading. Latest updates Deprecations In Falco 0.43.0, we are announcing the deprecation of three significant components to streamline the project, reduce maintenance burden, and focus on modern, more efficient alternatives. All these components are stable, and considering that the deprecation is first enforced in this version, they could be removed at any future version starting from 0.44.0. Legacy eBPF probe deprecation The "legacy" eBPF probe (configured via engine.kind=ebpf) was the original eBPF implementation in Falco. It required compiling a specific probe for each kernel version, often necessitating the dynamic usage of the falco-driver-loader or pre-built drivers. The Modern eBPF probe (engine.kind=m ## Blog: GPG Key Rotation for Falco Packages (2026) DevFeed: [Blog: GPG Key Rotation for Falco Packages (2026)]() Original publisher: [Read original article]() Published: 2025-12-12T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security](), [Package manager](), [releases](), [apt]() Tags: [announcements](), [apt](), [falco](), [import](), [installation](), [releases](), [rotation](), [rsa](), [security]() ### AI overview Falco maintainers are rotating the 4096-bit RSA GPG key used to sign official RPM and DEB packages because the existing key expires on January 17, 2026. The transition uses a soft launch followed by a hard cut-over, and existing users should update their keyrings before January 12, 2026. ### Source excerpt The GPG key used to sign official Falco packages (RPM and DEB) is set to expire on January 17, 2026. To ensure the security and continuity of our software distribution, the Falco maintainers will be rotating to a new 4096-bit RSA key. We have designed a two-phase "Soft Launch" strategy to make this transition as smooth as possible, providing a one-month transition window before the old key is retired. The Rotation Plan To avoid immediate disruption, we are rolling out the new key in two distinct phases. You can follow the detailed progress in our tracking issue #3750. Phase 1: Soft Launch (Dec 12, 2025) What happens: The new GPG key has been published and added to our repository configuration. Dev Builds: Will begin using the New Key immediately. Stable Builds: No stable releases are planned for this phase. If any hotfixes are released, they will be signed with New Key as well. Key Bundle: The official key URL has been updated to serve a bundle containing both the Old (valid) and New (valid) keys. Phase 2: Hard Cut-Over (Jan 12-17, 2026) What happens: This is the maintenance window where we fully switch to the new key. Mass Resign: All existing stable packages on download.falco.org will be resigned with the New Key. Revocation: The Old Key will be officially revoked and removed from the active bundle. Impact: If you have not updated your keyring by this date, your package manager (apt or yum) will reject updates with a signature verification error. Action Items for Users We strongly recommend all users update their GPG keyring before January 12, 2026 to avoid interruption. New Users If you are installing Falco for the first time following our Install on a host (DEB,RPM) instructions, no action is required. The installation process will guide you to fetch the new key bundle, ensuring you are ready for both phases. Existing Users If you have an existing Falco installation, you must manually import the new key. We have updated the key file at our standard URL to includ ## Blog: Introducing Falco 0.42.0 DevFeed: [Blog: Introducing Falco 0.42.0]() Original publisher: [Read original article]() Published: 2025-10-22T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [container](), [Processes](), [static linking]() Tags: [bug](), [bug-fixes](), [dry-run](), [falco](), [features](), [memory-leak](), [performance](), [recording](), [release](), [static-linking]() ### AI overview Falco 0.42.0 introduces a capture recording feature that generates .scap files when detection rules trigger, including system-call traces for forensic analysis. The release also includes performance improvements, schema validation, configuration changes, and bug fixes. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.42.0! This release brings exciting new capabilities, including the capture feature, significant performance improvements, and important bug fixes that enhance Falco's capabilities. During this release cycle, we merged: 52 PRs on Falco, including 23 release note-worthy changes 110 PRs on Falco libs, including 47 release note-worthy changes 102 PRs on Falco drivers, including 29 release note-worthy changes We upgraded libs to version 0.22.1 and drivers to v9.0.0+driver. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Key features: Capture recording feature; Drop enter initiative for performance; Plugin event schema validation; Thread table auto-purging configuration; Static fields; Key fixes: Fix thread table memory leak when parsing vfork (or equivalent clone/clone3 with CLONE_VFORK) exit from the caller process; Enable handling of multiple actions configured with syscall_event_drops.actions; Disable dry-run restarts when Falco runs with config-watching disabled; Fix abseil-cpp for Alpine build; Fix detection sandbox containers for CRI and containerd runtimes (container plugin); Stability improvements for container plugin and static linking of libgcc/libstdc++ for legacy compatibility; This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.42.0 release contains a new capture feature and significant performance improvements. Here is a list of the key new capabilities. Capture recording feature Falco 0.42.0 introduces the new capture recording feature, now available at sandbox maturity. This capability allows Falco to generate .scap files whenever a detection rule is triggered automatically. Each capture contains a detailed trace of system calls around the event, providing forensic-level ## Blog: Introducing Falco 0.41.0 DevFeed: [Blog: Introducing Falco 0.41.0]() Original publisher: [Read original article]() Published: 2025-05-29T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [eBPF](), [Kubernetes](), [configuration](), [container](), [JSON](), [Prometheus](), [bug](), [Code Modularity]() Tags: [bug-fixes](), [capabilities](), [changes](), [code-modularity](), [configuration](), [container](), [ebpf](), [falco](), [json](), [kubernetes](), [prometheus](), [release](), [ux]() ### AI overview Falco 0.41.0 introduces revised container engine support, an early Kubernetes operator, configurable merge strategies, expanded eBPF driver behavior, new field access options, and JSON output controls. The release also includes fixes for kernel-module crashes, Prometheus metrics, RPM scripts, and configuration overrides. