fix(userspace/falco): respect buffered_outputs YAML config value

The buffered_outputs config option was silently overridden to true by an unconditional assignment in load_config.cpp. The -U CLI flag now only overrides the config when explicitly passed.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

.github/workflows/bump-libs.yaml

@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: '30 6 * * 1' # on each monday 6:30
 
+permissions:
+  contents: read
+
 # Checks if any concurrent jobs is running for kernels CI and eventually cancel it.
 concurrency:
   group: bump-libs-ci

.github/workflows/ci.yml

@@ -27,6 +27,7 @@ jobs:
       version: ${{ needs.fetch-version.outputs.version }}
       enable_debug: true
       enable_sanitizers: true
+      use_mimalloc: true
 
   build-dev-packages-arm64:
     needs: [fetch-version]
@@ -35,6 +36,7 @@ jobs:
       arch: aarch64
       version: ${{ needs.fetch-version.outputs.version }}
       enable_debug: true
+      use_mimalloc: true
 
   test-dev-packages:
     needs: [fetch-version, build-dev-packages-x86_64]

.github/workflows/codeql.yaml

@@ -59,11 +59,11 @@ jobs:
       run: sudo apt update -y
 
     - name: Install build dependencies
-      run: sudo DEBIAN_FRONTEND=noninteractive apt install libssl-dev libc-ares-dev libprotobuf-dev protobuf-compiler libyaml-cpp-dev libgrpc++-dev protobuf-compiler-grpc rpm libelf-dev cmake build-essential libcurl4-openssl-dev linux-headers-$(uname -r) clang llvm git -y
+      run: sudo DEBIAN_FRONTEND=noninteractive apt install libssl-dev libc-ares-dev libyaml-cpp-dev rpm libelf-dev cmake build-essential libcurl4-openssl-dev linux-headers-$(uname -r) clang llvm git -y
 
     - name: Prepare project
       run: |
-          cmake -B build -S . -DBUILD_BPF=On -DBUILD_FALCO_MODERN_BPF=Off -DUSE_BUNDLED_DEPS=Off -DUSE_BUNDLED_NLOHMANN_JSON=On -DUSE_BUNDLED_CXXOPTS=On -DUSE_BUNDLED_CPPHTTPLIB=On
+          cmake -B build -S . -DBUILD_FALCO_MODERN_BPF=Off -DUSE_BUNDLED_DEPS=Off -DUSE_BUNDLED_NLOHMANN_JSON=On -DUSE_BUNDLED_CXXOPTS=On -DUSE_BUNDLED_CPPHTTPLIB=On
 
     - name: Build
       run: |

.github/workflows/format.yaml

@@ -6,6 +6,9 @@ on:
       - master
       - "release/**"
 
+permissions:
+  contents: read
+
 jobs:
   format:
     name: format code 🐲

.github/workflows/master.yaml

@@ -3,6 +3,9 @@ on:
   push:
     branches: [master]
 
+permissions:
+  contents: read
+
 # Checks if any concurrent jobs is running for master CI and eventually cancel it
 concurrency:
   group: ci-master

.github/workflows/release.yaml

@@ -3,6 +3,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 # Checks if any concurrent jobs is running for release CI and eventually cancel it.
 concurrency:
   group: ci-release
@@ -56,6 +59,7 @@ jobs:
     with:
       arch: x86_64
       version: ${{ github.event.release.tag_name }}
+      use_jemalloc: true
     secrets: inherit
 
   build-packages-arm64:
@@ -64,6 +68,7 @@ jobs:
     with:
       arch: aarch64
       version: ${{ github.event.release.tag_name }}
+      use_jemalloc: true
     secrets: inherit
 
   test-packages:

.github/workflows/reusable_build_dev.yaml

@@ -57,7 +57,7 @@ jobs:
 
       - name: Install build dependencies (non-minimal)
         if: inputs.minimal != true
-        run: sudo DEBIAN_FRONTEND=noninteractive apt install libssl-dev libc-ares-dev libprotobuf-dev protobuf-compiler libgrpc++-dev protobuf-compiler-grpc rpm libcurl4-openssl-dev linux-headers-$(uname -r) clang llvm -y
+        run: sudo DEBIAN_FRONTEND=noninteractive apt install libssl-dev libc-ares-dev rpm libcurl4-openssl-dev linux-headers-$(uname -r) clang llvm -y
 
       - name: Prepare project
         run: |
@@ -65,7 +65,6 @@ jobs:
             -DBUILD_FALCO_UNIT_TESTS=On \
             -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} \
             -DBUILD_FALCO_MODERN_BPF=Off \
-            -DBUILD_BPF=${{ inputs.minimal == true && 'OFF' || 'ON' }} \
             -DBUILD_DRIVER=${{ inputs.minimal == true && 'OFF' || 'ON' }} \
             -DMINIMAL_BUILD=${{ inputs.minimal == true && 'ON' || 'OFF' }} \
             -DUSE_ASAN=${{ inputs.sanitizers == true && 'ON' || 'OFF' }} \

.github/workflows/reusable_build_docker.yaml

@@ -46,6 +46,7 @@ jobs:
           docker build -f docker/falco/Dockerfile -t docker.io/falcosecurity/falco:${{ inputs.arch }}-${{ inputs.tag }} \
             --build-arg VERSION_BUCKET=bin${{ inputs.bucket_suffix }} \
             --build-arg FALCO_VERSION=${{ inputs.version }} \
+            --build-arg FALCO_COMMIT_SHA=${{ github.sha }} \
             --build-arg TARGETARCH=${TARGETARCH} \
             .
             docker save docker.io/falcosecurity/falco:${{ inputs.arch }}-${{ inputs.tag }} --output /tmp/falco-${{ inputs.arch }}.tar
@@ -55,6 +56,7 @@ jobs:
           docker build -f docker/falco-debian/Dockerfile -t docker.io/falcosecurity/falco:${{ inputs.arch }}-${{ inputs.tag }}-debian \
             --build-arg VERSION_BUCKET=deb${{ inputs.bucket_suffix }} \
             --build-arg FALCO_VERSION=${{ inputs.version }} \
+            --build-arg FALCO_COMMIT_SHA=${{ github.sha }} \
             --build-arg TARGETARCH=${TARGETARCH} \
             .
             docker save docker.io/falcosecurity/falco:${{ inputs.arch }}-${{ inputs.tag }}-debian --output /tmp/falco-${{ inputs.arch }}-debian.tar
@@ -63,6 +65,8 @@ jobs:
         run: |
           docker build -f docker/driver-loader/Dockerfile -t docker.io/falcosecurity/falco-driver-loader:${{ inputs.arch }}-${{ inputs.tag }} \
             --build-arg FALCO_IMAGE_TAG=${{ inputs.arch }}-${{ inputs.tag }} \
+            --build-arg FALCO_VERSION=${{ inputs.version }} \
+            --build-arg FALCO_COMMIT_SHA=${{ github.sha }} \
             --build-arg TARGETARCH=${TARGETARCH} \
             .
             docker save docker.io/falcosecurity/falco-driver-loader:${{ inputs.arch }}-${{ inputs.tag }} --output /tmp/falco-driver-loader-${{ inputs.arch }}.tar
@@ -72,6 +76,7 @@ jobs:
           docker build -f docker/driver-loader-buster/Dockerfile -t docker.io/falcosecurity/falco-driver-loader:${{ inputs.arch }}-${{ inputs.tag }}-buster \
             --build-arg VERSION_BUCKET=deb${{ inputs.bucket_suffix }} \
             --build-arg FALCO_VERSION=${{ inputs.version }} \
+            --build-arg FALCO_COMMIT_SHA=${{ github.sha }} \
             --build-arg TARGETARCH=${TARGETARCH} \
             .
             docker save docker.io/falcosecurity/falco-driver-loader:${{ inputs.arch }}-${{ inputs.tag }}-buster --output /tmp/falco-driver-loader-${{ inputs.arch }}-buster.tar

.github/workflows/reusable_build_packages.yaml

@@ -20,8 +20,18 @@ on:
         required: false
         type: boolean
         default: false
+      use_jemalloc:
+        description: Use jemalloc memory allocator
+        required: false
+        type: boolean
+        default: false
+      use_mimalloc:
+        description: Use mimalloc memory allocator
+        required: false
+        type: boolean
+        default: false
 
-permissions:  
+permissions:
   contents: read
 
 jobs:
@@ -63,8 +73,8 @@ jobs:
 
       - name: Install systemd rpm macros
         run: |
-          wget https://www.rpmfind.net/linux/centos-stream/9-stream/BaseOS/${{ inputs.arch }}/os/Packages/systemd-rpm-macros-252-51.el9.noarch.rpm
-          sudo alien -d -i systemd-rpm-macros-252-51.el9.noarch.rpm
+          wget https://www.rpmfind.net/linux/centos-stream/9-stream/BaseOS/${{ inputs.arch }}/os/Packages/systemd-rpm-macros-252-59.el9.noarch.rpm
+          sudo alien -d -i systemd-rpm-macros-252-59.el9.noarch.rpm
 
       - name: Checkout
         uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
@@ -87,8 +97,8 @@ jobs:
               -DFALCO_ETC_DIR=/etc/falco \
               -DMODERN_BPF_SKEL_DIR=/tmp \
               -DBUILD_DRIVER=Off \
-              -DBUILD_BPF=Off \
-              -DUSE_JEMALLOC=ON \
+              -DUSE_JEMALLOC=${{ inputs.use_jemalloc }} \
+              -DUSE_MIMALLOC=${{ inputs.use_mimalloc }} \
               -DFALCO_VERSION=${{ inputs.version }}
 
       - name: Build project
@@ -159,8 +169,8 @@ jobs:
               -DFALCO_ETC_DIR=/etc/falco \
               -DMODERN_BPF_SKEL_DIR=/tmp \
               -DBUILD_DRIVER=Off \
-              -DBUILD_BPF=Off \
-              -DUSE_JEMALLOC=On \
+              -DUSE_JEMALLOC=${{ inputs.use_jemalloc }} \
+              -DUSE_MIMALLOC=${{ inputs.use_mimalloc }} \
               -DFALCO_VERSION=${{ inputs.version }}
 
       - name: Build project
@@ -207,8 +217,8 @@ jobs:
               -DFALCO_ETC_DIR=/etc/falco \
               -DMODERN_BPF_SKEL_DIR=/tmp \
               -DBUILD_DRIVER=Off \
-              -DBUILD_BPF=Off \
               -DUSE_JEMALLOC=Off \
+              -DUSE_MIMALLOC=Off \
               -DUSE_ASAN=On \
               -DFALCO_VERSION=${{ inputs.version }}
 
@@ -252,8 +262,9 @@ jobs:
           cmake -B build -S . \
                 -DCMAKE_BUILD_TYPE=Release \
                 -DCPACK_GENERATOR=TGZ \
-                -DBUILD_BPF=Off -DBUILD_DRIVER=Off \
-                -DUSE_JEMALLOC=On \
+                -DBUILD_DRIVER=Off \
+                -DUSE_JEMALLOC=${{ inputs.use_jemalloc }} \
+                -DUSE_MIMALLOC=${{ inputs.use_mimalloc }} \
                 -DUSE_BUNDLED_DEPS=On \
                 -DMUSL_OPTIMIZED_BUILD=On \
                 -DFALCO_ETC_DIR=/etc/falco \
@@ -339,6 +350,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install NSIS
+        run: choco install nsis -y
+
       # NOTE: Backslash doesn't work as line continuation on Windows.
       - name: Prepare project
         run: |

.github/workflows/reusable_publish_packages.yaml

@@ -82,11 +82,6 @@ jobs:
           GPG_KEY: ${{ secrets.GPG_KEY }}
         run: printenv GPG_KEY | gpg --import -
 
-      - name: Sign rpms
-        run: |
-          rpmsign --define '_gpg_name Falcosecurity Package Signing' --addsign /tmp/falco-build-rpm/falco-*.rpm
-          rpm -qp --qf '%|DSAHEADER?{%{DSAHEADER:pgpsig}}:{%|RSAHEADER?{%{RSAHEADER:pgpsig}}:{(none)}|}|\n' /tmp/falco-build-rpm/falco-*.rpm
-
       - name: Publish wasm
         run: |
           ./scripts/publish-wasm -f /tmp/falco-wasm/falco-${{ inputs.version }}-wasm.tar.gz

.github/workflows/staticanalysis.yaml

@@ -24,7 +24,7 @@ jobs:
         run: |
           cmake -B build -S . \
                 -DCMAKE_BUILD_TYPE="release" \
-                -DUSE_BUNDLED_DEPS=On -DUSE_DYNAMIC_LIBELF=Off -DBUILD_WARNINGS_AS_ERRORS=ON -DCREATE_TEST_TARGETS=Off -DBUILD_BPF=Off -DBUILD_DRIVER=Off
+                -DUSE_BUNDLED_DEPS=On -DUSE_DYNAMIC_LIBELF=Off -DBUILD_WARNINGS_AS_ERRORS=ON -DCREATE_TEST_TARGETS=Off -DBUILD_DRIVER=Off
           cmake --build build -j4 --target cppcheck
           cmake --build build -j4 --target cppcheck_htmlreport
 

