github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-10-21 19:44:57 +00:00
Code Issues Projects Releases Wiki Activity
2,634 Commits 123 Branches 176 Tags
676fc9efa820c722176fe22bab032c447601714a
Commit Graph

50 Commits

Author SHA1 Message Date
Josh Soref
676fc9efa8 spelling: between 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
72725a7f87 spelling: archiving 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Leo Di Donato
3414ca5361 update(proposal): clarify that old drivers are not removed anymore 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-09-29 16:51:25 +02:00
Loris Degioanni
5e027c7fe2 Proposal for a libs plugin system 
Description of changes to falcosecurity/libs and /falco to support
plugins to provide events and extract fields from events.

Signed-off-by: Loris Degioanni <loris@sysdig.com>
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Co-authored-by: Mark Stemm <mark.stemm@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2021-08-24 17:52:19 +02:00
Leonardo Di Donato
24f64cab33 docs(proposals): fix libs contribution name 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-05-17 16:24:53 +02:00
Leonardo Di Donato
19fe7240e2 new(proposals): libraries donation 
Donate:
- libsinsp
- libscap
- the kernel module driver
- the eBPF driver sources

by moving them to the Falco project.

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2021-02-04 17:29:42 +01:00
Leonardo Grasso
581d67fa08 docs(proposals/20200828-structured-exception-handling): indentation 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-01-08 17:53:08 +01:00
Leonardo Grasso
b7bda6d892 docs(proposals/20200828-structured-exception-handling): highlight syntax 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
5eec26976d Add notes on single-field exceptions 
If an exception item has a single value for fields, all the values are
combined together into a single set to build an expression field
cmp (val1, val2, ...)

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
1916314583 Use well-defined object keys 
Instead of oveloading the exception item name as the key of the object,
just have a flat array of object with a name property.

A bit more verbose, but makes it easier to understand what the schema is.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
8831c7f3c7 Add notion of exception operators 
A rule exception can now have a comps property that allows fields to be
matched against items using an operator of =. If not defined, equality
is implied.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
2cebe052a1 Address feedback 
- Clean up npm examples so they are valid.
- Small punctuation changes.
- Emphasize that the strings related to field values are arbitrary.
- Emphasize that exceptions only use equality matching.
- Emphasize that you'll need to upgrade falco to use these new features.
- Capitalize Falco everywhere.
- Change language related to backwards compatibility.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Mark Stemm
05282f3976 Proposal on better exception handling 
This proposes adding exceptions as a first class object to falco rules
files.

It adds a new key "exceptions" to rule objects that allows a rule
writer to define tuples of field names that comprise an exception, and a
new top level object "exception" that contains lists of tuples of field
values that define exceptions to rules.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-08 17:53:08 +01:00
Leonardo Di Donato
a575625043 docs(proposals): new drivers storage obsolate part of existing artifacts storage proposals 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-10-28 14:11:39 +01:00
Lorenzo Fontana
61bfd5a158 update(proposals): proposal for moving the drivers to S3 
Reviewed-by: Spencer Krum <nibz@spencerkrum.com>
Reviewed-by: Leonardo Grasso <me@leonardograsso.com>
Reviewed-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-10-26 14:07:31 +01:00
Leo Di Donato
d25e07381e update(proposals): clarify that prebuilding drivers is on a best-effort basis 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
481eedb80e update(proposals): artifacts cleanup (prebuilt drivers part) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
f077f2887f new(proposals): artifacts cleanup (packages part) 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
d80ffeae5b update(proposals): artifacts storage proposal 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
2d24df1ce2 new(proposals): initial document about SoA of artifacts storage 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-09-07 11:39:54 +02:00
Leonardo Di Donato
b88767f558 bc(userspace/falco): the Falco gRPC Outputs API are now "falco.outputs.service/get" and "falco.outputs.service/sub" 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-06-29 20:42:50 +02:00
Leonardo Di Donato
4e2f3e2c71 update(proposals): keep Falco gRPC Outputs proposal in sync 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-06-29 20:42:50 +02:00
Leonardo Grasso
a520a9b666 update(proposals/20200506-artifacts-scope-part-2.md): resolution about image naming 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
9393ae9e03 fix(proposals/20200506-artifacts-scope): typos 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
fcd2849a5d update(proposals/20200506-artifacts-scope): refinements 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