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.41.0! This version brings several new features, performance enhancements, and bug fixes that streamline Falco's detection capabilities. During this release cycle, we merged more than 50 PRs on Falco and around 130 PRs for libs and drivers, version 0.21.0 and version 8.1.0, respectively. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Key features: Reimplemented container engines support from scratch; A Kubernetes operator is taking shape; Falco's config_files configuration gained support to specify the merge strategy; Modern eBPF driver is now capable of trying to load multiple programs for each event; consequently, sendmmsg and recvmmsg will now make use of bpf_loop eBPF helper where available, boosting their performances; New proc.aargs field available, ie: a lookup for an ancestor args field; proc.args gained support for indexed access, to only check a certain argument; json_include_output_fields configuration key for Falco to control whether output fields are included in the JSON message; Ongoing work to improve libs code modularity; Key fixes: Avoid kmod crashing when a CPU gets enabled at runtime; Fixed Falco Prometheus metrics with multiple event sources enabled; Fixed RPM packages evaluation of RPM scripts; -o options do now correctly override included config_files; This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.41.0 release contains a number of features and UX improvements. Here is a list of some of the key new capabilities. Reimplemented container engines support In the Falco 0.41.0 release, the Falco team has completely revised its support for container engines. Key improvements include: Container support is now a plugin; The plugin will attach a listener to the eng ## Blog: Falco plugin for collecting AKS audit logs DevFeed: [Blog: Falco plugin for collecting AKS audit logs]() Original publisher: [Read original article]() Published: 2025-03-09T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Azure Kubernetes Service](), [Falco](), [Kubernetes](), [Security](), [threat detection](), [api server](), [Containers](), [Cloud Native Ecosystem](), [Kernel]() Tags: [aks](), [audit](), [auditlogs](), [azure](), [azure-kubernetes-service](), [falco](), [kubernetes](), [logs](), [plugin](), [security](), [threat-detection]() ### AI overview The article introduces a Falco plugin for collecting Azure Kubernetes Service (AKS) audit logs. It explains how Falco uses runtime and Kubernetes data for threat detection and outlines the required Event Hub configuration and storage setup for using the plugin. ### Source excerpt Troubleshooting Kubernetes events is challenging due to the multitude of data sources involved: container logs, Kubernetes events, cloud logs, and more. Among these sources, Kubernetes audit logs are especially valuable for identifying threats, as every action passing through the Kubernetes API server is recorded there. We already provide plugins that let you parse and use Falco to detect threats in audit logs from GKE and EKS clusters. With our latest plugin, you'll now have the same powerful threat detection capabilities for your Azure AKS clusters. What is Falco? Falco is a Cloud Native Computing Foundation project that provides runtime threat detection. Out of the box, Falco examines syscalls to alert you to any suspicious activity. And, since containers share the same kernel as their host, Falco can monitor not only activity on the host but also activity on all of the containers running on that host. Moreover, Falco pulls data from both Kubernetes and the container runtime to add additional context to its alerts. With Falco running on your GKE clusters you can be notified of a wide variety of events, such as: Did someone start a container with high privileges? Has someone shelled into a running container? Has an executable been added to the container after it was deployed? These are just a few examples. Falco has over 80 rules that can be used to make you aware of not only external threats but also when clusters aren't being operated in accordance with industry best practices. What is the AKS audit logs plugin? The AKS audit logs plugin extends Falco's capabilities to Microsoft Azure Kubernetes Service (AKS) clusters, providing you with the same security insights and threat detection Falco already offers for GKE and EKS environments. With this plugin, you can seamlessly integrate AKS audit logs into Falco's event processing pipeline, enabling it to identify anomalies, suspicious activities, and policy violations within your AKS-based workloads. Using AKS audit ## Blog: Falco Talon v0.3.0 DevFeed: [Blog: Falco Talon v0.3.0]() Original publisher: [Read original article]() Published: 2025-02-11T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Amazon S3](), [MinIO](), [Command-line interface](), [Kubernetes]() Tags: [aws](), [aws-s3](), [cli](), [falco](), [kubernetes](), [minio](), [release](), [talon](), [version]() ### AI overview Falco Talon 0.3.0 adds a kubernetes:sysdig action that captures syscalls when suspicious events occur in a pod and exports the resulting artifact to AWS S3 or MinIO. The release also describes configuring capture duration and buffer size, and exploring captures with the sysdig CLI or Stratoshark. ### Source excerpt Today, we