CHANGELOG.md

@@ -1,5 +1,289 @@
 # Change Log
 
+## v0.43.0
+
+Released on 2026-01-28
+
+### Breaking Changes :warning:
+
+* fix(userspace)!: show source config path only in debug builds [[#3787](https://github.com/falcosecurity/falco/pull/3787)] - [@leogr](https://github.com/leogr)
+
+
+
+### Minor Changes
+
+* chore(userspace): deprecate `--gvisor-generate-config` CLI option [[#3784](https://github.com/falcosecurity/falco/pull/3784)] - [@ekoops](https://github.com/ekoops)
+* docs: add deprecation notice for legacy eBPF in pkg install dialog [[#3786](https://github.com/falcosecurity/falco/pull/3786)] - [@ekoops](https://github.com/ekoops)
+* chore: [NOTICE] The GPG key used to sign DEB/RPM packages has been rotated, and all existing packages have been re-signed. New key fingerprint: `478B2FBBC75F4237B731DA4365106822B35B1B1F` [[#3753](https://github.com/falcosecurity/falco/pull/3753)] - [@leogr](https://github.com/leogr)
+* chore(scripts/falcoctl): increase follow interval to 1 week [[#3757](https://github.com/falcosecurity/falco/pull/3757)] - [@leogr](https://github.com/leogr)
+* docs: add deprecation notice for legacy eBPF, gVisor and gRPC usage [[#3763](https://github.com/falcosecurity/falco/pull/3763)] - [@ekoops](https://github.com/ekoops)
+* chore(userspace): deprecate legacy eBPF probe, gVisor engine and gRPC [[#3763](https://github.com/falcosecurity/falco/pull/3763)] - [@ekoops](https://github.com/ekoops)
+* chore(engine): emit warning when the deprecated `evt.latency` field family is used in a rule condition or output [[#3744](https://github.com/falcosecurity/falco/pull/3744)] - [@irozzo-1A](https://github.com/irozzo-1A)
+
+
+### Bug Fixes
+
+* fix: prevent null pointer crash on `popen()` failure in output_program [[#3722](https://github.com/falcosecurity/falco/pull/3722)] - [@vietcgi](https://github.com/vietcgi)
+* fix: correct falcoctl.yaml path in debian conffiles [[#3745](https://github.com/falcosecurity/falco/pull/3745)] - [@leogr](https://github.com/leogr)
+
+
+
+### Non user-facing changes
+
+* chore(cmake): bump falcoctl dependency version to `0.12.2` [[#3790](https://github.com/falcosecurity/falco/pull/3790)] - [@ekoops](https://github.com/ekoops)
+* chore(cmake): bump falcoctl dependency version to `0.12.1` [[#3777](https://github.com/falcosecurity/falco/pull/3777)] - [@ekoops](https://github.com/ekoops)
+* chore(cmake): bump container plugin version to `0.6.1` [[#3780](https://github.com/falcosecurity/falco/pull/3780)] - [@ekoops](https://github.com/ekoops)
+* fix(userspace/engine): missing closing quote in deprecated field warning [[#3779](https://github.com/falcosecurity/falco/pull/3779)] - [@leogr](https://github.com/leogr)
+* chore(.github): Put back gpg key rotation workflow [[#3772](https://github.com/falcosecurity/falco/pull/3772)] - [@irozzo-1A](https://github.com/irozzo-1A)
+* chore(cmake): bump libs/drivers to `0.23.1`/`9.1.0+driver` [[#3769](https://github.com/falcosecurity/falco/pull/3769)] - [@ekoops](https://github.com/ekoops)
+* revert: chore(.github): temporary action for GPG key rotation [[#3766](https://github.com/falcosecurity/falco/pull/3766)] - [@leogr](https://github.com/leogr)
+* chore(cmake): bump container plugin version to 0.6.0 [[#3768](https://github.com/falcosecurity/falco/pull/3768)] - [@irozzo-1A](https://github.com/irozzo-1A)
+* docs(proposals): add proposal for legacy probe, gVisor engine and gRPC output deprecation [[#3755](https://github.com/falcosecurity/falco/pull/3755)] - [@ekoops](https://github.com/ekoops)
+* chore(cmake): bump libs/drivers to `0.23.0`/`9.1.0+driver` [[#3760](https://github.com/falcosecurity/falco/pull/3760)] - [@ekoops](https://github.com/ekoops)
+* update(cmake): update libs and driver to latest master [[#3754](https://github.com/falcosecurity/falco/pull/3754)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* fix(metrics): Add null check for state.outputs in metrics collection [[#3740](https://github.com/falcosecurity/falco/pull/3740)] - [@adduali1310](https://github.com/adduali1310)
+* chore(cmake): bump libs to `0.23.0-rc2` [[#3759](https://github.com/falcosecurity/falco/pull/3759)] - [@ekoops](https://github.com/ekoops)
+* chore(cmake): bump libs/drivers to `0.23.0-rc1`/`9.1.0-rc1+driver` [[#3758](https://github.com/falcosecurity/falco/pull/3758)] - [@ekoops](https://github.com/ekoops)
+* fix(ci): revert changes to mitigate rate-limitar change [[#3752](https://github.com/falcosecurity/falco/pull/3752)] - [@irozzo-1A](https://github.com/irozzo-1A)
+* update(cmake): update libs and driver to latest master [[#3723](https://github.com/falcosecurity/falco/pull/3723)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* Reduce image size [[#3746](https://github.com/falcosecurity/falco/pull/3746)] - [@jfcoz](https://github.com/jfcoz)
+* docs(RELEASE.md): specify target branch association upon release creation [[#3717](https://github.com/falcosecurity/falco/pull/3717)] - [@ekoops](https://github.com/ekoops)
+* docs(RELEASE.md): fix `rn2md` cmd generating changelogs [[#3709](https://github.com/falcosecurity/falco/pull/3709)] - [@ekoops](https://github.com/ekoops)
+* docs(RELEASE.md): fix PRs filtering expr for checking release notes [[#3708](https://github.com/falcosecurity/falco/pull/3708)] - [@ekoops](https://github.com/ekoops)
+* docs(RELEASE.md): fix PRs filtering expression text [[#3707](https://github.com/falcosecurity/falco/pull/3707)] - [@ekoops](https://github.com/ekoops)
+
+### Statistics
+
+|   MERGED PRS    | NUMBER |
+|-----------------|--------|
+| Not user-facing |     21 |
+| Release note    |     11 |
+| Total           |     32 |
+
+## v0.42.0
+
+Released on 2025-10-22
+
+
+### Major Changes
+
+* feat: add `falco_libs.thread_table_auto_purging_interval_s` and `thread_table_auto_purging_thread_timeout_s` configuration options [[#3670](https://github.com/falcosecurity/falco/pull/3670)] - [@ekoops](https://github.com/ekoops)
+* feat: log plugin version info at loading time [[#3657](https://github.com/falcosecurity/falco/pull/3657)] - [@FedeDP](https://github.com/FedeDP)
+* feat: ability to add statically defined fields via `static_fields` configuration [[#3557](https://github.com/falcosecurity/falco/pull/3557)] - [@FedeDP](https://github.com/FedeDP)
+* feat(engine): emit warning when a rule containing the `evt.dir` field in output is encountered [[#3697](https://github.com/falcosecurity/falco/pull/3697)] - [@irozzo-1A](https://github.com/irozzo-1A)
+* feat(engine): emit warning when a rule containing a condition on the deprecated `evt.dir` field is encountered [[#3690](https://github.com/falcosecurity/falco/pull/3690)] - [@irozzo-1A](https://github.com/irozzo-1A)
+* new: ability to record `.scap` files (capture feature) [[#3645](https://github.com/falcosecurity/falco/pull/3645)] - [@leogr](https://github.com/leogr)
+* new(docker): includes sha on the image labels [[#3658](https://github.com/falcosecurity/falco/pull/3658)] - [@jcchavezs](https://github.com/jcchavezs)
+* new(cmake,userspace,ci): add mimalloc support [[#3616](https://github.com/falcosecurity/falco/pull/3616)] - [@FedeDP](https://github.com/FedeDP)
+
+
+### Minor Changes
+
+* docs(falco.yaml): refactor config documentation [[#3685](https://github.com/falcosecurity/falco/pull/3685)] - [@leogr](https://github.com/leogr)
+* build: fix `debian:buster` apt debian repo URL in `:driver-loader-buster` container image [[#3644](https://github.com/falcosecurity/falco/pull/3644)] - [@ekoops](https://github.com/ekoops)
+* build: updagrade libs to version 0.22.1 [[#3705](https://github.com/falcosecurity/falco/pull/3705)] - [@irozzo-1A](https://github.com/irozzo-1A)
+* build: upgrade drivers to v9.0.0+driver [[#3701](https://github.com/falcosecurity/falco/pull/3701)] - [@irozzo-1A](https://github.com/irozzo-1A)
+* build: upgrade cpp-httplib to v0.23.1 [[#3647](https://github.com/falcosecurity/falco/pull/3647)] - [@FedeDP](https://github.com/FedeDP)
+* update: upgrade default ruleset to v5.0.0 [[#3700](https://github.com/falcosecurity/falco/pull/3700)] - [@leogr](https://github.com/leogr)
+* build: upgrade `falcoctl` to v0.11.4 [[#3694](https://github.com/falcosecurity/falco/pull/3694)] - [@leogr](https://github.com/leogr)
+* chore(prometheus): deprecate enter events drop stats [[#3675](https://github.com/falcosecurity/falco/pull/3675)] - [@irozzo-1A](https://github.com/irozzo-1A)
+
+
+### Bug Fixes
+
+* fix(cmake): correct abseil-cpp for alpine build [[#3598](https://github.com/falcosecurity/falco/pull/3598)] - [@RomanenkoDenys](https://github.com/RomanenkoDenys)
+* fix: enable handling of multiple actions configured with `syscall_event_drops.actions` [[#3676](https://github.com/falcosecurity/falco/pull/3676)] - [@terror96](https://github.com/terror96)
+* fix: disable dry-run restarts when Falco runs with config-watching disabled [[#3640](https://github.com/falcosecurity/falco/pull/3640)] - [@Proximyst](https://github.com/Proximyst)
+
+
+
+### Non user-facing changes
+
+* fix(userspace/falco): correct default duration calculation [[#3715](https://github.com/falcosecurity/falco/pull/3715)] - [@leogr](https://github.com/leogr)
+* chore(falcoctl): update falco rules to version 5 [[#3712](https://github.com/falcosecurity/falco/pull/3712)] - [@irozzo-1A](https://github.com/irozzo-1A)
+* doc(OWNERS): move incertum (Melissa Kilby) to emeritus_approvers [[#3605](https://github.com/falcosecurity/falco/pull/3605)] - [@incertum](https://github.com/incertum)
+* update(cmake): update libs and driver to latest master [[#3689](https://github.com/falcosecurity/falco/pull/3689)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* chore(docker): use new `ENV` syntax in place of deprecated one [[#3696](https://github.com/falcosecurity/falco/pull/3696)] - [@ekoops](https://github.com/ekoops)
+* chore(cmake/modules): update rules to 5.0.0-rc1 [[#3698](https://github.com/falcosecurity/falco/pull/3698)] - [@leogr](https://github.com/leogr)
+* fix(userspace/engine): fix logger date format [[#3672](https://github.com/falcosecurity/falco/pull/3672)] - [@ekoops](https://github.com/ekoops)
+* docs(OWNERS): add `ekoops`(Leonardo Di Giovanna) as approver [[#3688](https://github.com/falcosecurity/falco/pull/3688)] - [@ekoops](https://github.com/ekoops)
+* update(cmake): update libs and driver to latest master [[#3665](https://github.com/falcosecurity/falco/pull/3665)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* Refactor: cppcheck cleanups [[#3649](https://github.com/falcosecurity/falco/pull/3649)] - [@sgaist](https://github.com/sgaist)
+* update(userspace/engine): update falco engine version and checksum [[#3648](https://github.com/falcosecurity/falco/pull/3648)] - [@ekoops](https://github.com/ekoops)
+* update(cmake): update libs and driver to latest master [[#3662](https://github.com/falcosecurity/falco/pull/3662)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3661](https://github.com/falcosecurity/falco/pull/3661)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3653](https://github.com/falcosecurity/falco/pull/3653)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* chore(ci): disable mimalloc for master builds. [[#3655](https://github.com/falcosecurity/falco/pull/3655)] - [@FedeDP](https://github.com/FedeDP)
+* chore(deps): Bump submodules/falcosecurity-rules from `1208816` to `be38001` [[#3651](https://github.com/falcosecurity/falco/pull/3651)] - [@dependabot[bot]](https://github.com/apps/dependabot)
+* docs(falco.yaml): avoid out-of-sync config options for `container` pl… [[#3650](https://github.com/falcosecurity/falco/pull/3650)] - [@leogr](https://github.com/leogr)
+* update(cmake): update libs and driver to latest master [[#3636](https://github.com/falcosecurity/falco/pull/3636)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(CHANGELOG.md): release 0.41.3 (cherry-pick) [[#3634](https://github.com/falcosecurity/falco/pull/3634)] - [@ekoops](https://github.com/ekoops)
+* update(cmake): update libs and driver to latest master [[#3628](https://github.com/falcosecurity/falco/pull/3628)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(CHANGELOG.md): release 0.41.2 (cherry-pick) [[#3623](https://github.com/falcosecurity/falco/pull/3623)] - [@ekoops](https://github.com/ekoops)
+* update(cmake): update libs and driver to latest master [[#3618](https://github.com/falcosecurity/falco/pull/3618)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3602](https://github.com/falcosecurity/falco/pull/3602)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* chore(falco.yaml): clean up plugins config leftover [[#3596](https://github.com/falcosecurity/falco/pull/3596)] - [@leogr](https://github.com/leogr)
+* chore(deps): Bump submodules/falcosecurity-rules from `b4437c4` to `4d51b18` [[#3607](https://github.com/falcosecurity/falco/pull/3607)] - [@dependabot[bot]](https://github.com/apps/dependabot)
+* update(docs): cherry pick CHANGELOG. [[#3600](https://github.com/falcosecurity/falco/pull/3600)] - [@FedeDP](https://github.com/FedeDP)
+* update(cmake): update libs and driver to latest master [[#3592](https://github.com/falcosecurity/falco/pull/3592)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(docs): bumped changelog for release 0.41.0, master sync [[#3586](https://github.com/falcosecurity/falco/pull/3586)] - [@FedeDP](https://github.com/FedeDP)
+* chore(deps): Bump submodules/falcosecurity-rules from `cb17833` to `b4437c4` [[#3578](https://github.com/falcosecurity/falco/pull/3578)] - [@dependabot[bot]](https://github.com/apps/dependabot)
+
+### Statistics
+
+|   MERGED PRS    | NUMBER |
+|-----------------|--------|
+| Not user-facing |     29 |
+| Release note    |     23 |
+| Total           |     52 |
+
+## v0.41.3
+
+Released on 2025-07-01
+
+
+
+### Minor Changes
+
+* update: bump container plugin to v0.3.1 [[#3629](https://github.com/falcosecurity/falco/pull/3629)] - [@FedeDP](https://github.com/FedeDP)
+
+
+
+
+### Statistics
+
+|   MERGED PRS    | NUMBER |
+|-----------------|--------|
+| Not user-facing |      0 |
+| Release note    |      1 |
+| Total           |      1 |
+
+## v0.41.2
+
+Released on 2025-06-17
+
+
+
+### Minor Changes
+
+* update(build): update container plugin to 0.3.0 [[#3619](https://github.com/falcosecurity/falco/pull/3619)] - [@ekoops](https://github.com/ekoops)
+
+
+
+### Non user-facing changes
+
+* update(build): update container plugin to 0.2.6 [[#3611](https://github.com/falcosecurity/falco/pull/3611)] - [@leogr](https://github.com/leogr)
+
+### Statistics
+
+|   MERGED PRS    | NUMBER |
+|-----------------|--------|
+| Not user-facing |      1 |
+| Release note    |      1 |
+| Total           |      2 |
+
+## v0.41.1
+
+Released on 2025-06-05
+
+### Bug Fixes
+
+* fix(userspace/falco): when collecting metrics for stats_writer, create a `libs_metrics_collector` for each source [[#3585](https://github.com/falcosecurity/falco/pull/3585)] - [@FedeDP](https://github.com/FedeDP)
+* fix(userspace/falco): only enable prometheus metrics once all inspectors have been opened [[#3588](https://github.com/falcosecurity/falco/pull/3588)] - [@FedeDP](https://github.com/FedeDP)
+
+### Statistics
+
+|   MERGED PRS    | NUMBER |
+|-----------------|--------|
+| Not user-facing |      0 |
+| Release note    |      2 |
+| Total           |      2 |
+
+## v0.41.0
+
+Released on 2025-05-29
+
+### Breaking Changes :warning:
+
+* cleanup(engine)!: only consider .yaml/.yml rule files [[#3551](https://github.com/falcosecurity/falco/pull/3551)] - [@LucaGuerra](https://github.com/LucaGuerra)
+* cleanup(userspace)!: deprecate print of `container.info` [[#3543](https://github.com/falcosecurity/falco/pull/3543)] - [@FedeDP](https://github.com/FedeDP)
+* cleanup(userspace/falco)!: drop deprecated in 0.40.0 CLI flags. [[#3496](https://github.com/falcosecurity/falco/pull/3496)] - [@FedeDP](https://github.com/FedeDP)
+
+
+### Major Changes
+
+* new(falco): add json_include_output_fields option [[#3527](https://github.com/falcosecurity/falco/pull/3527)] - [@LucaGuerra](https://github.com/LucaGuerra)
+* new(build,userspace): switch to use container plugin [[#3482](https://github.com/falcosecurity/falco/pull/3482)] - [@FedeDP](https://github.com/FedeDP)
+* new(docker,scripts,ci): use an override config file to enable ISO 8601 output timeformat on docker images [[#3488](https://github.com/falcosecurity/falco/pull/3488)] - [@FedeDP](https://github.com/FedeDP)
+
+
+### Minor Changes
+
+* chore(build): update falcoctl to v0.11.2, rules for artifact follow to v4 [[#3580](https://github.com/falcosecurity/falco/pull/3580)] - [@LucaGuerra](https://github.com/LucaGuerra)
+* update(cmake): bumped falcoctl to 0.11.1 and rules to 4.0.0. [[#3577](https://github.com/falcosecurity/falco/pull/3577)] - [@FedeDP](https://github.com/FedeDP)
+* update(containers): update opencontainers labels [[#3575](https://github.com/falcosecurity/falco/pull/3575)] - [@LucaGuerra](https://github.com/LucaGuerra)
+* update(metrics): improve restart/hot_reload conditions inspection [[#3562](https://github.com/falcosecurity/falco/pull/3562)] - [@incertum](https://github.com/incertum)
+* update: empty `values` in `exceptions` won't emit a warning anymore [[#3529](https://github.com/falcosecurity/falco/pull/3529)] - [@leogr](https://github.com/leogr)
+* chore(falco.yaml): enable libs_logger by default with info level [[#3507](https://github.com/falcosecurity/falco/pull/3507)] - [@FedeDP](https://github.com/FedeDP)
+
+
+### Bug Fixes
+
+* fix(metrics/prometheus): gracefully handle multiple event sources, avoid erroneous duplicate metrics [[#3563](https://github.com/falcosecurity/falco/pull/3563)] - [@incertum](https://github.com/incertum)
+* fix(ci): properly install rpm systemd-rpm-macro package on building packages pipeline [[#3521](https://github.com/falcosecurity/falco/pull/3521)] - [@FedeDP](https://github.com/FedeDP)
+* fix(userspace/falco): init cmdline options after loading all config files [[#3493](https://github.com/falcosecurity/falco/pull/3493)] - [@FedeDP](https://github.com/FedeDP)
+* fix(cmake): add support for 16K kernel page to jemalloc [[#3490](https://github.com/falcosecurity/falco/pull/3490)] - [@Darkness4](https://github.com/Darkness4)
+* fix(userspace/falco): fix jemalloc enabled in minimal build. [[#3478](https://github.com/falcosecurity/falco/pull/3478)] - [@FedeDP](https://github.com/FedeDP)
+
+
+
+### Non user-facing changes
+
+* chore(deps): Bump submodules/falcosecurity-rules from `4ccf111` to `cb17833` [[#3572](https://github.com/falcosecurity/falco/pull/3572)] - [@dependabot[bot]](https://github.com/apps/dependabot)
+* update(cmake/rules): bump to falco-rules-4.0.0-rc1 [[#3567](https://github.com/falcosecurity/falco/pull/3567)] - [@leogr](https://github.com/leogr)
+* cleanup(userspace/falco): drop unused `libs_metrics_collector` variable. [[#3566](https://github.com/falcosecurity/falco/pull/3566)] - [@FedeDP](https://github.com/FedeDP)
+* update(cmake): update libs and driver to latest master [[#3564](https://github.com/falcosecurity/falco/pull/3564)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* fix(build): fixed container custom_target `sed` command. [[#3556](https://github.com/falcosecurity/falco/pull/3556)] - [@FedeDP](https://github.com/FedeDP)
+* chore(deps): Bump submodules/falcosecurity-rules from `ae6ed41` to `4ccf111` [[#3555](https://github.com/falcosecurity/falco/pull/3555)] - [@dependabot[bot]](https://github.com/apps/dependabot)
+* fix(cmake): fix bundled c-ares cmake issue with e.g. SLES [[#3559](https://github.com/falcosecurity/falco/pull/3559)] - [@terror96](https://github.com/terror96)
+* chore(deps): Bump submodules/falcosecurity-rules from `1d2c6b1` to `ae6ed41` [[#3553](https://github.com/falcosecurity/falco/pull/3553)] - [@dependabot[bot]](https://github.com/apps/dependabot)
+* chore: revert "chore(deps): Bump submodules/falcosecurity-rules from `1d2c6b1` to `371e431`" [[#3552](https://github.com/falcosecurity/falco/pull/3552)] - [@FedeDP](https://github.com/FedeDP)
+* update(cmake): update libs and driver to latest master [[#3550](https://github.com/falcosecurity/falco/pull/3550)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3549](https://github.com/falcosecurity/falco/pull/3549)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(adopters): added SafeDep as adopter [[#3548](https://github.com/falcosecurity/falco/pull/3548)] - [@KunalSin9h](https://github.com/KunalSin9h)
+* update(cmake): update libs and driver to latest master [[#3547](https://github.com/falcosecurity/falco/pull/3547)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3541](https://github.com/falcosecurity/falco/pull/3541)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* fix(userspace): fixed engine `openssl` dep. [[#3535](https://github.com/falcosecurity/falco/pull/3535)] - [@FedeDP](https://github.com/FedeDP)
+* fix(userspace/falco): fix outputs_http timeout [[#3523](https://github.com/falcosecurity/falco/pull/3523)] - [@benierc](https://github.com/benierc)
+* fix(ci): use clang-19 to build modern_ebpf skeleton. [[#3537](https://github.com/falcosecurity/falco/pull/3537)] - [@FedeDP](https://github.com/FedeDP)
+* update(cmake): update libs and driver to latest master [[#3531](https://github.com/falcosecurity/falco/pull/3531)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3530](https://github.com/falcosecurity/falco/pull/3530)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3525](https://github.com/falcosecurity/falco/pull/3525)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3520](https://github.com/falcosecurity/falco/pull/3520)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3516](https://github.com/falcosecurity/falco/pull/3516)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* docs(README.md): cleanups and enhancements [[#3514](https://github.com/falcosecurity/falco/pull/3514)] - [@leogr](https://github.com/leogr)
+* update(cmake): update libs and driver to latest master [[#3511](https://github.com/falcosecurity/falco/pull/3511)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* chore(deps): Bump submodules/falcosecurity-rules from `1d2c6b1` to `371e431` [[#3510](https://github.com/falcosecurity/falco/pull/3510)] - [@dependabot[bot]](https://github.com/apps/dependabot)
+* update(cmake): update libs and driver to latest master [[#3508](https://github.com/falcosecurity/falco/pull/3508)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* update(cmake): update libs and driver to latest master [[#3506](https://github.com/falcosecurity/falco/pull/3506)] - [@github-actions[bot]](https://github.com/apps/github-actions)
+* fix(userspace/falco): when counting `-M` timeout, do not account for async events [[#3505](https://github.com/falcosecurity/falco/pull/3505)] - [@FedeDP](https://github.com/FedeDP)
+* chore(deps): Bump submodules/falcosecurity-rules from `d8415c1` to `1d2c6b1` [[#3504](https://github.com/falcosecurity/falco/pull/3504)] - [@dependabot[bot]](https://github.com/apps/dependabot)
+* docs(proposals): correct typo in example [[#3499](https://github.com/falcosecurity/falco/pull/3499)] - [@leogr](https://github.com/leogr)
+* fix(docker): fixed entrypoints paths with new docker context. [[#3492](https://github.com/falcosecurity/falco/pull/3492)] - [@FedeDP](https://github.com/FedeDP)
+* feat(falco/app): move actions not using config before `load_config` [[#3483](https://github.com/falcosecurity/falco/pull/3483)] - [@ekoops](https://github.com/ekoops)
+* refactor(falco/app): apply early return pattern in actions code [[#3484](https://github.com/falcosecurity/falco/pull/3484)] - [@ekoops](https://github.com/ekoops)
+* chore(deps): Bump submodules/falcosecurity-rules from `abf6637` to `d8415c1` [[#3489](https://github.com/falcosecurity/falco/pull/3489)] - [@dependabot[bot]](https://github.com/apps/dependabot)
+* Add NETWAYS Web Services to ADOPTERS.md [[#3487](https://github.com/falcosecurity/falco/pull/3487)] - [@mocdaniel](https://github.com/mocdaniel)
+* chore: add back Falco static package to the release template. [[#3472](https://github.com/falcosecurity/falco/pull/3472)] - [@FedeDP](https://github.com/FedeDP)
+
+### Statistics
+
+|   MERGED PRS    | NUMBER |
+|-----------------|--------|
+| Not user-facing |     36 |
+| Release note    |     17 |
+| Total           |     53 |
+
 ## v0.40.0
 
