mirror of
https://github.com/falcosecurity/falco.git
synced 2025-07-16 15:51:55 +00:00
cleanup(docs): adjust readme
Co-authored-by: Leonardo Grasso <me@leonardograsso.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Melissa Kilby
poiana
parent
18345b1a1a
commit
4338a8adec
42
README.md
42
README.md
@ -45,42 +45,42 @@ Notes:
|
||||
|
||||
-->
|
||||
|
||||
| | development | stable |
|
||||
|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| rpm-x86_64 | [][1] | [][2] |
|
||||
| deb-x86_64 | [][3] | [][4] |
|
||||
| binary-x86_64 | [][5] | [][6] |
|
||||
| rpm-aarch64 | [][1] | [][2] |
|
||||
| deb-aarch64 | [][3] | [][4] |
|
||||
| binary-aarch64 | [][7] | [][8] |
|
||||
| | stable |
|
||||
|--------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| rpm-x86_64 | [][2] |
|
||||
| deb-x86_64 | [][4] |
|
||||
| binary-x86_64 | [][6] |
|
||||
| rpm-aarch64 | [][2] |
|
||||
| deb-aarch64 | [][4] |
|
||||
| binary-aarch64 | [][8] |
|
||||
|
||||
For comprehensive information on the latest updates and changes to the project, please refer to the [change log](CHANGELOG.md). Additionally, we have documented the [release process](RELEASE.md) for delivering new versions of Falco.
|
||||
|
||||
## Introduction to Falco
|
||||
|
||||
The [Falco Project](https://falco.org/), originally created by [Sysdig](https://sysdig.com), is an incubating project under the [CNCF](https://cncf.io).
|
||||
[Falco](https://falco.org/), originally created by [Sysdig](https://sysdig.com), is an incubating project under the [CNCF](https://cncf.io).
|
||||
|
||||
Falco is a cloud-native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time.
|
||||
Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time.
|
||||
|
||||
At its core, Falco is a kernel event monitoring and detection agent that captures events, such as syscalls, based on custom rules. These events can be analyzed off-host in a SIEM or data lake. The [Falco ecosystem](https://github.com/falcosecurity/evolution/) is continuously evolving, aiming to enhance its functionality and interoperability by integrating with CNCF cloud native components. For detailed technical information and insights into the cyber threats that Falco can detect, visit the official [Falco Project](https://falco.org/) website.
|
||||
At its core, Falco is a kernel event monitoring and detection agent that captures events, such as syscalls, based on custom rules. Falco can enhance these events by integrating metadata from the container runtime and Kubernetes. The collected events can be analyzed off-host in SIEM or data lake systems.
|
||||
|
||||
For detailed technical information and insights into the cyber threats that Falco can detect, visit the official [Falco](https://falco.org/) website.
|
||||
|
||||
|
||||
## Falco Repo: Powering the Core of the Falco Project
|
||||
## Falco Repo: Powering the Core of The Falco Project
|
||||
|
||||
This repo acts as the core of Falco, containing the source code for building the Falco binary. By utilizing its [libraries](https://github.com/falcosecurity/libs) and the [falco.yaml](falco.yaml) configuration file, this repository forms the foundation of Falco's functionality. The Falco repository is closely interconnected with the following repositories within the Falco ecosystem:
|
||||
This is the main Falco repository which contains the source code for building the Falco binary. By utilizing its [libraries](https://github.com/falcosecurity/libs) and the [falco.yaml](falco.yaml) configuration file, this repository forms the foundation of Falco's functionality. The Falco repository is closely interconnected with the following *core* repositories:
|
||||
|
||||
- [falcosecurity/libs](https://github.com/falcosecurity/libs): Falco's libraries are key to its core operations, accounting for over 80% of the source code and supporting essential features such as the kernel drivers.
|
||||
- [falcosecurity/libs](https://github.com/falcosecurity/libs): Falco's libraries are key to its fundamental operations, making up the greater portion of the source code of the Falco binary and providing essential features such as kernel drivers.
|
||||
- [falcosecurity/rules](https://github.com/falcosecurity/rules): Contains the official ruleset for Falco, providing pre-defined detection rules for various security threats and abnormal behaviors.
|
||||
- [falcosecurity/plugins](https://github.com/falcosecurity/plugins/): Falco plugins facilitate integration with external services, expand Falco's capabilities beyond syscalls and container events, and are designed to evolve with specialized functionality in future releases.
|
||||
- [falcosecurity/falcoctl](https://github.com/falcosecurity/falcoctl): Command-line utility for managing and interacting with Falco.
|
||||
- [falcosecurity/falcosidekick](https://github.com/falcosecurity/falcosidekick): Companion tool that offers multiple output options for Falco.
|
||||
- [falcosecurity/driverkit](https://github.com/falcosecurity/driverkit): Command line tool to build the Falco kernel module and eBPF probe.
|
||||
|
||||
For more information, visit the official hub of the Falco ecosystem: [falcosecurity/evolution](https://github.com/falcosecurity/evolution). It provides valuable insights and information about the project's repositories.
|
||||
For more information, visit the official hub of The Falco Project: [falcosecurity/evolution](https://github.com/falcosecurity/evolution). It provides valuable insights and information about the project's repositories.
|
||||
|
||||
## Getting Started with Falco
|
||||
|
||||
Carefully review and follow the [official guide and documentation](https://falco.org/docs/getting-started/). Integration timelines may vary based on your organization's needs, typically taking several weeks of ramp-up time.
|
||||
Carefully review and follow the [official guide and documentation](https://falco.org/docs/getting-started/).
|
||||
|
||||
Considerations and guidance for Falco adopters:
|
||||
|
||||
@ -88,11 +88,11 @@ Considerations and guidance for Falco adopters:
|
||||
|
||||
2. Define threat detection objectives: Clearly identify the threats you want to detect and evaluate Falco's strengths and limitations.
|
||||
|
||||
3. Consider performance and cost: Evaluate compute performance overhead and align with system administrators or SREs. Budget accordingly.
|
||||
3. Consider performance and cost: Assess compute performance overhead and align with system administrators or SREs. Budget accordingly.
|
||||
|
||||
4. Choose build and customization approach: Decide between the open-source Falco build or creating a custom build pipeline. Customize the build and deployment process as necessary, including incorporating unique tests or approaches, to ensure a resilient deployment with fast deployment cycles.
|
||||
4. Choose build and customization approach: Decide between the open source Falco build or creating a custom build pipeline. Customize the build and deployment process as necessary, including incorporating unique tests or approaches, to ensure a resilient deployment with fast deployment cycles.
|
||||
|
||||
5. Integrate with output destinations: Integrate Falco with SIEM, data lakes, or other preferred output destinations to establish a robust foundation for comprehensive data analysis and enable effective incident response workflows.
|
||||
5. Integrate with output destinations: Integrate Falco with SIEM, data lake systems, or other preferred output destinations to establish a robust foundation for comprehensive data analysis and enable effective incident response workflows.
|
||||
|
||||
|
||||
## How to Contribute
|
||||
|
||||
Loading…
Reference in New Issue
Block a user