announce the release of Falco Talon 0.3.0 πŸ¦…! Three updates in a row, after Falco and Falcosidekick, it's time for Falco Talon to know a new version. What's new? The key feature this release brings is the new actionner kubernetes:sysdig. For those who are not familiar with sysdig, it's a CLI tool that allows to capture and record the syscalls, like tcpdump does for the network packets. Old brother of Falco, they share the same libs and filters. With this new integration, when a suspicious event occurs in a pod, Talon triggers a capture and then exports the created artifact to AWS S3 or Minio. You can configure the duration and the amount of bytes captured for each syscall. Check out the docs to discover more settings. See this example rule: - action: Capture the syscalls actionner: kubernetes:sysdig parameters: buffer_size: 2048 duration: 20 output: target: minio:s3 parameters: bucket: falco-talon prefix: /sysdig/ After the action has been completed, you'll find the capture in Minio: And you can run the CLI tool sysdig to explore it: ❯ sysdig -r 2025-01-23T13-26-41Z_default_cncf-597d69dbd4-h9fcb_sysdig.scap.gz evt.type=execve and evt.dir=">" 18563 14:26:38.376178286 0 bash (616444.616444) > execve filename=/usr/bin/apt 19163 14:26:38.394972623 0 apt (616445.616445) > execve filename=/usr/bin/dpkg 19599 14:26:38.399546432 0 apt (616446.616446) > execve filename=/usr/lib/apt/methods/http 20319 14:26:38.408846350 0 apt (616447.616447) > execve filename=/usr/lib/apt/methods/http 21775 14:26:38.453363037 0 apt (616448.616448) > execve filename=/usr/lib/apt/methods/gpgv 22335 14:26:38.461330752 0 apt (616449.616449) > execve filename=/usr/lib/apt/methods/gpgv 29434 14:26:38.481292691 0 gpgv (616451.616451) > execve filename=/usr/bin/apt-key 29604 14:26:38.486522901 0 apt-key (616453.616453) > execve filename=/usr/bin/apt-config 30183 14:26:38.494442117 0 apt-config (616454.616454) > execve filename=/usr/bin/dpkg 30422 14:26:38.497278722 0 apt-key (616455.616455) ## Blog: Falcosidekick 2.31.0 DevFeed: [Blog: Falcosidekick 2.31.0]() Original publisher: [Read original article]() Published: 2025-02-04T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [OpenTelemetry](), [Helm charts](), [Prometheus]() Tags: [changelog](), [charts](), [falco](), [falcosidekick](), [helm-charts](), [observability](), [opentelemetry](), [prometheus](), [release](), [updated](), [upgrade](), [version]() ### AI overview Falcosidekick 2.31.0 adds OTLP metrics forwarding to OpenTelemetry collectors, improves logging and Loki output options, allows NATS/STAN subject customization, and fixes issues involving labels, ClusterPolicyReport creation, HTTP headers, and Prometheus custom fields. Updated Helm charts are also available. ### Source excerpt The year 2025 is well started now. We saw a few days ago the first release of Falco for the year. It's to let fly out a new version of Falcosidekick, the 2.31.0. New output This release comes with a new output only, the last pillar of the observability with [OpenTelemetry].(https://opentelemetry.io/) that missing in Falcosidekick. OTLP Metrics You can now forward the Falco Events to the OpenTelemetery collector or any received understanding the protocol. New features Here's a non exhaustive list of the great features and enhancements which come with this new release: Better logger It was a ToDo for a while (even years), but it's now completed. The log system used by Falcosidekick has been replaced, without any breaking change for the users, but opening the door to more enhancements in the future. More default labels for Loki The log lines forwarded to Loki contain now by default the source namespace and pod name, if present in the alert. It will allow to filter more easily the events you want to display in your dashboards. Thanks to @afreyermuth98. Payload format for Loki Some users asked for the possibility to forward the Falco alerts in their JSON format to Loki. You can now use the setting loki.format for. NATS/STAN subject The template for the subject where to push the messages for NATS/STAN was hardcoded, it can now be overridden with nats/stan.subjecttemplate. See the example config file. Fixes Fix the missing templated fields as labels in Loki payload (PR#1091) Fix the creation error of a ClusterPolicyReport (PR#1100) Fix the missing custom headers for HTTP requests for Loki (PR#1107 thanks to @lsroe) Fix the wrong key format of custom fields for Prometheus (PR#1110 thanks to @rubensf) Conclusion You can find the full changelog here. The respective Helm charts are already updated and allow you to test by yourself all these great new features. Just issue the helm repo update; helm upgrade --reuse-values -n falco command to do so. Once again, thanks to all the ## Blog: Introducing Falco 0.40.0 DevFeed: [Blog: Introducing Falco 0.40.0]() Original publisher: [Read original article]() Published: 2025-01-28T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Docker](), [Processes](), [Usability](), [Security]() Tags: [bug-fixes](), [docker](), [docker-images](), [falco](), [improvements](), [new-features](), [performance](), [process](), [release](), [version](), [x86-64]() ### AI overview Falco 0.40.0 introduces streamlined Docker images, a reintroduced static x86_64 build using musl, process metadata filters, support for sendmmsg and recvmmsg syscall parameters, and plugin-suggested output fields. The release also includes performance, usability, and bug-fix improvements, along with breaking changes for upgraders. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.40.0! This version brings several new features, performance improvements, and bug fixes that streamline Falco's detection capabilities. During this release cycle, we merged more than 52 PRs on Falco and more than 150 PRs for libs and drivers, version 0.20.0 and version 8.0.0 respectively. Thank you to our maintainers and contributors, as this would not happen without your support and dedication! To learn all about these changes, read on! What's new? TL;DR Key features: Streamlined Falco docker images; Falco static build has been reintroduced for x86_64 binary using musl; New process filters allow to filter events based on process metadata; Added support for sendmmsg and recvmmsg syscalls parameters; Plugins suggested output fields are now available in the Falco engine; This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.40.0 release contains a number of features and UX improvements. Here is a list of some of the key new capabilities. Streamlined Falco docker images In the Falco 0.40.0 release, the Falco team has streamlined the Docker images to improve usability and performance. The new images are designed to be more efficient and easier to use, providing a better experience for users deploying Falco in containerized environments. Key improvements include: Reduced Image Size: The new images are smaller, which reduces the time required to pull and deploy them. Optimized Layers: The layers in the Docker images have been optimized to improve build times and caching efficiency. Enhanced Security: The images have been hardened to enhance security, reducing potential vulnerabilities. These changes make it easier to deploy and manage Falco in various environments. Introducing new process filters A new set of process filters are made available in this release: proc.pgid, proc.pgid.name, proc.pgid.exe, proc.pgid.exepath, pr ## Blog: Falcosidekick 2.30.0 DevFeed: [Blog: Falcosidekick 2.30.0]() Original publisher: [Read original article]() Published: 2024-12-04T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Cloud Native Ecosystem](), [elasticsearch](), [Prometheus]() Tags: [api](), [batching](), [cloud-native](), [compression](), [elasticsearch](), [falco](), [falcosidekick](), [http](), [prometheus](), [release]() ### AI overview Falcosidekick 2.30.0 adds Webex, OTLP Metrics, and Datadog Logs integrations. The release also improves throughput and Elasticsearch integration, updates Prometheus metric naming, supports multiple AlertManager hosts, and fixes several bugs. ### Source excerpt A few days after a new release of Falco Talon, our response engine, it's time for our favorite proxy forwarder to do the same. New outputs A new release means new integrations. Thanks to our contributors for their helps. Webex Notify your team on Webex with the integration developed by @k0rventen. OTLP Metrics The adoption of Open Telemetry is bigger and bigger in the Cloud Native ecosystem, @ekoops introduced the OTLP Metrics in Falcosidekick. Datalog Logs The Falco alerts can be forwarded to Datadog as events for a while in Falcosidekick, you can now use their Logs service thanks to @yohboy. New features Here's a non exhaustive list of the great features and enhancements which come with this new release: x3 throughput @alekmaus spotted a bottleneck with the http client used to forward the events to the outputs. His fix increases up to 300% the throughput!!! Better integration with Elasticsearch @alekmaus worked hard to improve the integration with Elasticsearch. In addition improvments for the clients, new settings have been introduced, like the possibility to specify an ingest pipeline or an api key, to enable batching and compression. See the docs to know them all. Better consistency for the Prometheus metrics Falco recently integrated a direct endpoint to expose metrics in the Prometheus format. After a lot of discussions between the maintainers and the community, a convention has been chosen for the names of the metrics. This release adapts the metrics exposed by Falcosidekick to follow this convention and have a consistency accross the different components of the ecosystem. Breaking changes: The renaming of the metrics might impact the queries for your alerts and dashboards. Multi hosts for AlertManager You can now specify a list of servers for the AlertManager output, which is a requirement when it's deployed in HA mode. Fixes The contributors fixed several bugs, here's a non exhaustive list of the more important ones: Fix PolicyReports created in the same n ## Blog: Falco Talon v0.2.0 DevFeed: [Blog: Falco Talon v0.2.0]() Original publisher: [Read original article]() Published: 2024-11-27T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Google Cloud Platform (GCP)](), [Kubernetes](), [Cloud]() Tags: [announce](), [authentication](), [authorization](), [blog](), [falco](), [gcp](), [google-cloud](), [helm](), [kubernetes](), [release](), [talon]() ### AI overview Falco Talon 0.2.0 is a minor release adding GCP function actions, Google Cloud Storage output, new Kubernetes action parameters, a smaller tcpdump action image, and a fix that removes the requirement for an existing config.yaml file when checking rule syntax. ### Source excerpt Today we announce the release of Falco Talon 0.2.0 πŸ¦…! Falco Talon 0.2.0 is a minor release that includes new actionners and outputs, add parameters to existing actionners, along one small fix on the check and print commands. Features Add gcp:function actionner: Now users can call GCP function to automate GCP tasks, with authentication and authorization out of the box. - action: Invoke GCP function actionner: gcp:function additional_contexts: - aws parameters: gcp_function_name: simple-http-function gcp_function_location: us-central1 Add gcp:gcs output Now users can send output directly to GCP Google Cloud Storage, same way as s3 and minio existing outputs. Add ignore_standalone_pods parameter for kubernetes:terminate actionner Allow to wait until the completion of kubernetes:drain by configuring max_wait_period and wait_period_excluded_namespaces Use smaller image for the kubernetes:tcpdump actionner Fixes An existing config.yaml file is not required anymore to check the syntax of your rules files. Try it! 