 Released on 2025-01-28

CMakeLists.txt

@@ -29,7 +29,29 @@ option(BUILD_FALCO_UNIT_TESTS "Build falco unit tests" OFF)
 option(USE_ASAN "Build with AddressSanitizer" OFF)
 option(USE_UBSAN "Build with UndefinedBehaviorSanitizer" OFF)
 option(UBSAN_HALT_ON_ERROR "Halt on error when building with UBSan" ON)
-option(USE_JEMALLOC "Use jemalloc allocator" OFF)
+option(USE_GPERFTOOLS "Build with gperftools CPU profiler support" OFF)
+option(USE_FRAME_POINTER "Build with frame pointers for accurate profiling" OFF)
+
+# Enable frame pointers by default when using gperftools for accurate stack traces
+if(USE_GPERFTOOLS AND NOT USE_FRAME_POINTER)
+	set(USE_FRAME_POINTER
+		ON
+		CACHE BOOL "Build with frame pointers for accurate profiling" FORCE
+	)
+	message(STATUS "Enabling USE_FRAME_POINTER since USE_GPERFTOOLS is enabled")
+endif()
+
+# Mem allocators - linux only for now
+if(NOT WIN32
+   AND NOT APPLE
+   AND NOT MINIMAL_BUILD
+   AND NOT EMSCRIPTEN
+)
+	# If one enables multiple allocators, cmake will fail since all of the allocators cmake modules
+	# create a `malloc` target.
+	option(USE_JEMALLOC "Use jemalloc allocator, linux only" OFF)
+	option(USE_MIMALLOC "Use mimalloc (microsoft) allocator, linux only" OFF)
+endif()
 
 if(WIN32)
 	if(POLICY CMP0091)
@@ -53,27 +75,12 @@ elseif(EMSCRIPTEN)
 		OFF
 		CACHE BOOL "" FORCE
 	)
-	set(BUILD_BPF
-		OFF
-		CACHE BOOL "" FORCE
-	)
 	set(CPACK_GENERATOR
 		TGZ
 		CACHE BOOL "" FORCE
 	)
 endif()
 
-# gVisor is currently only supported on Linux x86_64
-if(CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64"
-   AND CMAKE_SYSTEM_NAME MATCHES "Linux"
-   AND NOT MINIMAL_BUILD
-)
-	option(BUILD_FALCO_GVISOR "Build gVisor support for Falco" ON)
-	if(BUILD_FALCO_GVISOR)
-		add_definitions(-DHAS_GVISOR)
-	endif()
-endif()
-
 # Modern BPF is not supported on not Linux systems and in MINIMAL_BUILD
 if(CMAKE_SYSTEM_NAME MATCHES "Linux" AND NOT MINIMAL_BUILD)
 	option(BUILD_FALCO_MODERN_BPF "Build modern BPF support for Falco" ON)
@@ -122,11 +129,6 @@ set(DRIVER_NAME "falco")
 set(DRIVER_DEVICE_NAME "falco")
 set(DRIVERS_REPO "https://download.falco.org/driver")
 
-# If no path is provided, try to search the BPF probe in: `home/.falco/falco-bpf.o` This is the same
-# fallback that we had in the libraries: `SCAP_PROBE_BPF_FILEPATH`.
-set(FALCO_PROBE_BPF_FILEPATH ".${DRIVER_NAME}/${DRIVER_NAME}-bpf.o")
-add_definitions(-DFALCO_PROBE_BPF_FILEPATH="${FALCO_PROBE_BPF_FILEPATH}")
-
 if(NOT DEFINED FALCO_COMPONENT_NAME)
 	set(FALCO_COMPONENT_NAME "${CMAKE_PROJECT_NAME}")
 endif()
@@ -142,12 +144,7 @@ set(CMD_MAKE make)
 
 include(ExternalProject)
 
-if(USE_JEMALLOC)
-	if(USE_ASAN)
-		message(WARNING "Jemalloc and ASAN are known to have issues when combined")
-	endif()
-	include(jemalloc)
-endif()
+include(cxxopts)
 
 # libs
 include(falcosecurity-libs)
@@ -155,6 +152,23 @@ include(falcosecurity-libs)
 # compute FALCO_VERSION (depends on libs)
 include(falco-version)
 
+# Mem allocators - linux only for now
+if(NOT WIN32
+   AND NOT APPLE
+   AND NOT MINIMAL_BUILD
+   AND NOT EMSCRIPTEN
+)
+
+	if(USE_JEMALLOC)
+		include(jemalloc)
+	endif()
+	if(USE_MIMALLOC)
+		include(mimalloc)
+	endif()
+
+	message(STATUS "Will use mem allocator library: ${MALLOC_LIB}")
+endif()
+
 # nlohmann-json
 include(njson)
 
@@ -176,8 +190,6 @@ if(NOT WIN32
 	include(cpp-httplib)
 endif()
 
-include(cxxopts)
-
 # One TBB
 if(NOT EMSCRIPTEN)
 	include(tbb)
@@ -185,15 +197,17 @@ endif()
 
 include(zlib)
 include(valijson)
+
+# CPU Profiling with gperftools
+if(USE_GPERFTOOLS)
+	include(gperftools)
+endif()
 if(NOT MINIMAL_BUILD)
 	if(NOT WIN32
 	   AND NOT APPLE
 	   AND NOT EMSCRIPTEN
 	)
 		include(cares)
-		include(protobuf)
-		# gRPC
-		include(grpc)
 	endif()
 endif()
 
@@ -267,11 +281,17 @@ if(NOT WIN32
    AND NOT MUSL_OPTIMIZED_BUILD
 )
 	include(falcoctl)
+	set(CONTAINER_VERSION "0.6.1")
+	if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
+		set(CONTAINER_HASH "008989992ed1f31b3ffb94ba6b64ca5a8e2f91611a10c9d6213c5c0a499d0679")
+	else() # arm64
+		set(CONTAINER_HASH "f90a700b4c2b411b23e7cc461b61a316b242994aad853c3e6baf12481fb6f6c9")
+	endif()
 	include(container_plugin)
 
 	# Generate a binary_dir/falco.yaml that automatically enables the plugin to be used for local
 	# testing.
-	configure_file(${CMAKE_SOURCE_DIR}/falco.yaml ${CMAKE_BINARY_DIR} COPYONLY)
+	configure_file(${CMAKE_CURRENT_SOURCE_DIR}/falco.yaml ${CMAKE_BINARY_DIR} COPYONLY)
 	# The custom target configures the plugin and set its path
 	add_custom_target(
 		container

Contributing.md

@@ -27,7 +27,7 @@ The `pre-commit` framework allows you to automatically install different `git-ho
 
 1. The `clang-format` hook: this is a `pre-commit` git hook that runs `clang-format` on your staged changes.
 2. The `cmake-format` hook: this is a `pre-commit` git hook that runs `cmake-format` on your staged changes.
-3. The `DCO signed-off` hook: this is a `pre-commit-msg` git hook that adds the `DCO` on your commit if not present. This hook is not strictly related to the coding style so we will talk about it in a separate section: [Add DCO signed-off to your commits](#add-dco-signed-off-to-your-commits).
+3. The `DCO signed-off` hook: this is a `pre-commit-msg` git hook that adds the `DCO` on your commit if not present. This hook is not strictly related to the coding style so we will talk about it in a separate section: [Add DCO signed-off to your commits](#add-dco-signed-off-to-your-commits-).
 
 Now let's see what we need to use `pre-commit` framework.
 
@@ -47,7 +47,7 @@ This simple command allows you to install the two `pre-commit` git hooks, `clang
 pre-commit install --install-hooks --hook-type pre-commit --overwrite  
 ```
 
-If you want to install also the `pre-commit-msg` git hook for the DCO you have to type the following command, but be sure to have configured all you need as said in the [dedicated section]((#add-dco-signed-off-to-your-commits))
+If you want to install also the `pre-commit-msg` git hook for the DCO you have to type the following command, but be sure to have configured all you need as said in the [dedicated section](#add-dco-signed-off-to-your-commits-)
 
 ```bash
 pre-commit install --install-hooks --hook-type prepare-commit-msg --overwrite 
@@ -81,7 +81,7 @@ To install `cmake-format` you can follow the official documentation [here](https
 
 ##### Step 2
 
-Once you have installed the __right__ versions of the 2 tools, you can simply type `make format-all` from the root directory of the project (`/libs`) to format all your code according to the coding style.
+Once you have installed the __right__ versions of the 2 tools, you can simply type `make format-all` from the root directory of the project to format all your code according to the coding style.
 
 Remember to do that before submitting a new patch upstream! 😁
 
@@ -93,7 +93,7 @@ Obviously, you can also install the 2 tools locally and enable some extension of
 
 ### Introduction
 
-Another requirement for contributing to the `libs` repository, is applying the [DCO](https://cert-manager.io/docs/contributing/sign-off/) to every commit you want to push upstream.
+Another requirement for contributing to the `falco` repository, is applying the [DCO](https://cert-manager.io/docs/contributing/sign-off/) to every commit you want to push upstream.
 Before doing this you have to configure your git user `name` and `email` if you haven't already done it. To check your actual `name` and `email` type:
 
 ```bash

OWNERS

@@ -4,12 +4,14 @@ approvers:
   - jasondellaluce
   - fededp
   - andreagit97
-  - incertum
   - LucaGuerra
   - sgaist
+  - ekoops
 reviewers:
   - kaizhe
+  - irozzo-1A
 emeritus_approvers:
   - fntlnz
   - kris-nova
   - leodido
+  - incertum

README.md

@@ -74,8 +74,6 @@ Here's an example of a `cmake` command that will enable everything you need for
 ```bash
 cmake \
 -DUSE_BUNDLED_DEPS=ON \
--DBUILD_LIBSCAP_GVISOR=ON \
--DBUILD_BPF=ON \
 -DBUILD_DRIVER=ON \
 -DBUILD_FALCO_MODERN_BPF=ON \
 -DCREATE_TEST_TARGETS=ON \
@@ -113,7 +111,7 @@ Please refer to the [Contributing](https://github.com/falcosecurity/.github/blob
 
 1. The first lines of code at the base of Falco were written some time ago, where Go didn't yet have the same level of maturity and adoption as today.
 2. The Falco execution model is sequential and mono-thread due to the statefulness requirements of the tool, and so most of the concurrency-related selling points of the Go runtime would not be leveraged at all.
-3. The Falco code deals with very low-level programming in many places (e.g. some headers are shared with the eBPF probe and the Kernel module), and we all know that interfacing Go with C is possible but brings tons of complexity and tradeoffs to the table.
+3. The Falco code deals with very low-level programming in many places, and we all know that interfacing Go with C is possible but brings tons of complexity and tradeoffs to the table.
 4. As a security tool meant to consume a crazy high throughput of events per second, Falco needs to squeeze performance in all hot paths at runtime and requires deep control on memory allocation, which the Go runtime can't provide (there's also garbage collection involved).
 5. Although Go didn't suit the engineering requirements of the core of Falco, we still thought that it could be a good candidate for writing Falco extensions through the plugin system. This is the main reason we gave special attention and high priority to the development of the plugin-sdk-go.
 6. Go is not a requirement for having statically-linked binaries. In fact, we provide fully-static Falco builds since few years. The only issue with those is that the plugin system can't be supported with the current dynamic library model we currently have.

RELEASE.md

@@ -48,11 +48,10 @@ Alternatively Falco binaries or plugins can be downloaded from the Falco Artifac
 
 > Note: This section specifically applies to non-modern BPF drivers.
 
-The Falco Project publishes all drivers for each release for popular kernel versions / distros and `x86_64` and `aarch64` architectures to the Falco project's managed Artifacts repo. The Artifacts repo follows standard directory level conventions. The respective driver object file is prefixed by distro and named / versioned by kernel release - `$(uname -r)`. Pre-compiled drivers are released with a [best effort](https://github.com/falcosecurity/falco/blob/master/proposals/20200818-artifacts-storage.md#notice) notice. This is because gcc (`kmod`) and clang (`bpf`) compilers sometimes fail to build the artifacts for a specific kernel version. More details around driver versioning and driver compatibility are provided in the [Falco Components Versioning](#falco-components-versioning) section. Short preview: If you use the standard Falco setup leveraging driver-loader, [driver-loader script](https://github.com/falcosecurity/falco/blob/master/scripts/falco-driver-loader) will fetch the kernel space artifact (object file) corresponding to the default `DRIVER_VERSION` Falco was shipped with.
+The Falco Project publishes all drivers for each release for popular kernel versions / distros and `x86_64` and `aarch64` architectures to the Falco project's managed Artifacts repo. The Artifacts repo follows standard directory level conventions. The respective driver object file is prefixed by distro and named / versioned by kernel release - `$(uname -r)`. Pre-compiled drivers are released with a [best effort](https://github.com/falcosecurity/falco/blob/master/proposals/20200818-artifacts-storage.md#notice) notice. This is because gcc (`kmod`)  sometimes fails to build the artifacts for a specific kernel version. More details around driver versioning and driver compatibility are provided in the [Falco Components Versioning](#falco-components-versioning) section. Short preview: If you use the standard Falco setup leveraging driver-loader, [driver-loader script](https://github.com/falcosecurity/falco/blob/master/scripts/falco-driver-loader) will fetch the kernel space artifact (object file) corresponding to the default `DRIVER_VERSION` Falco was shipped with.
 
 - [Falco Artifacts Repo Drivers Root](https://download.falco.org/?prefix=driver/)
-    - Option 1: Kernel module (`.ko` files) - all under same driver version directory
-    - Option 2: eBPF (`.o` files) - all under same driver version directory
+    - Kernel module (`.ko` files) - all under same driver version directory
 
 
 ### Timeline
@@ -66,7 +65,7 @@ Changes and new features are organized into [milestones](https://github.com/falc
 
 The release process is mostly automated, requiring only a few manual steps to initiate and complete.
 
-Moreover, we assign owners for each release (typically pairing a new person with an experienced one). Assignees and due dates for releases are proposed during the [weekly community call](https://github.com/falcosecurity/community).
+Moreover, we assign owners for each release (typically pairing a new person with an experienced one). Assignees and due dates for releases are proposed during the [community call](https://github.com/falcosecurity/community).
 
 At a high level each Falco release needs to follow a pre-determined sequencing of releases and build order:
 
@@ -84,11 +83,15 @@ Before proceeding with the release, make sure to complete the following preparat
 
 ### 1. Release notes
 - Find the previous release date (`YYYY-MM-DD`) by looking at the [Falco releases](https://github.com/falcosecurity/falco/releases)
-- Check the release note block of every PR matching the `is:pr is:merged closed:>YYYY-MM-DD` [filter](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+closed%3A%3EYYYY-MM-DD)
+- Double-check, by using the following filters, if there is any closed issue/merge PR with no milestone assigned:
+  - `is:issue state:closed no:milestone closed:>YYYY-MM-DD`
+    [filter](https://github.com/falcosecurity/falco/issues?q=is%3Aissue%20state%3Aclosed%20no%3Amilestone%20closed%3A%3EYYYY-MM-DD)
+  - `is:pr is:merged no:milestone closed:>YYYY-MM-DD`
+    [filter](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+no%3Amilestone+closed%3A%3EYYYY-MM-DD)
+- Assign any issue/PR identified in the previous point to the milestone corresponding to the currently undergoing release
+- Check the release note block of every PR matching the `is:pr is:merged milestone:M.m.p` [filter](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+milestone%3AM.m.p)
     - Ensure the release note block follows the [commit convention](https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md#commit-convention), otherwise fix its content
     - If the PR has no milestone, assign it to the milestone currently undergoing release
-- Check issues without a milestone (using `is:pr is:merged no:milestone closed:>YYYY-MM-DD` [filter](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+no%3Amilestone+closed%3A%3EYYYY-MM-DD) ) and add them to the milestone currently undergoing release
-- Double-check that there are no more merged PRs without the target milestone assigned with the `is:pr is:merged no:milestone closed:>YYYY-MM-DD` [filter](https://github.com/falcosecurity/falco/pulls?q=is%3Apr+is%3Amerged+no%3Amilestone+closed%3A%3EYYYY-MM-DD), if any, update those missing
 
 ### 2. Milestones
 
@@ -102,7 +105,7 @@ Its naming will be `release/M.m.x`; for example: `release/0.34.x`.
 The same branch will then be used for any eventual cherry pick for patch releases.  
 
 For patch releases, instead, the `release/M.m.x` branch should already be in place; no more steps are needed.  
-Double check that any PR that should be part of the tag has been cherry-picked from master!
+Double-check that any PR that should be part of the tag has been cherry-picked from master!
 
