Registered Plugins

List of officially registered plugins

You can find below the officially registered plugins, more details on

IDPluginTypeSourceDescriptionAuthorsURLRules URLLicence
1k8sauditsourcingk8s_auditRead Kubernetes Audit Events and monitor Kubernetes ClustersThe Falco Authors🔗🔗Apache-2.0
2cloudtrailsourcingaws_cloudtrailReads Cloudtrail JSON logs from files/S3 and injects as eventsThe Falco Authors🔗🔗Apache-2.0
jsonextractionExtract values from any JSON payloadThe Falco Authors🔗Apache-2.0
3dummysourcingdummyReference plugin used to document interfaceThe Falco Authors🔗Apache-2.0
4dummy_csourcingdummy_cLike dummy, but written in C++The Falco Authors🔗Apache-2.0
5dockersourcingdockerDocker EventsThomas Labarussias🔗🔗Apache-2.0
6seccompagentsourcingseccompagentSeccomp Agent EventsAlban Crequy🔗Apache-2.0
7oktasourcingoktaOkta Log EventsThe Falco Authors🔗🔗Apache-2.0
8githubsourcinggithubGithub Webhook EventsThe Falco Authors🔗🔗Apache-2.0
9k8saudit-ekssourcingk8s_auditRead Kubernetes Audit Events from AWS EKS ClustersThe Falco Authors🔗Apache-2.0
10nomadsourcingnomadRead Hashicorp Nomad Events StreamAlberto Llamas🔗🔗Apache-2.0
999testsourcingtestThis ID is reserved for source plugin development. Any plugin author can use this ID, but authors can expect events from other developers with this ID. After development is complete, the author should request an actual ID