🏎 In case you just want to try out the Falco Talon 0.2.0, you can install the helm chart following the instructions on the documentation Let's meet 🀝 We meet every Wednesday in our community calls, if you want to know the latest and the greatest, you should join us there! If you have any questions Join the #falco channel on the Kubernetes Slack Join the Falco mailing list Thanks to all the amazing contributors! Enjoy 😎, Igor ## Blog: How to Deploy Falco with k8s-metacollector + k8smeta Plugin DevFeed: [Blog: How to Deploy Falco with k8s-metacollector + k8smeta Plugin]() Original publisher: [Read original article]() Published: 2024-10-14T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Kubernetes](), [container-security](), [Security](), [Deployment](), [Kubernetes clusters](), [monitor]() Tags: [clusters](), [container-security](), [deployment](), [enrichment](), [falco](), [helm](), [k8s-metacollector](), [k8smeta](), [kubernetes](), [monitor](), [plugin](), [security](), [tutorial]() ### AI overview This tutorial explains how to deploy Falco with the k8s-metacollector and k8smeta plugin on Kubernetes. It shows how these components add Kubernetes metadata such as pod names, namespaces, and deployment details to Falco security alerts, and how Falco's append_output feature can add extra metadata fields without modifying rules. ### Source excerpt In today's cloud-native world, securing Kubernetes environments has become increasingly critical as containerized workloads gain complexity. Falco is designed to monitor and detect anomalous activities in Kubernetes clusters and container environments. By continuously observing system calls and enriching event data with metadata, Falco ensures that any suspicious behavior is detected in real-time, protecting against threats like privilege escalations, file tampering, and network anomalies. In this tutorial, we will guide you through deploying Falco with two powerful components: k8s-metacollector and the k8smeta plugin. These tools significantly enhance Falco's security event detection by adding important Kubernetes context, such as pod names, namespaces, deployment details, to the alerts. Additionally, we will explore how to leverage the new append_output feature introduced in Falco version 0.39.0. This feature allows you to append extra metadata fields to Falco's output, without the need to modify your rules. By the end of this guide, you will have a Falco setup capable of detecting security issues in Kubernetes with enriched metadata output, ensuring you get a complete picture of your cluster's security posture. Whether you're an experienced Kubernetes administrator or just starting to explore container security, this guide will help you make the most of Falco's capabilities in a Kubernetes environment. What You'll Learn: The purpose and benefits of using the k8s-metacollector and k8smeta plugin to enrich Falco alerts with Kubernetes-specific data. How to deploy Falco with the k8smeta plugin on a Kubernetes cluster. How to configure and use the append_output feature to enhance Falco alerts with additional metadata fields. Prerequisites: A working Kubernetes cluster and some familiarity with Kubernetes concepts. Basic knowledge of Falco and how it works. Helm installed on your system (for easy deployment of Falco). Let's dive in and set up a Falco deployment that w ## Blog: Introducing Falco 0.39.1 DevFeed: [Blog: Introducing Falco 0.39.1]() Original publisher: [Read original article]() Published: 2024-10-09T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [bug](), [Parsing](), [JSON Schema](), [Docker](), [Amazon Web Services]() Tags: [aws](), [bug](), [docker](), [falco](), [json-schema](), [parsing](), [release]() ### AI overview Falco 0.39.1 is a small patch release that fixes a plugin event-parsing crash, a command-line parsing bug involving commas in object definitions, and a JSON Schema issue allowing null plugin init_config values. ### Source excerpt Today we announce the release of Falco 0.39.1 πŸ¦…! Fixes Falco's 0.39.1 is a small patch release that includes some important bugfixes: Fixed a crash when using plugin with event parsing capabilities (eg: k8smeta plugin) Fixed a bug while parsing -o key={object} command line arguments, when the object definition contains a comma Improved config json schema to allow null init_config for plugin info Thanks to everyone in the community for helping us with spotting these annoying bugs and improving Falco every day πŸ›! You make Falco successful πŸ¦…! Thanks as always to the Falco maintainers for their support and effort during the entire release process. Try it! 🏎 As usual, in case you just want to try out the stable Falco 0.39.1, you can install its packages following the process outlined in the docs: CentOS/Amazon Linux Debian/Ubuntu openSUSE Linux binary package Prefer to use a container image? No problem at all! 🐳 You can read more about running Falco with Docker in the docs. You can also find the Falcosecurity container images on the public AWS ECR gallery: falco falco-no-driver falco-driver-loader Let's meet 🀝 We meet every Wednesday in our community calls, if you want to know the latest and the greatest you should join us there! If you have any questions Join the #falco channel on the Kubernetes Slack Join the Falco mailing list Thanks to all the amazing contributors! Enjoy 😎, Federico ## Blog: Introducing Falco Talon v0.1.0 DevFeed: [Blog: Introducing Falco Talon v0.1.0]() Original publisher: [Read original article]() Published: 2024-09-09T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Kubernetes clusters](), [No-code](), [function as a service](), [Security]() Tags: [blog](), [faas](), [falco](), [kubernetes](), [kubernetes-clusters](), [no-code](), [release](), [security](), [talon](), [version]() ### AI overview This release introduces Falco Talon v0.1.0, a response engine for managing threats in Kubernetes clusters. It is designed to let users define rules and react to Falco events without building and maintaining custom FaaS-based response systems. ### Source excerpt More than 7 years ago, frustrated by the lack of integrations between Falco and third parties, I created Falcosidekick. The tool evolved much more than expected, with the help of dozens of contributors, individuals