 ### 4. Release PR
 
@@ -112,7 +115,7 @@ The release PR is meant to be made against the respective `release/M.m.x` branch
     - If any, manually correct it then open an issue to automate version number bumping later
     - Versions table in the `README.md` updates itself automatically
 - Generate the change log using [rn2md](https://github.com/leodido/rn2md):
-    - Execute `rn2md -o falcosecurity -m <version> -r falco`
+    - Execute `rn2md -r falcosecurity/falco -m M.m.p`
     - In case `rn2md` emits error try to generate an GitHub OAuth access token and provide it with the `-t` flag
 - Add the latest changes on top the previous `CHANGELOG.md`
 - Submit a PR with the above modifications
@@ -125,16 +128,18 @@ The release PR is meant to be made against the respective `release/M.m.x` branch
 Core maintainers and/or the release manager can decide to publish pre-releases at any time before the final release
 is live for development and testing purposes.
 
-The prerelease tag must be formatted as `M.m.p-r`where `r` is the prerelease version information (e.g. `0.35.0-rc1`.)
+The pre-release must be associated with a newly created tag. The tag is intended to be created while drafting the new pre-release through the GitHub form (this is indeed the only way to correctly associate the tag with a target branch; more on this below).
+The pre-release tag must be formatted as `M.m.p-r`, where `r` is the pre-release version information (e.g. `0.35.0-rc1`).
 
-To do so:
+To create both pre-release tag and pre-release, do the following:
 
 - [Draft a new release](https://github.com/falcosecurity/falco/releases/new)
-- Use `M.m.p-r` both as tag version and release title.
+- Use `M.m.p-r` both as tag version and release title
+- Associate `release/M.m.x` as "target branch" for the new tag
 - Check the "Set as a pre-release" checkbox and make sure "Set as the latest release" is unchecked
 - It is recommended to add a brief description so that other contributors will understand the reason why the prerelease is published
 - Publish the prerelease!
-- The release pipeline will start automatically. Packages will be uploaded to the `-dev` bucket and container images will be tagged with the specified tag.
+- The release pipeline will start automatically. Packages will be uploaded to the `-dev` bucket and container images will be tagged with the specified tag
 
 In order to check the status of the release pipeline click on the [GitHub Actions tab](https://github.com/falcosecurity/falco/actions?query=event%3Arelease) in the Falco repository and filter by release.
 
@@ -146,6 +151,7 @@ Assume `M.m.p` is the new version.
 
 - [Draft a new release](https://github.com/falcosecurity/falco/releases/new)
 - Use `M.m.p` both as tag version and release title
+- Associate `release/M.m.x` as "target branch" for the new tag
 - Do NOT fill body, since it will be autogenerated by the [github release workflow](.github/workflows/release.yaml)
 - Publish the release!
 - The release pipeline will start automatically upon publication and all packages and container images will be uploaded to the stable repositories.
@@ -158,7 +164,7 @@ For each release we archive the meeting notes in git for historical purposes.
 
  - The notes from the Falco meetings can be [found here](https://hackmd.io/3qYPnZPUQLGKCzR14va_qg).
     - Note: There may be other notes from working groups that can optionally be added as well as needed.
- - Add the entire content of the document to a new file in [github.com/falcosecurity/community/tree/master/meeting-notes](https://github.com/falcosecurity/community/tree/master/meeting-notes) as a new file labeled `release-M.m.p.md`
+ - Add the entire content of the document to a new file in [github.com/falcosecurity/community/tree/main/meeting-notes](https://github.com/falcosecurity/community/tree/main/meeting-notes) as a new file labeled `release-M.m.p.md`
  - Open up a pull request with the new change.
 
 
@@ -166,10 +172,10 @@ For each release we archive the meeting notes in git for historical purposes.
 
 Announce the new release to the world!
 
+- IFF the ongoing release introduces a **new minor version**, [archive a snapshot of the Falco website](https://github.com/falcosecurity/falco-website/blob/master/release.md#documentation-versioning)
 - Publish a blog on [Falco website](https://github.com/falcosecurity/falco-website) ([example](https://github.com/falcosecurity/falco-website/blob/master/content/en/blog/falco-0-28-1.md))
 - Send an announcement to cncf-falco-dev@lists.cncf.io (plain text, please)
 - Let folks in the slack #falco channel know about a new release came out
-- IFF the on going release introduces a **new minor version**, [archive a snapshot of the Falco website](https://github.com/falcosecurity/falco-website/blob/master/release.md#documentation-versioning)
 
 
 ## Falco Components Versioning
@@ -181,9 +187,7 @@ This section provides more details around the versioning of the components that
 - Falco version is a git tag (`x.y.z`), see [Procedures](#procedures) section. Note that the Falco version is a sem-ver-like schema, but not fully compatible with sem-ver.
 - [FALCO_ENGINE_VERSION](https://github.com/falcosecurity/falco/blob/master/userspace/engine/falco_engine_version.h) is not sem-ver and must be bumped either when a backward incompatible change has been introduced to the rules files syntax and loading logic, and/or when `FALCO_ENGINE_CHECKSUM` has changed. The checksum is computed by considering the available rules fields (see currently supported [Falco fields](https://falco.org/docs/reference/rules/supported-fields/)), the event types (see currently supported [Falco events](https://falco.org/docs/reference/rules/supported-events/)), and the supported driver schema version. A checksum indicates that something was not available in previous engine versions. See the [rules release guidelines](https://github.com/falcosecurity/rules/blob/main/RELEASE.md#versioning-a-ruleset) to understand how this affects the versioning of Falco rules. Breaking changes introduced in the Falco engine are not necessarily tied to the drivers or libs versions. The version number must be incremented every time and only when a single change or an atomic group of changes - which meet the criteria described above - is included in the `master` branch. Thus, a version bump can occur multiple times during the development and testing phases of a given release cycle. A given version bump must not group multiple changes that occurred sporadically during the release cycle.
 - During development and release preparation, libs and driver reference commits are often bumped in Falco's cmake setup ([falcosecurity-libs cmake](https://github.com/falcosecurity/falco/blob/master/cmake/modules/falcosecurity-libs.cmake#L30) and [driver cmake](https://github.com/falcosecurity/falco/blob/master/cmake/modules/driver.cmake#L29)) in order to merge new Falco features. In practice, they are mostly bumped at the same time referencing the same `libs` commit. However, for the official Falco build `FALCOSECURITY_LIBS_VERSION` flag that references the stable libs version is used (read below).
-- Similarly, Falco plugins versions are bumped in Falco's cmake setup ([plugins cmake](https://github.com/falcosecurity/falco/blob/master/cmake/modules/plugins.cmake)) and those versions are the ones used for the Falco release.
 - At release time Plugin, Libs and Driver versions are compatible with Falco.
-- If you use the standard Falco setup leveraging driver-loader, [driver-loader script](https://github.com/falcosecurity/falco/blob/master/scripts/falco-driver-loader) will fetch the kernel space artifact (object file) corresponding to the default `DRIVER_VERSION` Falco was shipped with (read more below under Libs).
 
