Falco Plugins

Extend Falco functionality using Plugins for Falco libraries/Falco daemon

The Falco libraries and Falco itself can be extended by using Plugins. Plugins are shared libraries that conform to a documented API and allow for:

  • Adding new event sources that can be evaluated using filtering expressions/Falco rules.
  • Adding the ability to define new fields that can extract information from events.

This section describes how plugins fit into the existing event processing pipeline and how to enable/configure plugins in Falco.


Last modified Dec 15, 2022: limit _index.md to intro content (7070ae8)