or for companies, to have now almost 70 different integrations, and more are coming. Its baby brother came few years later, Falcosidekick UI, helping people to visualize in real time the alerts leveraged by Falco and fine tuning their rules. A frustation remained after all. With Falco, we have an amazing tool to detect suspicious events in our Linux hosts, VM and Kubernetes clusters, with Falcosidekick, we can easily notify our Dev/Secops, index the alerts in some SIEM, etc. But a last piece was missing: how to react to these events? With the integrations of well known FaaS in Falcosidekick, we started a series of blog posts to show how to create from scratch what we call a "response engine". All these systems are modular, flexible, robust, but they all require a considerable amount of work from the user, to deal with the Falco payload format, the errors, the retries, the authentication to the API (AWS, Kubernetes Control Plane), the logs, the metrics, etc. Not all users and companies have the skills and/or the budget to maintain such an architecture. To answer these needs, we designed and created Falco Talon. The the first version is officially out!. What is Falco Talon? Falco Talon is a Response Engine for managing threats in Kubernetes clusters. It enhances the solutions proposed by the Falco community with a no-code tailor-made solution. With easy rules, you can react to events from Falco in milliseconds. Why did we created Falco Talon? Over the years, the Falco community proposed different methods to react to the Falco Events, what we call a response engine. All these methods rely on a 3rd party FaaS (Function as a Service) and come with drawbacks, all actions must be developped by the users to manage: The errors The Falco event format The authentica ## Blog: Halfway Through GSoC 2024: My Progress and Plans with Falco DevFeed: [Blog: Halfway Through GSoC 2024: My Progress and Plans with Falco]() Original publisher: [Read original article]() Published: 2024-07-24T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [benchmarking](), [Testing](), [ci]() Tags: [benchmarking](), [container](), [continuous-integration](), [falco](), [gsoc](), [mentorship](), [midterm](), [testing](), [yaml]() ### AI overview A GSoC 2024 mentee describes progress improving Falco's event-generator for testing and benchmarking. The project includes declarative YAML-based Falco rule testing, a container runner, and planned CI pipelines to assess threat-detection correctness and performance. ### Source excerpt Hello Falco community, I'm Kiriti, a current GSoC mentee under Falco Security. I have been working diligently to improve the testing and benchmarking capabilities of Falco's event-generator project. Now that we've reached the midterm of GSoC, I'm eager to share the journey so far. In this blog, I'll delve into the details of my contributions, particularly focusing on two key PRs that have been merged, and outline my plans for the remainder of the program. My Project: Enhancing Falco's Event-Generator The event-generator is a vital utility within the Falco ecosystem, designed to test Falco's detection capabilities. My Google Summer of Code project focuses on upgrading the event-generator to enhance its testing and benchmarking capabilities, reliability, and consistency. Additionally, I am developing new Continuous Integration (CI) pipelines based on the upgraded event-generator. The ultimate goal is to evolve the event-generator into the standard tool for systematically assessing the correctness and performance of Falco's threat detection capabilities during every release and development cycle. My Journey So Far: Before being selected for GSoC, I contributed to the event-generator repository. I am grateful to Leonardo Grasso and Federico Di Pierro, who played a vital role in getting my PRs merged during the pre-GSoC contribution phase. These contributions helped me understand the event-generator codebase. I am also thankful to my mentors, Jason Dellaluce and Aldo Lacuku, for selecting me as a GSoC mentee. I will share my complete story of getting selected to GSoC in future. After my selection, Jason, Aldo, and I collectively designed a plan to enhance the event-generator. The community bonding period was crucial in designing and understanding the implementation plan. You can view our idea here, which we will implement during this GSoC period. Once the coding period began, we managed to merge two key PRs before the midterm. These PRs partially added support for testin ## Blog: Falcosidekick 2.29.0 DevFeed: [Blog: Falcosidekick 2.29.0]() Original publisher: [Read original article]() Published: 2024-07-02T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [releases](), [Falco](), [Security](), [observability](), [Traces](), [dynatrace]() Tags: [apm](), [falco](), [falcosidekick](), [observability](), [release](), [releases](), [security](), [traces]() ### AI overview Falcosidekick 2.29.0 introduces new outputs and features after nearly a year without a release. The release adds integrations with Dynatrace, Sumo Logic, OTLP traces, Quickwit, and Falco Talon, and updates the Kubernetes Policy Report output. OTLP trace export works only for syscall-related events. ### Source excerpt Almost 1 year without a release of Falcosidekick, but version 2.29.0 is finally here. Thanks to all contributors for their patience, you made amazing contributions and we're happy to finally have them available for all users. Like for every releases, a small recap about its adoption. Falcosidekick continues to be adopted, even if the rate is not as high as before, but we're sure it will explode once again with this new fresh version. Once more, Falcosidekick expands Falco's integrability with a lot of new outputs. That and the introduction of many new features has been possible thanks to the hard work of the community. You can find a comprehensive list of these in the changelog. New outputs More and more systems are integrated as outputs in Falcosidekick, more and more often