 
 ```

brand/README.md

@@ -53,15 +53,10 @@ Notice the capitalization of the following terms.
 
 This section contains key terms specifically used within the context of The Falco Project. For a more comprehensive list of Falco-related terminology, we invite you to visit the [Glossary](https://falco.org/docs/reference/glossary/) page on our official website.
 
-#### eBPF Probe
-
-Used to describe the `.o` object that would be dynamically loaded into the kernel as a secure and stable (e)BPF probe. 
-This is one option used to pass kernel events up to userspace for Falco to consume.
-
 #### Modern eBPF Probe
 
-More robust [eBPF probe](#ebpf-probe), which brings the CO-RE paradigm, better performances, and maintainability. 
-Unlike the legacy probe, the modern eBPF probe is not shipped as a separate artifact but bundled into the Falco binary itself.
+Robust eBPF probe, which brings the CO-RE paradigm, better performances, and maintainability. 
+The modern eBPF probe is not shipped as a separate artifact but bundled into the Falco binary itself.
 This is one option used to pass kernel events up to userspace for Falco to consume.
 
 #### Kernel Module
@@ -71,7 +66,7 @@ This is one option used to pass kernel events up to userspace for Falco to consu
 
 #### Driver 
 
-The global term for the software that sends events from the kernel. Such as the [eBPF probe](#ebpf-probe), the [Modern eBPF probe](#modern-ebpf-probe), or the [Kernel Module](#kernel-module).
+The global term for the software that sends events from the kernel. Such as the [Modern eBPF probe](#modern-ebpf-probe), or the [Kernel Module](#kernel-module).
 
 #### Plugin
 

cmake/cpack/CMakeCPackOptions.cmake

@@ -29,11 +29,6 @@ if(CPACK_GENERATOR MATCHES "DEB" OR CPACK_GENERATOR MATCHES "RPM")
 		CPACK_INSTALL_COMMANDS
 		"cp scripts/systemd/falco-kmod.service _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system"
 	)
-	list(
-		APPEND
-		CPACK_INSTALL_COMMANDS
-		"cp scripts/systemd/falco-bpf.service _CPack_Packages/${CPACK_TOPLEVEL_TAG}/${CPACK_GENERATOR}/${CPACK_PACKAGE_FILE_NAME}/usr/lib/systemd/system"
-	)
 	list(
 		APPEND
 		CPACK_INSTALL_COMMANDS

cmake/cpack/debian/conffiles

@@ -1,3 +1,3 @@
 /etc/falco/falco.yaml
-/etc/falco/falcoctl.yaml
 /etc/falco/falco_rules.local.yaml
+/etc/falcoctl/falcoctl.yaml

cmake/modules/CompilerFlags.cmake

@@ -23,6 +23,7 @@ endif()
 string(TOLOWER "${CMAKE_BUILD_TYPE}" CMAKE_BUILD_TYPE)
 if(CMAKE_BUILD_TYPE STREQUAL "debug")
 	set(KBUILD_FLAGS "${FALCO_EXTRA_DEBUG_FLAGS} ${FALCO_EXTRA_FEATURE_FLAGS}")
+	add_definitions(-DBUILD_TYPE_DEBUG)
 elseif(CMAKE_BUILD_TYPE STREQUAL "relwithdebinfo")
 	set(KBUILD_FLAGS "${FALCO_EXTRA_FEATURE_FLAGS}")
 	add_definitions(-DBUILD_TYPE_RELWITHDEBINFO)
@@ -67,6 +68,10 @@ if(NOT MSVC)
 		endif()
 	endif()
 
+	if(USE_FRAME_POINTER)
+		set(FALCO_SECURITY_FLAGS "${FALCO_SECURITY_FLAGS} -fno-omit-frame-pointer")
+	endif()
+
 	set(CMAKE_COMMON_FLAGS
 		"${FALCO_SECURITY_FLAGS} -Wall -ggdb ${FALCO_EXTRA_FEATURE_FLAGS} ${MINIMAL_BUILD_FLAGS} ${MUSL_FLAGS}"
 	)

cmake/modules/cpp-httplib.cmake

@@ -20,11 +20,14 @@ if(USE_BUNDLED_CPPHTTPLIB)
 	set(HTTPLIB_REQUIRE_BROTLI OFF)
 	set(HTTPLIB_USE_ZLIB_IF_AVAILABLE OFF)
 	set(HTTPLIB_REQUIRE_ZLIB OFF)
+	set(HTTPLIB_USE_ZSTD_IF_AVAILABLE OFF)
+	set(HTTPLIB_REQUIRE_ZSTD OFF)
+	set(HTTPLIB_USE_NON_BLOCKING_GETADDRINFO OFF)
 	include(FetchContent)
 	FetchContent_Declare(
 		cpp-httplib
-		URL https://github.com/yhirose/cpp-httplib/archive/refs/tags/v0.15.3.tar.gz
-		URL_HASH SHA256=2121bbf38871bb2aafb5f7f2b9b94705366170909f434428352187cb0216124e
+		URL https://github.com/yhirose/cpp-httplib/archive/refs/tags/v0.23.1.tar.gz
+		URL_HASH SHA256=410a1347ed6bcbcc4a19af8ed8ad3873fe9fa97731d52db845c4c78f3f9c31e6
 	)
 	FetchContent_MakeAvailable(cpp-httplib)
 else()

cmake/modules/cxxopts.cmake

@@ -24,7 +24,7 @@ if(CXXOPTS_INCLUDE_DIR)
 elseif(NOT USE_BUNDLED_CXXOPTS)
 	find_package(cxxopts CONFIG REQUIRED)
 	get_target_property(CXXOPTS_INCLUDE_DIR cxxopts::cxxopts INTERFACE_INCLUDE_DIRECTORIES)
-else()
+elseif(NOT TARGET cxxopts)
 	set(CXXOPTS_SRC "${PROJECT_BINARY_DIR}/cxxopts-prefix/src/cxxopts/")
 	set(CXXOPTS_INCLUDE_DIR "${CXXOPTS_SRC}/include")
 

cmake/modules/driver.cmake

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright (C) 2023 The Falco Authors.
+# Copyright (C) 2026 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 # in compliance with the License. You may obtain a copy of the License at
@@ -35,9 +35,9 @@ else()
 	# FALCOSECURITY_LIBS_VERSION. In case you want to test against another driver version (or
 	# branch, or commit) just pass the variable - ie., `cmake -DDRIVER_VERSION=dev ..`
 	if(NOT DRIVER_VERSION)
-		set(DRIVER_VERSION "9c2734a64338abff04c4a8274d3770e40c964e21")
+		set(DRIVER_VERSION "7b08f8a0a12b56d59eab73052e637ca123623f61")
 		set(DRIVER_CHECKSUM
-			"SHA256=8094cfb04c77b317a4e5a69cf8556dccb54067d1decf9ec920c7cc3fa1ea831a"
+			"SHA256=43c72a98e48d04177c8223ccdfe88de6f09958f2330b6b9ee26882f1a77e369f"
 		)
 	endif()
 

cmake/modules/falcoctl.cmake

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright (C) 2023 The Falco Authors.
+# Copyright (C) 2025 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 # in compliance with the License. You may obtain a copy of the License at
@@ -20,16 +20,16 @@ option(ADD_FALCOCTL_DEPENDENCY "Add falcoctl dependency while building falco" ON
 if(ADD_FALCOCTL_DEPENDENCY)
 	string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} FALCOCTL_SYSTEM_NAME)
 
-	set(FALCOCTL_VERSION "0.11.0")
+	set(FALCOCTL_VERSION "0.12.2")
 
 	message(STATUS "Building with falcoctl: ${FALCOCTL_VERSION}")
 
 	if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
 		set(FALCOCTL_SYSTEM_PROC_GO "amd64")
-		set(FALCOCTL_HASH "b9d0e0f50813e7172a945f36f70c5c3c16a677ab4c85b35b6f7a155bc92768fc")
+		set(FALCOCTL_HASH "7e0e232aa73825383d3382b3af8a38466289a768f9c1c7f25bd7e11a3ed6980a")
 	else() # aarch64
 		set(FALCOCTL_SYSTEM_PROC_GO "arm64")
-		set(FALCOCTL_HASH "689c625d1d414cbf53d39ef94083a53dda3ea4ac4908799fb85f4519e21442e0")
+		set(FALCOCTL_HASH "9b7dd75189f997da6423bcdb5dfe68840f20c56f95d30d323d26d0c4bd75a8e3")
 	endif()
 
 	ExternalProject_Add(

cmake/modules/falcosecurity-libs.cmake

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright (C) 2023 The Falco Authors.
+# Copyright (C) 2026 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 # in compliance with the License. You may obtain a copy of the License at
@@ -42,9 +42,9 @@ else()
 	# version (or branch, or commit) just pass the variable - ie., `cmake
 	# -DFALCOSECURITY_LIBS_VERSION=dev ..`
 	if(NOT FALCOSECURITY_LIBS_VERSION)
-		set(FALCOSECURITY_LIBS_VERSION "9c2734a64338abff04c4a8274d3770e40c964e21")
+		set(FALCOSECURITY_LIBS_VERSION "7b08f8a0a12b56d59eab73052e637ca123623f61")
 		set(FALCOSECURITY_LIBS_CHECKSUM
-			"SHA256=8094cfb04c77b317a4e5a69cf8556dccb54067d1decf9ec920c7cc3fa1ea831a"
+			"SHA256=43c72a98e48d04177c8223ccdfe88de6f09958f2330b6b9ee26882f1a77e369f"
 		)
 	endif()
 
@@ -87,11 +87,8 @@ if(NOT LIBS_DIR)
 	set(LIBS_DIR "${FALCOSECURITY_LIBS_SOURCE_DIR}")
 endif()
 
-# configure gVisor support
-set(BUILD_LIBSCAP_GVISOR
-	${BUILD_FALCO_GVISOR}
-	CACHE BOOL ""
-)
+# todo(ekoops): remove this once we remove gvisor from libs
+option(BUILD_LIBSCAP_GVISOR OFF)
 
 # configure modern BPF support
 set(BUILD_LIBSCAP_MODERN_BPF
@@ -108,6 +105,10 @@ set(BUILD_LIBSCAP_EXAMPLES
 	OFF
 	CACHE BOOL ""
 )
+set(BUILD_LIBSINSP_EXAMPLES
+	OFF
+	CACHE BOOL ""
+)
 
 set(USE_BUNDLED_TBB
 	ON

cmake/modules/gperftools.cmake

@@ -0,0 +1,132 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (C) 2026 The Falco Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+# in compliance with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License
+# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+# or implied. See the License for the specific language governing permissions and limitations under
+# the License.
+#
+
+# gperftools CPU profiler support This module provides: GPERFTOOLS_INCLUDE_DIR (include directory)
+# and GPERFTOOLS_PROFILER_LIB (the profiler library path)
+
+option(USE_BUNDLED_GPERFTOOLS "Build gperftools from source" ${USE_BUNDLED_DEPS})
+
+if(GPERFTOOLS_INCLUDE_DIR)
+	# Already have gperftools configured
+elseif(NOT USE_BUNDLED_GPERFTOOLS)
+	# Use system gperftools
+	find_path(
+		GPERFTOOLS_INCLUDE_DIR
+		NAMES gperftools/profiler.h
+		PATHS /usr/include /usr/local/include
+	)
+
+	find_library(
+		GPERFTOOLS_PROFILER_LIB
+		NAMES profiler
+		PATHS /usr/lib /usr/local/lib /usr/lib/x86_64-linux-gnu /usr/lib/aarch64-linux-gnu
+	)
+
+	if(GPERFTOOLS_INCLUDE_DIR AND GPERFTOOLS_PROFILER_LIB)
+		message(
+			STATUS
+				"Found system gperftools: include: ${GPERFTOOLS_INCLUDE_DIR}, lib: ${GPERFTOOLS_PROFILER_LIB}"
+		)
+	else()
+		message(
+			FATAL_ERROR
+				"Couldn't find system gperftools. Install it or use -DUSE_BUNDLED_GPERFTOOLS=ON\n"
+				"  Ubuntu/Debian: sudo apt-get install libgoogle-perftools-dev\n"
+				"  Fedora/RHEL:   sudo dnf install gperftools-devel\n"
+				"  macOS:         brew install gperftools"
+		)
+	endif()
+else()
+	# Build gperftools from source
+	set(GPERFTOOLS_SRC "${PROJECT_BINARY_DIR}/gperftools-prefix/src/gperftools")
+	set(GPERFTOOLS_INCLUDE_DIR "${GPERFTOOLS_SRC}/src")
+
+	if(BUILD_SHARED_LIBS)
+		set(GPERFTOOLS_LIB_SUFFIX ${CMAKE_SHARED_LIBRARY_SUFFIX})
+	else()
+		set(GPERFTOOLS_LIB_SUFFIX ${CMAKE_STATIC_LIBRARY_SUFFIX})
+	endif()
+
+	# The library is built in .libs subdirectory
+	set(GPERFTOOLS_PROFILER_LIB "${GPERFTOOLS_SRC}/.libs/libprofiler${GPERFTOOLS_LIB_SUFFIX}")
+
+	# gperftools version 2.15 (latest stable as of 2024)
+	set(GPERFTOOLS_VERSION "2.15")
+	set(GPERFTOOLS_URL
+		"https://github.com/gperftools/gperftools/releases/download/gperftools-${GPERFTOOLS_VERSION}/gperftools-${GPERFTOOLS_VERSION}.tar.gz"
+	)
+	set(GPERFTOOLS_URL_HASH
+		"SHA256=c69fef855628c81ef56f12e3c58f2b7ce1f326c0a1fe783e5cae0b88cbbe9a80"
+	)
+
+	message(STATUS "Building gperftools ${GPERFTOOLS_VERSION} from source")
+
+	# Configure options for gperftools
+	set(GPERFTOOLS_CONFIGURE_ARGS --enable-cpu-profiler --disable-heap-profiler
+								  --disable-heap-checker --disable-debugalloc
+	)
+
+	# Check if libunwind is available for better stack traces
+	find_library(LIBUNWIND_LIBRARY NAMES unwind)
+	if(LIBUNWIND_LIBRARY)
+		list(APPEND GPERFTOOLS_CONFIGURE_ARGS --enable-libunwind)
+		message(STATUS "gperftools: libunwind found, enabling for better stack traces")
+	else()
+		list(APPEND GPERFTOOLS_CONFIGURE_ARGS --disable-libunwind)
+		message(STATUS "gperftools: libunwind not found, using frame pointers for stack traces")
+	endif()
+
+	ExternalProject_Add(
+		gperftools
+		PREFIX "${PROJECT_BINARY_DIR}/gperftools-prefix"
+		URL "${GPERFTOOLS_URL}"
+		URL_HASH "${GPERFTOOLS_URL_HASH}"
+		CONFIGURE_COMMAND <SOURCE_DIR>/configure ${GPERFTOOLS_CONFIGURE_ARGS}
+		BUILD_COMMAND ${CMD_MAKE} ${PROCESSOUR_COUNT_MAKE_FLAG}
+		BUILD_IN_SOURCE 1
+		INSTALL_COMMAND ""
+		UPDATE_COMMAND ""
+		BUILD_BYPRODUCTS ${GPERFTOOLS_PROFILER_LIB}
+	)
+
+	install(
+		FILES "${GPERFTOOLS_PROFILER_LIB}"
+		DESTINATION "${CMAKE_INSTALL_LIBDIR}/${LIBS_PACKAGE_NAME}"
+		COMPONENT "libs-deps"
+		OPTIONAL
+	)
+endif()
+
+# Create a custom target so we can always depend on 'gperftools' regardless of bundled/system
+if(NOT TARGET gperftools)
+	add_custom_target(gperftools)
+endif()
+
+# Add include directory globally
+include_directories(${GPERFTOOLS_INCLUDE_DIR})
+
+# Add compile definition so code can detect profiling support
+add_compile_definitions(HAS_GPERFTOOLS)
+
+# Wrap the profiler library with --whole-archive to ensure the profiler's initialization code is
+# linked even though we don't call ProfilerStart() directly. This is required for the CPUPROFILE
+# environment variable to work.
+set(GPERFTOOLS_PROFILER_LIB "-Wl,--whole-archive" "${GPERFTOOLS_PROFILER_LIB}"
+							"-Wl,--no-whole-archive"
+)
+
+message(STATUS "gperftools CPU profiler enabled")
+message(STATUS "  Include dir: ${GPERFTOOLS_INCLUDE_DIR}")
+message(STATUS "  Library: ${GPERFTOOLS_PROFILER_LIB}")

cmake/modules/grpc.cmake

@@ -1,274 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-#
-# Copyright (C) 2023 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
-# in compliance with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License
-# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
-# or implied. See the License for the specific language governing permissions and limitations under
-# the License.
-#
-
-option(USE_BUNDLED_GRPC "Enable building of the bundled grpc" ${USE_BUNDLED_DEPS})
-
-if(GRPC_INCLUDE)
-	# we already have grpc
-elseif(NOT USE_BUNDLED_GRPC)
-	# gRPC
-	find_package(gRPC CONFIG)
-	if(gRPC_FOUND)
-		message(STATUS "Using gRPC ${gRPC_VERSION}")
-		set(GPR_LIB gRPC::gpr)
-		set(GRPC_LIB gRPC::grpc)
-		set(GRPCPP_LIB gRPC::grpc++)
-
-		# gRPC C++ plugin
-		get_target_property(GRPC_CPP_PLUGIN gRPC::grpc_cpp_plugin LOCATION)
-		if(NOT GRPC_CPP_PLUGIN)
-			message(FATAL_ERROR "System grpc_cpp_plugin not found")
-		endif()
-
-		# gRPC include dir + properly handle grpc{++,pp}
-		get_target_property(GRPC_INCLUDE gRPC::grpc++ INTERFACE_INCLUDE_DIRECTORIES)
-		find_path(
-			GRPCXX_INCLUDE
-			NAMES grpc++/grpc++.h
-			PATHS ${GRPC_INCLUDE}
-		)
-		if(NOT GRPCXX_INCLUDE)
-			find_path(
-				GRPCPP_INCLUDE
-				NAMES grpcpp/grpcpp.h
-				PATHS ${GRPC_INCLUDE}
-			)
-			add_definitions(-DGRPC_INCLUDE_IS_GRPCPP=1)
-		endif()
-	else()
-		# Fallback to manually find libraries; Some distro, namely Ubuntu focal, do not install gRPC
-		# config cmake module
-		find_library(GPR_LIB NAMES gpr)
-		if(GPR_LIB)
-			message(STATUS "Found gpr lib: ${GPR_LIB}")
-		else()
-			message(FATAL_ERROR "Couldn't find system gpr")
-		endif()
-		find_path(GRPCXX_INCLUDE NAMES grpc++/grpc++.h)
-		if(GRPCXX_INCLUDE)
-			set(GRPC_INCLUDE ${GRPCXX_INCLUDE})
-		else()
-			find_path(GRPCPP_INCLUDE NAMES grpcpp/grpcpp.h)
-			set(GRPC_INCLUDE ${GRPCPP_INCLUDE})
-			add_definitions(-DGRPC_INCLUDE_IS_GRPCPP=1)
-		endif()
-		find_library(GRPC_LIB NAMES grpc)
-		find_library(GRPCPP_LIB NAMES grpc++)
-		if(GRPC_INCLUDE
-		   AND GRPC_LIB
-		   AND GRPCPP_LIB
-		)
-			message(
-				STATUS
-					"Found grpc: include: ${GRPC_INCLUDE}, C lib: ${GRPC_LIB}, C++ lib: ${GRPCPP_LIB}"
-			)
-		else()
-			message(FATAL_ERROR "Couldn't find system grpc")
-		endif()
-		find_program(GRPC_CPP_PLUGIN grpc_cpp_plugin)
-		if(NOT GRPC_CPP_PLUGIN)
-			message(FATAL_ERROR "System grpc_cpp_plugin not found")
-		endif()
-	endif()
-else()
-	include(cares)
-	include(protobuf)
-	include(zlib)
-	include(openssl)
-	if(BUILD_SHARED_LIBS)
-		set(GRPC_OPENSSL_STATIC_LIBS_OPTION FALSE)
-	else()
-		set(GRPC_OPENSSL_STATIC_LIBS_OPTION TRUE)
-	endif()
-	include(re2)
-	set(GRPC_SRC "${PROJECT_BINARY_DIR}/grpc-prefix/src/grpc")
-	set(GRPC_INSTALL_DIR "${GRPC_SRC}/target")
-	set(GRPC_INCLUDE "${GRPC_INSTALL_DIR}/include" "${GRPC_SRC}/third_party/abseil-cpp")
-	set(GPR_LIB "${GRPC_SRC}/libgpr.a")
-	set(GRPC_LIB "${GRPC_SRC}/libgrpc.a")
-	set(GRPCPP_LIB "${GRPC_SRC}/libgrpc++.a")
-	set(GRPC_CPP_PLUGIN "${GRPC_SRC}/grpc_cpp_plugin")
-	set(GRPC_MAIN_LIBS "")
-	list(
-		APPEND
-		GRPC_MAIN_LIBS
-		"${GPR_LIB}"
-		"${GRPC_LIB}"
-		"${GRPCPP_LIB}"
-		"${GRPC_SRC}/libgrpc++_alts.a"
-		"${GRPC_SRC}/libgrpc++_error_details.a"
-		"${GRPC_SRC}/libgrpc++_reflection.a"
-		"${GRPC_SRC}/libgrpc++_unsecure.a"
-		"${GRPC_SRC}/libgrpc_plugin_support.a"
-		"${GRPC_SRC}/libgrpc_unsecure.a"
-		"${GRPC_SRC}/libgrpcpp_channelz.a"
-	)
-
-	get_filename_component(PROTOC_DIR ${PROTOC} PATH)
-
-	if(NOT TARGET grpc)
-		message(STATUS "Using bundled grpc in '${GRPC_SRC}'")
-
-		# fixme(leogr): this workaround is required to inject the missing deps (built by gRCP
-		# cmakefiles) into target_link_libraries later note: the list below is manually generated
-		# starting from the output of pkg-config --libs grpc++
-		set(GRPC_LIBRARIES "")
-		list(
-			APPEND
-			GRPC_LIBRARIES
-			"${GRPC_SRC}/libaddress_sorting.a"
-			"${GRPC_SRC}/libupb.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/hash/libabsl_hash.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/hash/libabsl_city.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/hash/libabsl_low_level_hash.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/container/libabsl_raw_hash_set.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/container/libabsl_hashtablez_sampler.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/status/libabsl_statusor.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/status/libabsl_status.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/strings/libabsl_cord.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/strings/libabsl_cordz_functions.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/profiling/libabsl_exponential_biased.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/types/libabsl_bad_optional_access.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/types/libabsl_bad_variant_access.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/strings/libabsl_str_format_internal.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/synchronization/libabsl_synchronization.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/synchronization/libabsl_graphcycles_internal.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/debugging/libabsl_stacktrace.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/debugging/libabsl_symbolize.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/debugging/libabsl_debugging_internal.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/debugging/libabsl_demangle_internal.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/base/libabsl_malloc_internal.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/time/libabsl_time.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/time/libabsl_civil_time.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/strings/libabsl_strings.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/strings/libabsl_strings_internal.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/base/libabsl_base.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/base/libabsl_spinlock_wait.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/numeric/libabsl_int128.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/base/libabsl_throw_delegate.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/base/libabsl_raw_logging_internal.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/base/libabsl_log_severity.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/time/libabsl_time_zone.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/strings/libabsl_cord_internal.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/strings/libabsl_cordz_info.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/strings/libabsl_cordz_handle.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/random/libabsl_random_internal_pool_urbg.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/random/libabsl_random_internal_randen.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/random/libabsl_random_internal_randen_hwaes.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/random/libabsl_random_internal_randen_hwaes_impl.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/random/libabsl_random_internal_randen_slow.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/random/libabsl_random_internal_seed_material.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/random/libabsl_random_internal_platform.a"
-			"${GRPC_SRC}/third_party/abseil-cpp/absl/random/libabsl_random_seed_gen_exception.a"
-		)
-
-		# Make abseil-cpp build compatible with gcc-13 See
-		# https://patchwork.yoctoproject.org/project/oe/patch/20230518093301.2938164-1-Martin.Jansa@gmail.com/
-		# TO BE DROPPED once we finally upgrade grpc...