As per https://github.com/falcosecurity/falco/pull/1184/files#r420856406
 2020-05-12 18:53:46 +02:00
Leo Di Donato
c7573c3db9 update(proposals/20200506-artifacts-scope-part-2): refinements to the future SoA of Falco artifacts and images 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-12 18:53:46 +02:00
Leo Di Donato
737ef557ae update(proposals/20200506-artifacts-scope-part-1): improvements to SoA of Falco artifacts and images 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>

Co-authored-by: Lorenzo Fontana <lo@linux.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
078c98f847 docs(proposal): split artifacts scope proposal in 2 parts 
Still some TODOs

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
63eafd2ff8 docs(proposals/20200504-falco-artifacts-scope.md): update from review 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Leonardo Grasso
69714a8124 fix(proposals/20200504-falco-artifacts-scope.md): minor fixes 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 18:53:46 +02:00
Kris Nova
b6bbc27e57 feat(docs): "Official Support" is the highest and most coveted status. 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-05-12 18:53:46 +02:00
Kris Nova
df3fc73e55 feat(docs): Updating proposal with new vernacular 
Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-05-12 18:53:46 +02:00
Kris Nova
b9bf985fae feat(proposal): Adding artifacts scope and proposal 
- Highlights scope of Falco
 - Highlights subprojects and groups evolution
 - Defines build artifacts
 - Defines artifact naming convention
 - Dictates that we take action to make these changes happen

Signed-off-by: Kris Nova <kris@nivenly.com>
 2020-05-12 18:53:46 +02:00
toc-me[bot]
373d2bfd89 Update ToC for proposals/20191217-rules-naming-convention.md 
Signed-off-by: kaizhe <derek0405@gmail.com>

address comments

Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-01-07 14:58:12 +01:00
Kaizhe Huang
4065af25c1 Update proposals/20191217-rules-naming-convention.md 
Co-Authored-By: Leo Di Donato <leodidonato@gmail.com>

Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-01-07 14:58:12 +01:00
kaizhe
cc1892177a falco rule naming convention 
Signed-off-by: kaizhe <derek0405@gmail.com>
 2020-01-07 14:58:12 +01:00
Leonardo Di Donato
7159b43f68 update(proposals): goals, non-goals and use cases of the Falco API 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-12-09 16:46:16 +01:00
Leonardo Di Donato
b684aee817 update(proposals): better summary for Falco API 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-12-09 16:46:16 +01:00
Leonardo Di Donato
ae52dc4d3b proposals: complete the Falco API proposal 
Co-Authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-12-09 16:46:16 +01:00
Leo Di Donato
a64f7faa3c fix(proposals): typos and language 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>

Co-Authored-By: Lorenzo Fontana <lo@linux.com>
 2019-12-09 16:46:16 +01:00
Leonardo Di Donato
ced04a4d89 update: goals and (initial) architecture for API services 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-12-09 16:46:16 +01:00
Leonardo Di Donato
2b75ca9024 new: setup Falco API proposal 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-12-09 16:46:16 +01:00
Leo Di Donato
6019320f9d chore(proposals): apply code review about PSP rules proposal 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-10-14 13:59:15 +02:00
Mark Stemm
161b46474d Proposal for adding PSP Rules Support 
Separate from the PR that actually makes the changes.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2019-10-14 13:59:15 +02:00
toc-me[bot]
6f18b0de74 update(proposals): ToC for proposals/20190826-grpc-outputs.md 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 14:37:46 +03:00
Leonardo Di Donato
47ab5bf39d update(proposals): address review comments and suggestions 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 14:37:46 +03:00
Leonardo Di Donato
510d215558 docs(proposals): grpc output design details 
Co-Authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 14:37:46 +03:00
Leonardo Di Donato
734d48204d docs(proposals): design details for the gRPC output 
Co-Authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 14:37:46 +03:00
Leonardo Di Donato
1ad75ad653 docs(proposals): proto3 definitions for grpc output proposal 
Co-Authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 14:37:46 +03:00
Leonardo Di Donato
1ee769a76c docs(proposals): gRPC outputs goals/non-goals 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2019-09-25 14:37:46 +03:00