directly by the companies themselves and not their end users. It shows Falco and Falcosidekick are seen as major components in the security fields, and trusted as de facto standards. Dynatrace Mario Kahlhofer, aka @blu3r4y, from Dynatrace, integrated the well known observability and security platform he works for. You can even read his blog post about, to discover how to correlate the Falco events with their APM agent events. Sumologic Carlo Mencarelli, aka @mencarellic, did the exporter of the Falco events to Sumologic, the SaaS platform for your logs. OTLP Traces It started as an internal hackaton at Grafana Labs and became a real integration thanks to JuanJo Ciarlante (@jjo). You can now export the Falco event as traces, to have an automatic correlation between the detected events. [!WARNING] It works only for the syscall related events. Quickwit After a demo of Falco at a CNCF Meetup, the Quickwit team wanted to add their product as a new output for Falcosidekick, and they did it. You can now easily index your Falco events in their search engine thanks to the work of Idriss Neumann (@idrissneumann). Falco Talon New born in the Falco ecosystem, trying to complete the last missing piece: the r ## Blog: Introducing Falco 0.38.1 DevFeed: [Blog: Introducing Falco 0.38.1]() Original publisher: [Read original article]() Published: 2024-06-19T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [API](), [Docker](), [Linux]() Tags: [announce](), [blog](), [bugs](), [docker](), [falco](), [linux](), [metric](), [plugin](), [release]() ### AI overview Falco 0.38.1 is a patch release that fixes crashes, startup issues involving plugin events and audit-enabled Kubernetes clusters, rule comparison operators, NSS user and group loading, and metric-related plugin API issues. The release also bumps the Plugin API to 3.6.0, enables plugin metrics, and updates libs to 0.17.2. ### Source excerpt Today we announce the release of Falco 0.38.1 πŸ¦…! Fixes Falco's 0.38.1 is a patch release aimed at addressing a few important bugs. It includes the following fixes: A Falco crash while running with plugins and metrics enabled has been solved (https://github.com/falcosecurity/falco/issues/3229) Falco -p output format option can now be passed to plugin events while -pc and -pk can only be used for syscall sources. Fixes an issue that could result in Falco exiting with LOAD_ERR_COMPILE_OUTPUT on startup with k8s clusters that had -pk and audit enabled (https://github.com/falcosecurity/falco/pull/3239) Fixed an issue that could prevent the integer compare operators <, <=, >, >= in rules from working properly (https://github.com/falcosecurity/falco/issues/3245) Ignore NSS user and group entries while loading users and groups (https://github.com/falcosecurity/libs/pull/1909) Issues related to the new metric-related plugins API (https://github.com/falcosecurity/libs/pull/1885). Plugin API was also bumped to 3.6.0. Plugin metrics are now enabled in Falco (https://github.com/falcosecurity/falco/pull/3228). Note that plugin must make use of the new metrics-related API to expose metrics. Libs were updated to 0.17.2 Thanks to everyone in the community for helping us in spotting these annoying bugs πŸ›! You make Falco successful πŸ¦…! Thanks as always to the Falco maintainers for their support and effort during the entire release process. Try it! 🏎 As usual, in case you just want to try out the stable Falco 0.38.1, you can install its packages following the process outlined in the docs: CentOS/Amazon Linux Debian/Ubuntu openSUSE Linux binary package Prefer to use a container image? No problem at all! 🐳 You can read more about running Falco with Docker in the docs. You can also find the Falcosecurity container images on the public AWS ECR gallery: falco falco-no-driver falco-driver-loader Let's meet 🀝 We meet every Wednesday in our community calls, if you want to know the latest and t ## Blog: Track the Bitcoin transactions with Falco DevFeed: [Blog: Track the Bitcoin transactions with Falco]() Original publisher: [Read original article]() Published: 2024-03-13T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Bitcoin](), [WebSocket](), [Blockchain](), [Monitoring]() Tags: [bitcoin](), [falco](), [helm](), [kubernetes](), [plugin](), [websocket]() ### AI overview This tutorial presents a Falco plugin that receives Bitcoin transactions from a public WebSocket stream and shows how to install it, configure its default rules, and monitor transaction events in real time. ### Source excerpt The number of plugins available for Falco continues to grow thanks to our wonderful community. Thank you all for your help! You can find the list of available plugins here. The vast majority of plugins developed allow Falco to ingest logs from different sources and raise alerts when suspicious elements are identified by its rules. In order to show that any event stream can be a source if you have the right plugin, and to have something fun to show users during my talks, I developed a Falco plugin to track Bitcoin transactions. How does it work? I discovered the site https://www.blockchain.com/ exposes a public flux, accessible via a websocket, by subscribing to it you can retrieve transactions carried out on the blockchain in real time. This is perfect for a Falco plugin as it allows you to test the ingestion of events via a websocket, and serve as a basis for other plugins. I am not going to describe the internal workings of the plugin here, nor how it was developed. If you are interested, you can look at the code here. Alternatively, read our documentation explaining how to create a plugin from A to Z: https://falco.org/docs/concepts/plugins/developers-guide/how-to-develop/. Default rules The plugin comes with its default set of rules, we will use them as a working example. You are free to play with it for your own needs, such as monitoring suspicious movements of your wallet. You can find the Falco rules file provided here. Installation of the plugin We will see the 3 classic ways to install