Monitoring your EKS clusters audit logs

This blog post is an update of a post of November 2022 At the beginning of the year 2022, Falco introduced a game changing feature, the Falco Plugins. They allow Falco to monitor and trigger alerts for any kind of event. Since the launch …

GitOps your Falco Rules

Falco rules management has been a discussed topic for quite a long time. When we start building and customizing rules for our environment, we need a simple way to effectively update and distribute them to our Falco fleet. Starting from …

Add prebuilt drivers for new distro

Hi everyone! Today we are going to learn how to add support for a new distro prebuilt drivers. There are multiple repositories involved with it, and while most of the time it should be a pretty simple job, other times it can become really …

Falco Community Survey 2023

TLDR; Falco users prefer deploying on AWS and adopting it for security threat detection, auditing and compliance, and sandbox testing. Security and DevOps teams are the most common users of Falco. The official Helm chart and official …

The 2023 Falco Security Audit

We are happy to announce that in early 2023 the Falco project completed a security audit sponsored by the CNCF, with support from the Open Source Technology Improvement Fund and conducted by the security experts at Quarkslab SAS. The audit …

Forward Falco events to AWS Security Lake

Last November at re:Invent (2022) AWS introduced the new security oriented data lake: Amazon Security Lake. The AWS team leading the development of the new service contacted the Falco community and proposed a collaboration to develop the …

Falcoctl: install and manage your rules and plugins

Since the launch of the plugin framework in January 2022, our adopters have requested an out-of-the-box solution to manage the lifecycle of rules (installation, updates). We heard your request and also created a guide to help you smoothly …

Falco 0.34.1

Today we announce the release of Falco 0.34.1 🦅! Novelties 🆕 and Fixes Here's a minor update! This patch release addresses small but persistent issues that have been causing inconvenience for users: http_output not working as expected when …

Rule basics for the Falco 3.0.0 Helm chart

The new Falco Helm chart 3.0.0 (full documentation, upgrade information) comes with a new way to automatically update the Falco rules that are currently loaded. Of course, you can enable, disable and configure this functionality to your …