-		set(GRPC_PATCH_CMD
-			sh
-			-c
-			"sed -i '20s/^/#include <cstdint>/' ${GRPC_SRC}/third_party/abseil-cpp/absl/strings/internal/str_format/extension.h"
-		)
-
-		# Zig workaround: Add a PATCH_COMMAND to grpc cmake to fixup emitted -march by abseil-cpp
-		# cmake module, making it use a name understood by zig for arm64. See
-		# https://github.com/abseil/abseil-cpp/blob/master/absl/copts/GENERATED_AbseilCopts.cmake#L226.
-		if(CMAKE_C_COMPILER MATCHES "zig")
-			message(STATUS "Enabling zig workaround for abseil-cpp")
-			set(GRPC_PATCH_CMD
-				${GRPC_PATCH_CMD}
-				&&
-				sh
-				-c
-				"sed -i 's/armv8-a/cortex_a57/g' ${GRPC_SRC}/third_party/abseil-cpp/absl/copts/GENERATED_AbseilCopts.cmake"
-			)
-		endif()
-
-		ExternalProject_Add(
-			grpc
-			PREFIX "${PROJECT_BINARY_DIR}/grpc-prefix"
-			DEPENDS openssl protobuf c-ares zlib re2
-			GIT_REPOSITORY https://github.com/grpc/grpc.git
-			GIT_TAG v1.44.0
-			GIT_SUBMODULES "third_party/abseil-cpp"
-			CMAKE_CACHE_ARGS
-				-DCMAKE_INSTALL_PREFIX:PATH=${GRPC_INSTALL_DIR}
-				-DCMAKE_BUILD_TYPE:STRING=${CMAKE_BUILD_TYPE}
-				-DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=${ENABLE_PIC}
-				-DgRPC_INSTALL:BOOL=OFF
-				# disable unused stuff
-				-DgRPC_BUILD_TESTS:BOOL=OFF
-				-DgRPC_BUILD_CSHARP_EXT:BOOL=OFF
-				-DgRPC_BUILD_GRPC_CSHARP_PLUGIN:BOOL=OFF
-				-DgRPC_BUILD_GRPC_NODE_PLUGIN:BOOL=OFF
-				-DgRPC_BUILD_GRPC_OBJECTIVE_C_PLUGIN:BOOL=OFF
-				-DgRPC_BUILD_GRPC_PHP_PLUGIN:BOOL=OFF
-				-DgRPC_BUILD_GRPC_PYTHON_PLUGIN:BOOL=OFF
-				-DgRPC_BUILD_GRPC_RUBY_PLUGIN:BOOL=OFF
-				# deps provided by us
-				# https://github.com/grpc/grpc/blob/v1.32.0/cmake/modules/Findc-ares.cmake
-				-DgRPC_CARES_PROVIDER:STRING=package
-				-Dc-ares_DIR:PATH=${CARES_SRC}
-				-Dc-ares_INCLUDE_DIR:PATH=${CARES_INCLUDE}
-				-Dc-ares_LIBRARY:PATH=${CARES_LIB}
-				# https://cmake.org/cmake/help/v3.6/module/FindProtobuf.html
-				-DgRPC_PROTOBUF_PROVIDER:STRING=package
-				-DCMAKE_CXX_FLAGS:STRING=-I${PROTOBUF_INCLUDE}
-				-DProtobuf_INCLUDE_DIR:PATH=${PROTOBUF_INCLUDE}
-				-DProtobuf_LIBRARY:PATH=${PROTOBUF_LIB}
-				-DProtobuf_PROTOC_LIBRARY:PATH=${PROTOC_LIB}
-				-DProtobuf_PROTOC_EXECUTABLE:PATH=${PROTOC}
-				# https://cmake.org/cmake/help/v3.6/module/FindOpenSSL.html
-				-DgRPC_SSL_PROVIDER:STRING=package
-				-DOPENSSL_ROOT_DIR:PATH=${OPENSSL_INSTALL_DIR}
-				-DOPENSSL_USE_STATIC_LIBS:BOOL=${GRPC_OPENSSL_STATIC_LIBS_OPTION}
-				# https://cmake.org/cmake/help/v3.6/module/FindZLIB.html
-				-DgRPC_ZLIB_PROVIDER:STRING=package
-				-DZLIB_ROOT:STRING=${ZLIB_SRC}
-				# RE2
-				-DgRPC_RE2_PROVIDER:STRING=package
-				-Dre2_DIR:PATH=${RE2_DIR}
-			BUILD_IN_SOURCE 1
-			BUILD_BYPRODUCTS ${GRPC_LIB} ${GRPCPP_LIB} ${GPR_LIB} ${GRPC_LIBRARIES}
-			# Keep installation files into the local ${GRPC_INSTALL_DIR} since here is the case when
-			# we are embedding gRPC
-			UPDATE_COMMAND ""
-			PATCH_COMMAND ${GRPC_PATCH_CMD}
-			INSTALL_COMMAND DESTDIR= ${CMAKE_MAKE_PROGRAM} install
-		)
-		install(
-			FILES ${GRPC_MAIN_LIBS}
-			DESTINATION "${CMAKE_INSTALL_LIBDIR}/${LIBS_PACKAGE_NAME}"
-			COMPONENT "libs-deps"
-		)
-		install(
-			FILES ${GRPC_LIBRARIES}
-			DESTINATION "${CMAKE_INSTALL_LIBDIR}/${LIBS_PACKAGE_NAME}"
-			COMPONENT "libs-deps"
-		)
-		install(
-			DIRECTORY "${GRPC_SRC}/target/include/"
-			DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/${LIBS_PACKAGE_NAME}"
-			COMPONENT "libs-deps"
-		)
-	endif()
-endif()
-
-if(NOT TARGET grpc)
-	add_custom_target(grpc)
-endif()
-
-include_directories("${GRPC_INCLUDE}")

cmake/modules/jemalloc.cmake

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright (C) 2024 The Falco Authors.
+# Copyright (C) 2025 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 # in compliance with the License. You may obtain a copy of the License at
@@ -25,9 +25,9 @@ elseif(NOT USE_BUNDLED_JEMALLOC)
 	else()
 		set(JEMALLOC_LIB_SUFFIX ${CMAKE_STATIC_LIBRARY_SUFFIX})
 	endif()
-	find_library(JEMALLOC_LIB NAMES libjemalloc${JEMALLOC_LIB_SUFFIX})
-	if(JEMALLOC_LIB)
-		message(STATUS "Found JEMALLOC: include: ${JEMALLOC_INCLUDE}, lib: ${JEMALLOC_LIB}")
+	find_library(MALLOC_LIB NAMES libjemalloc${JEMALLOC_LIB_SUFFIX})
+	if(MALLOC_LIB)
+		message(STATUS "Found system jemalloc: include: ${JEMALLOC_INCLUDE}, lib: ${MALLOC_LIB}")
 	else()
 		message(FATAL_ERROR "Couldn't find system jemalloc")
 	endif()
@@ -38,15 +38,15 @@ else()
 		set(JEMALLOC_LIB_SUFFIX ${CMAKE_STATIC_LIBRARY_SUFFIX})
 	endif()
 	set(JEMALLOC_SRC "${PROJECT_BINARY_DIR}/jemalloc-prefix/src")
-	set(JEMALLOC_LIB "${JEMALLOC_SRC}/jemalloc/lib/libjemalloc${JEMALLOC_LIB_SUFFIX}")
-	set(JEMALLOC_INCLUDE "${JEMALLOC_SRC}/jemalloc/include/jemalloc")
+	set(MALLOC_LIB "${JEMALLOC_SRC}/malloc/lib/libjemalloc${JEMALLOC_LIB_SUFFIX}")
+	set(JEMALLOC_INCLUDE "${JEMALLOC_SRC}/malloc/include/jemalloc")
 	if(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64")
 		set(JEMALLOC_ARCH_SPECIFIC_CONFIGURE_ARGS --with-lg-page=14)
 	else()
 		set(JEMALLOC_ARCH_SPECIFIC_CONFIGURE_ARGS "")
 	endif()
 	ExternalProject_Add(
-		jemalloc
+		malloc
 		PREFIX "${PROJECT_BINARY_DIR}/jemalloc-prefix"
 		URL "https://github.com/jemalloc/jemalloc/archive/refs/tags/5.3.0.tar.gz"
 		URL_HASH "SHA256=ef6f74fd45e95ee4ef7f9e19ebe5b075ca6b7fbe0140612b2a161abafb7ee179"
@@ -56,11 +56,10 @@ else()
 		BUILD_COMMAND make build_lib_static
 		INSTALL_COMMAND ""
 		UPDATE_COMMAND ""
-		BUILD_BYPRODUCTS ${JEMALLOC_LIB}
+		BUILD_BYPRODUCTS ${MALLOC_LIB}
 	)
-	message(STATUS "Using bundled jemalloc: include: ${JEMALLOC_INCLUDE}, lib: ${JEMALLOC_LIB}")
 	install(
-		FILES "${JEMALLOC_LIB}"
+		FILES "${MALLOC_LIB}"
 		DESTINATION "${CMAKE_INSTALL_LIBDIR}/${LIBS_PACKAGE_NAME}"
 		COMPONENT "libs-deps"
 	)
@@ -68,8 +67,8 @@ endif()
 
 # We add a custom target, in this way we can always depend on `jemalloc` without distinguishing
 # between "bundled" and "not-bundled" case
-if(NOT TARGET jemalloc)
-	add_custom_target(jemalloc)
+if(NOT TARGET malloc)
+	add_custom_target(malloc)
 endif()
 
 include_directories(${JEMALLOC_INCLUDE})

cmake/modules/mimalloc.cmake

@@ -0,0 +1,92 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (C) 2025 The Falco Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+# in compliance with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License
+# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+# or implied. See the License for the specific language governing permissions and limitations under
+# the License.
+#
+
+option(USE_BUNDLED_MIMALLOC "Use bundled mimalloc (microsoft) allocator" ${USE_BUNDLED_DEPS})
+
+if(MIMALLOC_INCLUDE)
+	# we already have MIMALLOC
+elseif(NOT USE_BUNDLED_MIMALLOC)
+	find_path(MIMALLOC_INCLUDE mimalloc/mimalloc.h)
+	set(MIMALLOC_INCLUDE ${MIMALLOC_INCLUDE}/mimalloc)
+	if(BUILD_SHARED_LIBS)
+		set(MIMALLOC_LIB_SUFFIX ${CMAKE_SHARED_LIBRARY_SUFFIX})
+	else()
+		set(MIMALLOC_LIB_SUFFIX ${CMAKE_STATIC_LIBRARY_SUFFIX})
+	endif()
+	find_library(MALLOC_LIB NAMES libmimalloc${MIMALLOC_LIB_SUFFIX})
+	if(MALLOC_LIB)
+		message(STATUS "Found system mimalloc: include: ${MIMALLOC_INCLUDE}, lib: ${MALLOC_LIB}")
+	else()
+		message(FATAL_ERROR "Couldn't find system mimalloc")
+	endif()
+else()
+	if(BUILD_SHARED_LIBS)
+		set(BUILD_STATIC Off)
+		set(MIMALLOC_LIB_SUFFIX ${CMAKE_SHARED_LIBRARY_SUFFIX})
+	else()
+		set(BUILD_STATIC On)
+		set(MIMALLOC_LIB_SUFFIX ${CMAKE_STATIC_LIBRARY_SUFFIX})
+	endif()
+	set(MIMALLOC_SRC "${PROJECT_BINARY_DIR}/mimalloc-prefix/src")
+	string(TOLOWER "${CMAKE_BUILD_TYPE}" _build_type)
+	if(_build_type STREQUAL "debug")
+		set(MIMALLOC_LIB_BASENAME "libmimalloc-debug")
+	else()
+		set(MIMALLOC_LIB_BASENAME "libmimalloc")
+	endif()
+	set(MALLOC_LIB "${MIMALLOC_SRC}/malloc-build/${MIMALLOC_LIB_BASENAME}${MIMALLOC_LIB_SUFFIX}")
+	set(MIMALLOC_INCLUDE ${MIMALLOC_SRC}/malloc/include/)
+
+	# To avoid recent clang versions complaining with "error: expansion of date or time macro is not
+	# reproducible" while building mimalloc, we force-set both variables.
+	string(TIMESTAMP DATE "%Y%m%d")
+	string(TIMESTAMP TIME "%H:%M")
+	set(MIMALLOC_EXTRA_CPPDEFS __DATE__="${DATE}",__TIME__="${TIME}")
+
+	# We disable arch specific optimization because of issues with building with zig. Optimizations
+	# would be only effective on arm64. See MI_NO_OPT_ARCH=On.
+	ExternalProject_Add(
+		malloc
+		PREFIX "${PROJECT_BINARY_DIR}/mimalloc-prefix"
+		URL "https://github.com/microsoft/mimalloc/archive/refs/tags/v3.1.5.tar.gz"
+		URL_HASH "SHA256=1c6949032069d5ebea438ec5cedd602d06f40a92ddf0f0d9dcff0993e5f6635c"
+		LIST_SEPARATOR "," # to pass MIMALLOC_EXTRA_CPPDEFS as list
+		CMAKE_ARGS -DBUILD_SHARED_LIBS=${BUILD_SHARED_LIBS}
+				   -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
+				   -DMI_BUILD_SHARED=${BUILD_SHARED_LIBS}
+				   -DMI_BUILD_STATIC=${BUILD_STATIC}
+				   -DMI_BUILD_TESTS=Off
+				   -DMI_BUILD_OBJECT=Off
+				   -DMI_NO_OPT_ARCH=On
+				   -DMI_EXTRA_CPPDEFS=${MIMALLOC_EXTRA_CPPDEFS}
+		INSTALL_COMMAND ""
+		UPDATE_COMMAND ""
+		BUILD_BYPRODUCTS ${MALLOC_LIB}
+	)
+	install(
+		FILES "${MALLOC_LIB}"
+		DESTINATION "${CMAKE_INSTALL_LIBDIR}/${LIBS_PACKAGE_NAME}"
+		COMPONENT "libs-deps"
+	)
+endif()
+
+# We add a custom target, in this way we can always depend on `mimalloc` without distinguishing
+# between "bundled" and "not-bundled" case
+if(NOT TARGET malloc)
+	add_custom_target(malloc)
+endif()
+
+include_directories(${MIMALLOC_INCLUDE})
+add_compile_definitions(HAS_MIMALLOC)

cmake/modules/rules.cmake

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright (C) 2024 The Falco Authors.
+# Copyright (C) 2025 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 # in compliance with the License. You may obtain a copy of the License at
@@ -18,9 +18,9 @@ include(ExternalProject)
 
 if(NOT DEFINED FALCOSECURITY_RULES_FALCO_PATH)
 	# falco_rules.yaml
-	set(FALCOSECURITY_RULES_FALCO_VERSION "falco-rules-3.2.0")
+	set(FALCOSECURITY_RULES_FALCO_VERSION "falco-rules-5.0.0")
 	set(FALCOSECURITY_RULES_FALCO_CHECKSUM
-		"SHA256=b3990bf0209cfbf6a903b361e458a1f5851a9a5aeee808ad26a5ddbe1377157d"
+		"SHA256=ca87d972e102a9f960fed41f90d2736a73079fcc7e787187028f455ad58b1637"
 	)
 	set(FALCOSECURITY_RULES_FALCO_PATH
 		"${PROJECT_BINARY_DIR}/falcosecurity-rules-falco-prefix/src/falcosecurity-rules-falco/falco_rules.yaml"

docker/driver-loader-buster/Dockerfile

@@ -1,22 +1,38 @@
 FROM debian:buster
 
-LABEL maintainer="cncf-falco-dev@lists.cncf.io"
-LABEL org.opencontainers.image.source="https://github.com/falcosecurity/falco"
+ARG FALCO_COMMIT_SHA
+ARG FALCO_VERSION=latest
+
+LABEL org.opencontainers.image.authors='The Falco Authors https://falco.org' \
+      org.opencontainers.image.url='https://falco.org' \
+      org.opencontainers.image.source='https://github.com/falcosecurity/falco' \
+      org.opencontainers.image.vendor='Falco Organization' \
+      org.opencontainers.image.licenses='Apache-2.0' \
+      org.opencontainers.image.revision=${FALCO_COMMIT_SHA} \
+      org.opencontainers.image.version=${FALCO_VERSION} \
+      maintainer="cncf-falco-dev@lists.cncf.io"
 
 LABEL usage="docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro falcosecurity/falco-driver-loader:latest-buster [driver] [options]"
 
 ARG TARGETARCH
 
-ARG FALCO_VERSION=latest
 ARG VERSION_BUCKET=deb
-ENV VERSION_BUCKET=${VERSION_BUCKET}
-
-ENV FALCO_VERSION=${FALCO_VERSION}
-ENV HOST_ROOT /host
-ENV HOME /root
+ARG HOST_ROOT=/host
+ARG HOME=/root
+ENV FALCO_VERSION="${FALCO_VERSION}" \
+    VERSION_BUCKET="${VERSION_BUCKET}" \
+    HOST_ROOT="${HOST_ROOT}" \
+    HOME="${HOME}"
 
 RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
 
+# Use 20250630T203427Z debian apt snapshot as it still contains support for buster.
+RUN cat <<EOF > /etc/apt/sources.list
+deb http://snapshot.debian.org/archive/debian/20250630T203427Z buster main
+deb http://snapshot.debian.org/archive/debian-security/20250630T203427Z buster/updates main
+deb http://snapshot.debian.org/archive/debian/20250630T203427Z buster-updates main
+EOF
+
 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends \
 	bash-completion \
@@ -121,6 +137,6 @@ RUN curl -L -o binutils_2.30-22_${TARGETARCH}.deb https://download.falco.org/dep
 	&& dpkg -i *binutils*.deb \
 	&& rm -f *binutils*.deb
 
-COPY ./docker/driver-loader-buster/docker-entrypoint.sh /
+COPY docker/driver-loader-buster/docker-entrypoint.sh /
 
 ENTRYPOINT ["/docker-entrypoint.sh"]

docker/driver-loader-buster/docker-entrypoint.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright (C) 2023 The Falco Authors.
+# Copyright (C) 2026 The Falco Authors.
 #
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -27,7 +27,6 @@ print_usage() {
 	echo "  auto	       leverage automatic driver selection logic (default)"
 	echo "  modern_ebpf    modern eBPF CORE probe"
 	echo "  kmod           kernel module"
-	echo "  ebpf           eBPF probe"
 	echo ""
 	echo "Options:"
 	echo "  --help           show this help message"
@@ -59,7 +58,7 @@ driver=
 has_opts=
 while test $# -gt 0; do
 	case "$1" in
-		auto|kmod|ebpf|modern_ebpf)
+		auto|kmod|modern_ebpf)
 			if [ -n "$driver" ]; then
 				>&2 echo "Only one driver per invocation"
 				print_usage
@@ -120,7 +119,7 @@ if [ "$driver" != "auto" ]; then
   /usr/bin/falcoctl driver config --type $driver
 else
   # Needed because we need to configure Falco to start with correct driver
-  /usr/bin/falcoctl driver config --type modern_ebpf --type kmod --type ebpf
+  /usr/bin/falcoctl driver config --type modern_ebpf --type kmod
 fi
 
 /usr/bin/falcoctl driver install --compile=$ENABLE_COMPILE --download=$ENABLE_DOWNLOAD --http-insecure=$HTTP_INSECURE --http-headers="$FALCOCTL_DRIVER_HTTP_HEADERS"

docker/driver-loader/Dockerfile

@@ -1,13 +1,22 @@
 ARG FALCO_IMAGE_TAG=latest
 FROM docker.io/falcosecurity/falco:${FALCO_IMAGE_TAG}-debian
 
-LABEL maintainer="cncf-falco-dev@lists.cncf.io"
-LABEL org.opencontainers.image.source="https://github.com/falcosecurity/falco"
+ARG FALCO_COMMIT_SHA
+ARG FALCO_VERSION
+
+LABEL org.opencontainers.image.authors='The Falco Authors https://falco.org' \
+      org.opencontainers.image.url='https://falco.org' \
+      org.opencontainers.image.source='https://github.com/falcosecurity/falco' \
+      org.opencontainers.image.vendor='Falco Organization' \
+      org.opencontainers.image.licenses='Apache-2.0' \
+      org.opencontainers.image.revision=${FALCO_COMMIT_SHA} \
+      org.opencontainers.image.version=${FALCO_VERSION} \
+      maintainer="cncf-falco-dev@lists.cncf.io"
 
 LABEL usage="docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro falcosecurity/falco-driver-loader:latest [driver] [options]"
 
-ENV HOST_ROOT /host
-ENV HOME /root
+ENV HOST_ROOT=/host
+ENV HOME=/root
 
 RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
 

docker/driver-loader/docker-entrypoint.sh

@@ -27,7 +27,6 @@ print_usage() {
 	echo "  auto	       leverage automatic driver selection logic (default)"
 	echo "	modern_ebpf    modern eBPF CORE probe"
 	echo "  kmod           kernel module"
-	echo "  ebpf           eBPF probe"
 	echo ""
 	echo "Options:"
 	echo "  --help                   show this help message"
@@ -64,7 +63,7 @@ extra_args=
 
 while test $# -gt 0; do
 	case "$1" in
-		auto|kmod|ebpf|modern_ebpf)
+		auto|kmod|modern_ebpf)
 			if [ -n "$driver" ]; then
 				>&2 echo "Only one driver per invocation"
 				print_usage
@@ -133,7 +132,7 @@ if [ "$driver" != "auto" ]; then
   /usr/bin/falcoctl driver config --type $driver
 else
   # Needed because we need to configure Falco to start with correct driver
-  /usr/bin/falcoctl driver config --type modern_ebpf --type kmod --type ebpf
+  /usr/bin/falcoctl driver config --type modern_ebpf --type kmod
 fi
 
 /usr/bin/falcoctl driver install --compile=$ENABLE_COMPILE --download=$ENABLE_DOWNLOAD --http-insecure=$HTTP_INSECURE --http-headers="$FALCOCTL_DRIVER_HTTP_HEADERS" $extra_args

docker/falco-debian/Dockerfile

@@ -1,20 +1,29 @@
 FROM debian:12-slim
 
-LABEL maintainer="cncf-falco-dev@lists.cncf.io"
-LABEL org.opencontainers.image.source="https://github.com/falcosecurity/falco/docker/falco-debian"
+ARG FALCO_COMMIT_SHA
+ARG FALCO_VERSION
+
+LABEL org.opencontainers.image.authors='The Falco Authors https://falco.org' \
+      org.opencontainers.image.url='https://falco.org' \
+      org.opencontainers.image.source='https://github.com/falcosecurity/falco' \
+      org.opencontainers.image.vendor='Falco Organization' \
+      org.opencontainers.image.licenses='Apache-2.0' \
+      org.opencontainers.image.revision=${FALCO_COMMIT_SHA} \
+      org.opencontainers.image.version=${FALCO_VERSION} \
+      maintainer="cncf-falco-dev@lists.cncf.io"
 
 LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /proc:/host/proc:ro -v /etc:/host/etc:ro falcosecurity/falco:latest-debian"
 
-ARG FALCO_VERSION
 ARG VERSION_BUCKET=deb
+ARG HOST_ROOT=/host
+ARG HOME=/root
 
-ENV FALCO_VERSION=${FALCO_VERSION}
-ENV VERSION_BUCKET=${VERSION_BUCKET}
+ENV FALCO_VERSION="${FALCO_VERSION}" \
+    VERSION_BUCKET="${VERSION_BUCKET}" \
+    HOST_ROOT="${HOST_ROOT}" \
+    HOME="${HOME}"
 
-ENV HOST_ROOT /host
-ENV HOME /root
-
-RUN apt-get -y update && apt-get -y install ca-certificates curl jq ca-certificates gnupg2 \
+RUN apt-get -y update && apt-get -y install curl jq ca-certificates gnupg2 \
 	&& apt clean -y && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /
@@ -27,6 +36,6 @@ RUN curl -s https://falco.org/repo/falcosecurity-packages.asc | apt-key add - \
 	&& rm -rf /var/lib/apt/lists/*
 
 # Change the falco config within the container to enable ISO 8601 output.
-ADD ./config/falco.iso8601_timeformat.yaml /etc/falco/config.d/
+ADD config/falco.iso8601_timeformat.yaml /etc/falco/config.d/
 
 CMD ["/usr/bin/falco"]

docker/falco/Dockerfile

@@ -1,37 +1,48 @@
 FROM cgr.dev/chainguard/wolfi-base
 
-LABEL maintainer="cncf-falco-dev@lists.cncf.io"
-LABEL org.opencontainers.image.source="https://github.com/falcosecurity/falco"
+ARG FALCO_COMMIT_SHA
+ARG FALCO_VERSION
+
+LABEL org.opencontainers.image.authors='The Falco Authors https://falco.org' \
+      org.opencontainers.image.url='https://falco.org' \
+      org.opencontainers.image.source='https://github.com/falcosecurity/falco' \
+      org.opencontainers.image.vendor='Falco Organization' \
+      org.opencontainers.image.licenses='Apache-2.0' \
+      org.opencontainers.image.revision=${FALCO_COMMIT_SHA} \
+      org.opencontainers.image.version=${FALCO_VERSION} \
+      maintainer="cncf-falco-dev@lists.cncf.io"
 
 LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /proc:/host/proc:ro  -v /etc:/host/etc:ro falcosecurity/falco:latest"
 # NOTE: for the "least privileged" use case, please refer to the official documentation
 
-ARG FALCO_VERSION
 ARG VERSION_BUCKET=bin
+ARG HOST_ROOT=/host
+ARG HOME=/root
 
-ENV FALCO_VERSION=${FALCO_VERSION}
-ENV VERSION_BUCKET=${VERSION_BUCKET}
-ENV HOST_ROOT /host
-ENV HOME /root
+ENV FALCO_VERSION="${FALCO_VERSION}" \
+    VERSION_BUCKET="${VERSION_BUCKET}" \
+    HOST_ROOT="${HOST_ROOT}" \
+    HOME="${HOME}"
 
 RUN apk update && apk add curl ca-certificates jq libstdc++
 
 WORKDIR /
 
-RUN FALCO_VERSION_URLENCODED=$(echo -n ${FALCO_VERSION}|jq -sRr @uri) && \
+RUN ARCH=$(uname -m) && \
+    FALCO_VERSION_URLENCODED=$(echo -n "${FALCO_VERSION}" | jq -sRr @uri) && \
+    echo "Downloading Falco ${FALCO_VERSION} for ${ARCH}" && \
     curl -L -o falco.tar.gz \
-    https://download.falco.org/packages/${VERSION_BUCKET}/$(uname -m)/falco-${FALCO_VERSION_URLENCODED}-$(uname -m).tar.gz && \
+    https://download.falco.org/packages/${VERSION_BUCKET}/${ARCH}/falco-${FALCO_VERSION_URLENCODED}-${ARCH}.tar.gz && \
     tar -xvf falco.tar.gz && \
     rm -f falco.tar.gz && \
-    mv falco-${FALCO_VERSION}-$(uname -m) falco && \
+    mv falco-${FALCO_VERSION}-${ARCH} falco && \