the plugin: via sources with falcoctl in kubernetes via Helm Via sources The prerequisites are: Golang >= 1.19 make Falco >= 0.36 Git We will start by installing download the sources, build and install the plugin: git clone https://github.com/Issif/bitcoin-plugin.git cd bitcoin-plugin sudo make install We will create a falco.yaml file containing: plugins: - name: bitcoin library_path: /usr/share/falco/plugins/libbitcoin.so init_config: '' open_params: '' load_plugins: [bitcoi ## Blog: Falco Weekly 10 - 2024 DevFeed: [Blog: Falco Weekly 10 - 2024]() Original publisher: [Read original article]() Published: 2024-03-08T00:00:00Z Content type: news Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Kernel](), [API](), [CMake](), [Compiler](), [Testing]() Tags: [blog](), [bugfixes](), [falco](), [news](), [weekly]() ### AI overview Falco's weekly recap reports that the project graduated and reviews changes across its repositories, including the kmod configure system, a CRI API refactor, compiler sanitizer options, crash and file-descriptor fixes, new tests, and configuration and validation changes in Falco. ### Source excerpt What happened in Falco this week? First of all, you probably already heard it, Falco is now graduated! If you missed this important news, go ahead and give our graduation blog post a read! Let's go through the major changes that happened in various repositories under the falcosecurity organization during the last week. Libs We are approaching the 0.15.0 tag, therefore mostly bugfixes were merged, plus a great new feature and some refactors: The so-called "kmod configure system" was finally merged: https://github.com/falcosecurity/libs/pull/1452. This helps us to ensure that our kernel module builds even when some features get backported from more recent kernels (ie: when checking for kernel release version in the code is not enough). Kudos to Angelo Puglisi for shipping such a feature! Also, keep an eye for the very same thing for bpf too: https://github.com/falcosecurity/libs/pull/1729! Thanks to the kmod configure system, our kernel-testing matrix is now fully green for kmod! A big CRI API refactor finally landed: https://github.com/falcosecurity/libs/pull/1600 Proceeding with the journey around compiler sanitizers, we now have proper cmake options to enable ASAN and UBSAN: https://github.com/falcosecurity/libs/pull/1721 Fixed a crash when reading proclist from scap: https://github.com/falcosecurity/libs/pull/1726 Fixed some socketpair fds problems: https://github.com/falcosecurity/libs/pull/1733 Fixed and added some more tests: https://github.com/falcosecurity/libs/pull/1736, https://github.com/falcosecurity/libs/pull/1727 Falco Some small changes happened too, in Falco main repository: The proposal about features adoption and deprecation was merged: https://github.com/falcosecurity/falco/pull/2986! Added a new configuration key falco_libs.thread_table_size to customize max thread table size in libsinsp: https://github.com/falcosecurity/falco/pull/3071 Throw an error when an invalid macro/list name is used: https://github.com/falcosecurity/falco/pull/3116 Fixed u ## Blog: Falco Graduates within the CNCF! DevFeed: [Blog: Falco Graduates within the CNCF!]() Original publisher: [Read original article]() Published: 2024-02-29T00:00:00Z Content type: news Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security](), [Cloud](), [eBPF](), [GitHub]() Tags: [cloud](), [cncf](), [ebpf](), [falco](), [maintainers](), [pull-request](), [security]() ### AI overview Falco has become a CNCF Graduated Project, a milestone the article associates with the project's maturity and dependability. It describes Falco's holistic approach to runtime security in cloud-native environments, including data collection, enrichment, orchestrator integration, source correlation, and policy management. The article also outlines plans for stronger detections, richer signals, lower noise, broader data-source coverage, and easier production deployment. ### Source excerpt Today, the Falco project hit a big milestone: becoming a CNCF Graduated Project! Falco's graduation indicates the project's maturity and dependability, but most importantly, it is the culmination of a fantastic amount of work. The journey for Falco started in 2016 when the first commit was made. Today, Falco has become synonymous with "runtime security" due to its comprehensive approach to securing the highly complex and dynamic environments of the modern cloud era. "Falco approaches the security challenges associated with managing cloud native environments holistically," says Loris Degioanni, the project's founder. "Runtime security is more than eBPF-based data collection, it requires enrichment, orchestrator integration, correlation of different data sources, and a rich, well-maintained policy library. All of the things that Falco provides to its users." This holistic, runtime-centric approach to security is what makes Falco unique. It enables any organization to secure their infrastructure -- from scrappy startups to Fortune 500s. Since joining the CNCF, some of the largest enterprises in the world, including Amazon, Apple, IBM, and Red Hat, have contributed to Falco. The project also has a strong, rapidly growing community of adopters and has been downloaded over 100 million times! To the thousands of people who have helped Falco fly over the past years, thank you -- sincerely. Thank you to the Falco maintainers. Thank you to our CNCF Technical Oversight Committee sponsors, Emily Fox and Justin Cormack. Thank you to anyone who has ever raised an issue, submitted a pull request on GitHub, or just took part in our community. Thank you, also, to the thousands of organizations who have entrusted Falco with the security of your runtime environments. For us, Falco's Graduation represents a calling to continue to improve the project in a way that serves its users. We believe that runtime protection is vital to security, and that Falco is well positioned to power that sec [Next page]()