     rm -rf /falco/usr/src/falco-* && \
     cp -r /falco/* / && \
-    rm -rf /falco
+    rm -rf /falco && \
+    rm -rf /usr/bin/falcoctl /etc/falcoctl/
+
 
 # Change the falco config within the container to enable ISO 8601 output.
-ADD ./config/falco.iso8601_timeformat.yaml /etc/falco/config.d/
-
-# Falcoctl is not included here.
-RUN rm -rf /usr/bin/falcoctl /etc/falcoctl/
+ADD config/falco.iso8601_timeformat.yaml /etc/falco/config.d/
 
 CMD ["/usr/bin/falco"]

proposals/20251205-multi-thread-falco-design.md

@@ -0,0 +1,186 @@
+# Multi-Threaded Falco High-Level Design (Working draft)
+
+## Summary
+
+This document outlines a high-level design for implementing multi-threading in Falco. The goal of this proposal is to overcome Falco's single-threaded architecture to improve scalability in scenarios where the amount of events produced cannot be processed in a single thread. This is achieved by leveraging multiple threads for event processing, rule evaluation, and output handling, enabling Falco to better utilize multi-core systems and reduce event drops under high event rates.
+
+## Goals
+
+* Address the problems related to single CPU core saturation, leading to dropped events.
+* Minimize the performance impact on the single threaded usage, that remains the default. 
+
+## Non-Goals
+
+* This document does not cover low-level implementation details that will be addressed in specific design documents for each component or directly in the implementation phase.
+* This document does not focus on performance optimization, the primary goal is scalability improvements to handle higher event rates that exceed single-thread processing capacity.
+
+## Success Metrics
+
+The success of this multi-threading initiative will be measured by the following key metrics:
+
+* **Event Drop Rate Reduction**: The primary success metric is the reduction in event drops under high event rates. A successful implementation should significantly reduce or eliminate event drops that occur when a single thread cannot keep up with the event rate.
+* **Throughput Scaling**: The system should demonstrate improved throughput (events processed per second) that scales with the number of worker threads, up to a reasonable limit based on available CPU cores and workload characteristics.
+* **CPU Utilization**: Multi-threaded Falco should better utilize available CPU cores, with worker threads distributing load across multiple cores instead of saturating a single core.
+* **Single-Threaded Performance Preservation**: The single-threaded mode (default) should maintain its current performance characteristics, with minimal or no performance regression when multi-threading is disabled.
+
+These metrics will be evaluated through benchmarking and real-world deployment scenarios to validate that the multi-threaded architecture achieves its scalability goals without compromising correctness or introducing significant overhead.
+
+## High-Level Design
+
+### Current Architecture
+
+![Current Falco Architecture](images/falco-architecture.png)
+
+* The kernel driver (via kmod or eBPF) writes events into per-CPU ring buffers. Each CPU has its own buffer to avoid lock contention. We have a ring buffer per CPU core, and a single userspace.
+* Userspace (libscap) performs an `O(n_cpus)` scan on every next() call, it peeks at the head event from each ring buffer, finds the event with the minimum timestamp across all buffers and returns that event to Falco for processing. The consumer position is only advanced after the event has been consumed (on the next call), ensuring the caller can safely read the event data and avoiding the need to perform copies of the event data.
+* Libsinsp processes the events sequentially as they are received from libscap, building a stateful representation of the system and providing the necessary context for rule evaluation.
+* Falco evaluates the rules against the processed events and generates alerts based on the defined security policies.
+
+### Proposed Architecture Overview
+
+![Multi-Threaded Falco Architecture](images/falco-multi-thread-architecture.png)
+
+* The kernel driver (modern eBPF probe) routes events into per-partition ring buffers based on TGID. The routing logic executes in kernel space (within the eBPF program), where each event's TGID is hashed and used to select the target ring buffer. Only the modern eBPF probe is supported, as it relies on [BPF_MAP_TYPE_RINGBUF](https://docs.ebpf.io/linux/map-type/BPF_MAP_TYPE_RINGBUF/) which does not have a per-CPU design as opposed to the `BPF_MAP_TYPE_PERF_EVENT_ARRAY` used by the legacy eBPF probe.
+* Each ring buffer is associated with an event loop worker thread that processes events from its assigned ring buffer.
+* The `libsinsp` state (e.g., the thread state) is maintained in a shared data structure, allowing all workers to access data pushed by other workers. This is crucial for handling events like clone() that rely on data written by other partitions. This requires designing lightweight synchronization mechanisms to ensure efficient access to shared state without introducing significant contention. A dedicated proposal document will address the design of the shared state and synchronization mechanisms, and data consistency.
+* Falco's rule evaluation is performed in parallel by multiple worker threads, each evaluating rules against the events they process. Current Falco plugins are not supposed to be thread-safe. A dedicated proposal document will address the design of a thread-safe plugin architecture.
+* **Output handling** is already designed for multi-threaded access. The `falco_outputs` class implements a thread-safe, queue-based architecture using Intel TBB's `concurrent_bounded_queue`, which is specifically designed for multi-producer, single-consumer scenarios. Multiple worker threads can concurrently call `handle_event()` to enqueue alert messages using the thread-safe `try_push()` operation. A dedicated output worker thread consumes messages from the queue using `pop()` and sends them to all configured outputs (stdout, file, syslog, gRPC, HTTP, etc.). This design is already proven in production, as Falco's multi-source support (where different event sources run in separate threads) already uses this same queue concurrently. The existing implementation requires no changes to support multi-threaded event processing. Note that while outputs are processed in order within the queue, alerts from different worker threads may be interleaved, meaning strict temporal ordering of alerts across different processes is not guaranteed. This is acceptable for security monitoring use cases where the primary concern is detecting and reporting security events rather than maintaining precise event ordering.
+
+### Work Partitioning Strategies
+
+A crucial and challenging design aspect is partitioning the work to achieve a good trade-off among the following properties:
+
+1. **Even load balancing** between threads
+2. **Low contention** on shared data (or no shared data)
+3. **Avoiding temporal inconsistencies and causality violations** (e.g., processing a file-opening event before the related process-forking event)
+
+The first two properties are primarily focused on performance, while the third is essential for the correctness of the solution. These aspects are intrinsically linked.
+
+Based on the analysis below, **Static Partitioning by TGID** is the proposed approach for the initial implementation.
+
+#### Static Partitioning by TGID (Thread Group ID / Process ID)
+
+Events are routed based on the TGID in kernel space (within the eBPF program) to a ring buffer dedicated to a specific partition. The routing logic executes at the point where events are captured, before they are written to any ring buffer. This partition is then consumed by a dedicated worker thread in userspace. The routing in the eBPF program can be accomplished with a simple hash and modulo operation, depending on the desired number of worker threads:
+
+```
+ring_buffer_index = hash(event->tgid) % num_workers
+```
+
+The hash function and number of workers are configured at eBPF program initialization time, allowing the kernel to route events directly to the appropriate ring buffer without userspace intervention.
+
+**Pros:**
+
+* **Reduced need for thread synchronization**: While structures keeping thread group data are shared across all worker threads and require synchronization, TGID partitioning minimizes cross-partition access. For data stored per thread-group (such as file descriptors), TGID partitioning guarantees a single writer (the worker thread assigned to that TGID), resulting in low contention since the data is mostly accessed by the same partition. Synchronization is needed only in two specific cases:
+  1. **Clone/fork events**: When handling clone/fork events, the worker thread needs to access thread information from the parent thread, which may reside in a different partition. This requires synchronization to read the parent's state (e.g., file descriptors, environment variables) that will be inherited by the child.
+  2. **Proc exit events**: When a process exits, reparenting logic may need to access thread information from other partitions to handle child processes that are being reparented to a different thread group.
+* Guarantee of sequential order processing of events related to the same thread group/process, as they are handled by the same worker thread. This limits the chance of temporal inconsistencies.
+
+**Cons:**
+
+* **Load Imbalance / "Hot" Process Vulnerability**: This static partitioning is susceptible to uneven worker load distribution, as a small number of high-activity ("hot") processes can overload the specific worker thread assigned to their TGID, creating a bottleneck.
+* **Cross-Partition Temporal Inconsistency**: Events that require information from a parent thread (e.g., fork/clone events) can still lead to causality issues. If the parent's related event is handled by a different, lagging partition, the required context might be incomplete or arrive out of order. Note that load imbalance amplifies this issue. Missing thread information is easy to detect, but there are also cases where information is present but not up-to-date or ahead of the time the clone event happened.
+
+  **Ancestor information during rule evaluation**: When evaluating rules that require ancestor information, the worker thread may need to access thread data from other partitions. Falco rules commonly check ancestor process attributes using fields that traverse the process hierarchy. Based on actual usage in Falco rules, commonly used ancestor fields include:
+  
+  - `proc.aname` / `proc.aname[N]` - ancestor process name (where N is the generation level: 1=parent, 2=grandparent, 3=great-grandparent, etc., up to at least level 7)
+  - `proc.aexepath[N]` - ancestor executable path (e.g., `proc.aexepath[2]` for grandparent)
+  - `proc.aexe[N]` - ancestor executable (e.g., `proc.aexe[2]` for grandparent)
+  
+  Accessing stale or "ahead" ancestor data (where the ancestor's state may be out of date or from events processed by other partitions with different timestamps) could lead to false positives or false negatives in rule evaluation. We acknowledge this potential issue and plan to assess its impact and determine appropriate mitigations once we have a running prototype.
+
+**Mitigations:**
+
+* **Last-Resort Fetching**: Fetching the thread information from a different channel to resolve the drift (e.g., proc scan, eBPF iterator). This solution is considered as a last resort because it risks slowing down the event processing loop, potentially negating the performance benefits of multi-threading.
+
+* **Context Synchronization**: Wait for the required thread information to become available. This can be decomposed into two orthogonal concerns:
+
+  **How to handle the wait:**
+
+  * **Wait/Sleep (Blocking)**: The worker thread blocks (sleeping or spinning) until the required data becomes available. Simple to implement, but the worker is idle during the wait, reducing throughput.
+  * **Deferring (Non-blocking)**: The event is copied/buffered for later processing; the worker continues with other events from its ring buffer. More complex (requires event copying, a pending queue, and a retry mechanism), but keeps the worker productive.
+
+  **How to detect data readiness:**
+
+  * **Polling**: Periodically check if the required data is available (spin-check for Wait/Sleep, or periodic retry for Deferring). Simple but wastes CPU cycles.
+  * **Signaling**: Partitions proactively notify each other when data is ready. More efficient but requires coordination infrastructure (e.g., condition variables, eventfd, or message queues).
+
+  These combine into four possible approaches:
+
+  | | Polling | Signaling |
+  |---|---------|-----------|
+  | **Wait/Sleep** | Spin-check until ready | Sleep on condition variable, wake on signal |
+  | **Deferring** | Periodically retry deferred events | Process deferred events when signaled |
+
+  **Synchronization point**: A natural synchronization point is the **clone exit parent event**. At this point, the parent process has completed setting up the child's initial state (inherited file descriptors, environment, etc.), making it safe to start processing events for the newly created thread group.
+
+  **Special case — `vfork()` / `CLONE_VFORK`**: When `vfork()` is used, the parent thread is blocked until the child calls `exec()` or exits, delaying the clone exit parent event. An alternative synchronization point may be needed (e.g., adding back clone enter parent).
+
+### Other Considered Approaches
+
+#### Static Partitioning by TID (Thread ID)
+
+Similar to the previous approach, but events are routed by TID instead of TGID.
+
+**Pros:**
+
+* Guarantee of sequential order processing of events related to the same thread, as they are handled by the same worker thread. This limits the chance of temporal inconsistencies.
+* Good enough load balancing between partitions.
+
+**Cons:**
+
+* **Cross-Partition Temporal Inconsistency**: This approach can lead to temporal inconsistencies when accessing/writing information from/to other processes or from the Thread Group Leader (e.g., environment, file descriptor information is stored in the thread group leader).
+
+#### Static Partitioning by CPU Core
+
+This approach routes events based on the CPU core where the event was captured. Each CPU core has its own ring buffer (per-CPU buffers), and multiple CPU buffers are assigned to the same partition. Each partition is consumed by a dedicated worker thread that reads from all the per-CPU buffers assigned to it. The number of partitions does not necessarily match the number of CPU cores—a single partition can read from multiple per-CPU buffers, allowing flexibility in choosing the number of worker threads independently from the number of CPU cores. This leverages the existing per-CPU ring buffer infrastructure used by the kernel module (kmod) and legacy eBPF probe, where events are written to per-CPU buffers that are then grouped into partitions consumed by worker threads.
+
+**Pros:**
+
+* **Natural Load Distribution**: Events are naturally distributed across CPUs based on where processes execute, providing inherent load balancing that reflects actual system activity.
+* **No Routing Logic Required**: Uses the existing per-CPU ring buffer design, eliminating the need for custom routing logic in kernel or userspace. CPU cores are simply mapped to partitions (e.g., via modulo operation: `partition = cpu_id % num_workers`), and each worker thread reads from all per-CPU buffers assigned to its partition.
+* **Low Synchronization Overhead**: Events from per-CPU buffers assigned to the same partition are processed sequentially by the same worker thread, reducing cross-thread synchronization needs.
+* **Flexible Partitioning**: The number of partitions (and thus worker threads) can be chosen independently from the number of CPU cores, allowing optimization based on workload characteristics rather than hardware topology.
+
+**Cons:**
+
+* **Cross-CPU Temporal Inconsistency**: Events from the same process or thread group can be processed by different worker threads if the process migrates between CPUs, leading to potential temporal inconsistencies and causality violations. This is particularly problematic for multi-threaded applications that may execute on different CPUs.
+* **Process Migration Effects**: CPU migration can cause events from the same process to be processed out of order, as events captured on different CPUs are handled by different worker threads.
+* **Load Imbalance with CPU Grouping**: When multiple per-CPU buffers are assigned to the same partition, the worker thread must process events from all assigned buffers. If the activity levels across these CPUs are uneven, the worker thread may experience load imbalance, with some partitions handling more active CPUs than others. The worker thread must also coordinate reading from multiple buffers, potentially using techniques similar to the current `O(n_cpus)` scan to maintain event ordering.
+* **Modern eBPF Probe Limitation**: The modern eBPF probe uses `BPF_MAP_TYPE_RINGBUF`, which does not have a per-CPU design. This approach would only be viable with the kernel module (kmod) or legacy eBPF probe that use `BPF_MAP_TYPE_PERF_EVENT_ARRAY` with per-CPU buffers.
+
+#### Functional Partitioning (Pipelining)
+
+Instead of partitioning the data, this approach partitions the work by splitting processing into phases:
+
+1. **Parsing**: Runs in a single thread, the state is updated in this phase.
+2. **Rules evaluation**: Runs in a thread chosen from a worker thread pool, the state is accessed but not modified.
+
+**Pros:**
+
+* The state handling remains single-threaded, avoiding any synchronization issue on the write side.
+* The load balancing of the Rules evaluation phase is good as it does not require any form of stickiness. Every worker can take whatever event, and a simple round-robin policy can be applied.
+
+**Cons:**
+
+* The "Parsing" stage is likely to become the bottleneck; a single thread here limits total throughput regardless of how many cores you have.
+* As we are parallelizing parsing and rules evaluation phases, we need an MVCC (multi-version concurrency control) technique to maintain multiple levels of state to use the state at the right point in time during rules evaluation.
+* Processing multiple events in parallel involves changes at the driver and libscap level. At the moment we are processing one event at a time from the driver memory without copying. To be able to process multiple events in parallel, we need to adapt the ring-buffer to make sure that `next()` does not consume the event. We would also need some flow control (e.g., backpressure) to avoid processing too many events in parallel. This problem would arise only if the rules evaluation phase is slower than the parsing phase.
+
+#### Comparison Summary
+
+| Approach | Load Balancing | Contention | Temporal Consistency |
+|----------|----------------|------------|----------------------|
+| TGID | Moderate (hot process risk) | Low | Good (within process) |
+| TID | Good | Higher | Partial (thread-level only) |
+| CPU Core | Good | Low | Poor (process migration issues) |
+| Pipelining | Good (rules evaluation phase) | Low (writes) | Requires MVCC |
+
+#### Rationale for TGID Partitioning
+
+TGID partitioning was chosen because it offers the best balance between synchronization complexity and correctness guarantees. TID partitioning increases cross-partition access for thread group leader data (e.g., file descriptor table, working directory, environment variables), increasing the coordination cost. Per-CPU partitioning, while leveraging existing infrastructure, suffers from process migration issues that can cause significant temporal inconsistencies when processes move between CPUs. Functional partitioning, while elegant in its separation of concerns, introduces a single-threaded bottleneck in the parsing phase that limits scalability regardless of available cores, and requires complex MVCC mechanisms for data consistency and mechanisms for handling multiple events in parallel.
+
+### Risks and Mitigations
+
+- **Increased Complexity**: Multi-threading introduces complexity in terms of synchronization and state management. Mitigation: Careful design of shared state and synchronization mechanisms, along with thorough testing.
+- **Synchronization Overhead vs Performance Gains**: The overhead of synchronization might negate the performance benefits of multi-threading. Mitigation: Use lightweight synchronization techniques and minimize shared state access.
+- **Synchronization Overhead vs Data Consistency**: In order to keep the synchronization overhead low with the shared state, we might need to relax some data consistency guarantees. Mitigation: Analyze the trade-offs and ensure that any relaxed guarantees do not compromise security.

proposals/20251215-legacy-bpf-grpc-output-gvisor-engine-deprecation.md

@@ -0,0 +1,128 @@
+# Legacy eBPF probe, gVisor libscap engine and gRPC output deprecations
+
+## Summary
+
+This proposal aims to formalize motivations and procedures for deprecating the legacy eBPF probe, the gRPC output and
+the gVisor libscap engine.
+
+One of the key objectives of Falco is to maintain a seamless user experience, regardless of the system call event source
+actually used. This objective imposes strong requirements among all drivers and engines acting as system call source
+(i.e.: gVisor libscap engine), feature parity, among each other, above all. Feature parity raises challenges from both
+technical and maintainability perspectives, and these challenges are not justified if the driver/engine is no/little
+used. For these reasons, this document aims for raising consensus regarding the legacy eBPF probe and gRPC output
+deprecation.
+
+Similar arguments could be raised in favor of the gRPC output deprecation: this output requires dependency on the
+gRPC framework, that introduces a non-negligible build time overhead and maintainability burden (especially in a C++
+codebase), not justified by the little usage of the output.
+
+Upcoming evidences of non-negligible use of the gVisor engine and the gRPC output could be addressed by providing a
+separate source plugin in case of gVisor, and a Falco Sidekick output as a replacement of the gRPC output.
+
+## Motivation
+
+### Legacy eBPF probe deprecation
+
+The following matrix details the current minimum kernel version officially supported by each driver, for each
+architecture:
+
+|             | Kernel module                                                                                | legacy eBPF probe                                                                           | Modern eBPF probe | Status |
+| ----------- |----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------| ----------------- | ------ |
+| **x86_64**  | >= 3.10                                                                                        | >= 4.14                                                                                     | >= 5.8            | _STABLE_ |
+| **aarch64** | >= [3.16](https://github.com/torvalds/linux/commit/055b1212d141f1f398fca548f8147787c0b6253f) | >= 4.17                                                                                     | >= 5.8            | _STABLE_ |
+| **s390x**   | >= 3.10                                                                                        | >= [5.5](https://github.com/torvalds/linux/commit/6ae08ae3dea)                              | >= 5.8            | _EXPERIMENTAL_ |
+| **riscv64** | >= [5.0](https://github.com/torvalds/linux/commit/5aeb1b36cedd3a1dfdbfe368629fed52dee34103)  | N/A                                                                                         | N/A               | _EXPERIMENTAL_ |
+| **ppc64le** | >= 3.10                                                                                        | >= [5.1](https://github.com/torvalds/linux/commit/ed1cd6deb013a11959d17a94e35ce159197632da) | >= 5.8               | _STABLE_ |
+
+The legacy eBPF probe strives to provide a little more coverage than the modern eBPF one. This increased coverage comes
+at cost of flexibility and maintainability. Indeed:
+1. it cannot leverage CORE eBPF features - as a result, falcosecurity must maintain a great number of officially
+supported eBPF objects, each one built for a specific officially-supported kernel flavor; this increases the
+maintainability burden and makes the system less flexible to kernel configurations/structures changes
+2. old kernel versions support is difficult to retain - the verifier imposes huge limitations on old kernel versions,
+and any tiny change easily result in the verifier rejecting the code
+3. it is difficult to keep it up to date with other drivers - some desired features cannot be implemented in any way
+using eBPF on old kernel flavors, due to lack of eBPF helpers/program types or verifier limitations (e.g.: there is no
+way of implementing a synchronous data harvesting mechanism like the one provided by BPF iterators). As falcosecurity
+strives for feature parity among drivers, this imposes a big limitation on the other drivers. Please notice that:
+   1. the kernel module is unconstrained on the nature of feature it can support
+   2. the modern eBPF probe can easily rely on CORE features to probe for kernel features and use them if available
+
+Besides the above, the legacy eBPF probe provides support for a range of versions that is entirely contained by the
+kernel module supported range. Additionally, different distro kernel flavors already back-port features required by the
+modern eBPF, enabling its usage on kernel older than `5.8`.
+
+The above considerations, together with the evidence of its little usage, make the legacy eBPF probe a good candidate
+for deprecation.
+
+### gVisor libscap engine deprecation
+
+gVisor libscap engine implements a system call event source by leveraging events coming from gVisor itself through gRPC.
+
+There is evidence that this engine is little used. Moreover, gVisor doesn't provide all information required to build
+all supported event types, indeed resulting in a system call source not completely equivalent to the ones provided by
+drivers. Finally, it requires `falcosecurity/libs` being dependent on protobuf, this latter introducing a non-negligible
+build time overhead and maintainability burden.
+
+Deprecating it would allow to streamline system call event sources alignment, maintainability, and reduce build time for
+both `falcosecurity/falco` and `falcosecurity/libs`.
+
+### gRPC output deprecation
+
+The gRPC output provides a mechanism through which a gRPC client can subscribe to the Falco alerts stream. This output
+leverages a gRPC server embedded into Falco.
+
+As for the legacy eBPF probe and the gVisor libscap engine, there is evidence that this output is little used. Also,
+similarly to the gVisor libscap engine, this requires Falco being dependent on the protobuf, and additionally, on the
+entire C++ gRPC framework. Finally, the little amount of data that is sent through the gRPC stream, and the
+communication model (only involving a one-way communication from the server to the client) doesn't justify the need of
+using gRPC.
+
+Deprecating it would allow to reduce the build system, streamline maintainability, and reduce build time for
+`falcosecurity/falco`.
+
+## Goals
+
+* Deprecate the legacy eBPF probe, the gVisor libscap engine, and the gRPC output
+* Detail a plan to follow during the deprecation period, before completely remove any of the aforementioned components
+
+## Non-goals
+
+* Implement a gVisor source plugin as gVisor libscap engine alternative
+* Implement the gRPC output as Falco Sidekick output
+* Detail a plan to follow after taking the decision to completely remove any of the aforementioned components
+
+## The plan
+
+This section aims to detail the plan to follow contextually and after the deprecation mark, but before taking any
+definitive removal decision about the legacy eBPF probe, the gVisor libscap engine, and the gRPC output (collectively
+referred to hereinafter as "the components" or simply "components").
+
+The deprecation of these components introduces user-facing changes that must be addressed as prescribed by the current
+deprecation policy for "non-backward compatible user-facing changes" (see
+[20231220-features-adoption-and-deprecation.md#deprecation-policy](./20231220-features-adoption-and-deprecation.md#deprecation-policy)).
+
+All components are stable, and considering that deprecations will first be enforced in the stable Falco version `0.43.0`
+(ante `1.0.0`), the minimum deprecation period length is 1 release: this means that components cannot be removed before
+Falco `0.44.0`.
+
+At high level, the action plan is to inform users, during the deprecation period, about the deprecation: this is
+achieved by emitting a deprecation notice if the user try to leverage any of the feature exposed by any component, and
+by updating the website in any of the relevant areas.
+
+During the deprecation period, but before taking decision to remove the components, projects belonging to the
+`falcosecurity` organization will be updated to not use/rely on any of these. Specifically:
+- on `falcosecurity/libs`, any CI job building and testing the legacy eBPF probe will be removed
+- on `falcosecurity/kernel-testing`, playbooks will not build and test the legacy eBPF probe anymore
+- on `falcosecurity/event-generator`, the internal gRPC alert retriever will be replaced with an HTTP alert retriever,
+leveraging the existing HTTP output.
+
+## The non-plan
+
+This proposal does not address any design or implementation aspect of the gVisor engine and gRPC output replacement, nor
+formalizes in any way the conditions under which a replacement should be delivered. Upcoming evidences of non-negligible
+use of the gVisor engine and the gRPC output may be addressed by providing a separate source plugin in case of gVisor,
+and a Falco Sidekick output as a replacement of the gRPC output, but these latter possibilities should be intended as
+suggestions, and will not constraint in any way any related future choice.
+
+Finally, this proposal doesn't detail any aspect of the eventual removal.

scripts/CMakeLists.txt

@@ -24,10 +24,6 @@ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
 		"${PROJECT_SOURCE_DIR}/scripts/systemd/falco-kmod.service"
 		"${PROJECT_BINARY_DIR}/scripts/systemd" COPYONLY
 	)
-	configure_file(
-		"${PROJECT_SOURCE_DIR}/scripts/systemd/falco-bpf.service"
-		"${PROJECT_BINARY_DIR}/scripts/systemd" COPYONLY
-	)
 	configure_file(
 		"${PROJECT_SOURCE_DIR}/scripts/systemd/falco-modern-bpf.service"
 		"${PROJECT_BINARY_DIR}/scripts/systemd" COPYONLY
@@ -68,9 +64,6 @@ if(NOT WIN32
 	if(BUILD_DRIVER)
 		list(APPEND FALCOCTL_DRIVER_TYPES_LIST "kmod")
 	endif()
-	if(BUILD_BPF)
-		list(APPEND FALCOCTL_DRIVER_TYPES_LIST "ebpf")
-	endif()
 	string(REPLACE ";" ", " FALCOCTL_DRIVER_TYPES "${FALCOCTL_DRIVER_TYPES_LIST}")
 	configure_file(
 		${CMAKE_CURRENT_SOURCE_DIR}/falcoctl/falcoctl.yaml.in

scripts/debian/postinst.in

@@ -25,12 +25,10 @@ CHOICE=
 # Every time we call this script we want to stat from a clean state.
 echo "[POST-INSTALL] Disable all possible 'falco' services:"
 systemctl --system stop 'falco-kmod.service' || true
-systemctl --system stop 'falco-bpf.service' || true
 systemctl --system stop 'falco-modern-bpf.service' || true
 systemctl --system stop 'falco-custom.service' || true
 systemctl --system stop 'falcoctl-artifact-follow.service' || true
 systemctl --system disable 'falco-kmod.service' || true
-systemctl --system disable 'falco-bpf.service' || true
 systemctl --system disable 'falco-modern-bpf.service' || true
 systemctl --system disable 'falco-custom.service' || true
 systemctl --system disable 'falcoctl-artifact-follow.service' || true
@@ -47,11 +45,8 @@ if [ "$1" = "configure" ]; then
               kmod)
                   CHOICE=3
                   ;;
-              ebpf)
-                  CHOICE=4
-                  ;;
               modern_ebpf)
-                  CHOICE=5
+                  CHOICE=4
                   ;;
         esac     
         if [ -z $CHOICE ] && [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then          
@@ -60,8 +55,7 @@ if [ "$1" = "configure" ]; then
                     1 "Manual configuration (no unit is started)" \
                     2 "Automatic selection" \
                     3 "Kmod" \
-                    4 "eBPF" \
-                    5 "Modern eBPF" \
+                    4 "Modern eBPF" \
                     2>&1 >/dev/tty)
         fi
         # "auto" case is not managed here since it is already the default, so no CHOICE=2
@@ -73,9 +67,6 @@ if [ "$1" = "configure" ]; then
                 chosen_driver="kmod"
                 ;;
             4)
-                chosen_driver="ebpf"
-                ;;
-            5)
                 chosen_driver="modern_ebpf"
                 ;;
         esac
@@ -83,7 +74,7 @@ if [ "$1" = "configure" ]; then
             echo "[POST-INSTALL] Configure falcoctl '$chosen_driver' driver type:"
             if [ "$chosen_driver" = "auto" ];  then
                 # Configure falcoctl to enable all drivers
-                falcoctl driver config --type "modern_ebpf" --type "kmod" --type "ebpf"
+                falcoctl driver config --type "modern_ebpf" --type "kmod"
                 # Load the actually automatic chosen driver
                 chosen_driver=$(falcoctl driver printenv | grep DRIVER= | cut -d'"' -f2)
             else
@@ -124,11 +115,6 @@ case "$chosen_driver" in
       falcoctl driver install --download=false
       chosen_unit="kmod"
       ;;
-    "ebpf")
-      echo "[POST-INSTALL] Call 'falcoctl driver install for ebpf':"
-      falcoctl driver install
-      chosen_unit="bpf"
-      ;;
     "modern_ebpf")
       chosen_unit="modern-bpf"
       ;;

scripts/debian/postrm.in

@@ -25,7 +25,6 @@ set -e
 if [ -d /run/systemd/system ] && [ "$1" = remove ]; then
         echo "[POST-REMOVE] Disable all Falco services:"
         systemctl --system disable 'falco-kmod.service' || true
-        systemctl --system disable 'falco-bpf.service' || true
         systemctl --system disable 'falco-modern-bpf.service' || true
         systemctl --system disable 'falco-custom.service' || true
         systemctl --system disable 'falcoctl-artifact-follow.service' || true

scripts/debian/prerm.in

@@ -26,7 +26,6 @@ case "$1" in
     remove|upgrade|deconfigure)
       echo "[PRE-REMOVE] Stop all Falco services:"
       systemctl --system stop 'falco-kmod.service' || true
-      systemctl --system stop 'falco-bpf.service' || true
       systemctl --system stop 'falco-modern-bpf.service' || true
       systemctl --system stop 'falco-custom.service' || true
       systemctl --system stop 'falcoctl-artifact-follow.service' || true

scripts/falcoctl/falcoctl.yaml.in

@@ -7,10 +7,10 @@ driver:
     hostroot: "/"
 artifact:
   follow:
-    every: 6h0m0s
+    every: 168h0m0s
     falcoVersions: http://localhost:8765/versions
     refs:
-    - falco-rules:3
+    - falco-rules:5
 indexes:
 - name: falcosecurity
   url: https://falcosecurity.github.io/falcoctl/index.yaml

scripts/publish-rpm

@@ -14,6 +14,16 @@ check_program() {
   fi
 }
 
+# Sign RPM packages with embedded GPG signature using rpmsign
+#
+# $@: paths of RPM files to sign.
+rpmsign_packages() {
+    echo "Signing RPM packages with rpmsign..."
+    rpmsign --define '_gpg_name Falcosecurity Package Signing' --resign "$@"
+    echo "Verifying RPM signatures..."
+    rpm -qp --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}: %|DSAHEADER?{%{DSAHEADER:pgpsig}}:{%|RSAHEADER?{%{RSAHEADER:pgpsig}}:{(none)}|}|\n' "$@"
+}
+
 # Updates the signature of a RPM package in the local repository
 #
 # $1: path of the repository.
@@ -127,6 +137,8 @@ fi
 check_program createrepo
 check_program gpg
 check_program aws
+check_program rpmsign
+check_program rpm
 
 # settings
 s3_bucket_repo="s3://falco-distribution/packages/${repo}"
@@ -140,19 +152,32 @@ aws s3 cp ${s3_bucket_repo} ${tmp_repo_path} --recursive
 
 # update signatures for all existing packages
 if [ "${sign_all}" ]; then
+  # collect all RPM files
+  rpm_files=()
   for file in ${tmp_repo_path}/*; do
-    if [ -f "$file" ]; then # exclude directories, symlinks, etc...
-      if [[ ! $file == *.asc ]]; then # exclude signature files
-        package=$(basename -- ${file})
-        echo "Signing ${package}..."
-        sign_rpm ${tmp_repo_path} ${file}
-
-        echo "Syncing ${package}.asc to ${s3_bucket_repo}..."
-        aws s3 cp ${tmp_repo_path}/${package}.asc ${s3_bucket_repo}/${package}.asc --acl public-read
-      fi
+    if [ -f "$file" ] && [[ $file == *.rpm ]]; then
+      rpm_files+=("$file")
     fi
   done
+
+  # sign all RPM packages with embedded GPG signature
+  if [ ${#rpm_files[@]} -gt 0 ]; then
+    rpmsign_packages "${rpm_files[@]}"
+  fi
+
+  # create detached signatures and upload
+  for file in "${rpm_files[@]}"; do
+    package=$(basename -- ${file})
+    echo "Creating detached signature for ${package}..."
+    sign_rpm ${tmp_repo_path} ${file}
+
+    echo "Syncing ${package} and ${package}.asc to ${s3_bucket_repo}..."
+    aws s3 cp ${tmp_repo_path}/${package} ${s3_bucket_repo}/${package} --acl public-read
+    aws s3 cp ${tmp_repo_path}/${package}.asc ${s3_bucket_repo}/${package}.asc --acl public-read
+  done
+  aws cloudfront create-invalidation --distribution-id ${AWS_CLOUDFRONT_DIST_ID} --paths ${cloudfront_path}/*.rpm
   aws cloudfront create-invalidation --distribution-id ${AWS_CLOUDFRONT_DIST_ID} --paths ${cloudfront_path}/*.asc
+  update_repo ${tmp_repo_path}
   sign_repo ${tmp_repo_path}
 fi
 
@@ -161,8 +186,9 @@ if [[ ${repo} == "rpm-dev" ]]; then
   reduce_dir_size ${tmp_repo_path} 10 rpm
 fi
 
-# update the repo by adding new packages
+# sign and add new packages to the repo
 if ! [ ${#files[@]} -eq 0 ]; then
+  rpmsign_packages "${files[@]}"
   for file in "${files[@]}"; do
     echo "Adding ${file}..."
     add_rpm ${tmp_repo_path} ${file}

scripts/rpm/postinstall.in

@@ -24,12 +24,10 @@ CHOICE=
 # Every time we call this script we want to stat from a clean state.
 echo "[POST-INSTALL] Disable all possible enabled 'falco' service:"
 systemctl --system stop 'falco-kmod.service' || true
-systemctl --system stop 'falco-bpf.service' || true
 systemctl --system stop 'falco-modern-bpf.service' || true
 systemctl --system stop 'falco-custom.service' || true
 systemctl --system stop 'falcoctl-artifact-follow.service' || true
 systemctl --system disable 'falco-kmod.service' || true
-systemctl --system disable 'falco-bpf.service' || true
 systemctl --system disable 'falco-modern-bpf.service' || true
 systemctl --system disable 'falco-custom.service' || true
 systemctl --system disable 'falcoctl-artifact-follow.service' || true
@@ -46,11 +44,8 @@ if [ $1 -ge 1 ]; then
               kmod)
                   CHOICE=3
                   ;;
-              ebpf)
-                  CHOICE=4
-                  ;;
               modern_ebpf)
-                  CHOICE=5
+                  CHOICE=4
                   ;;
         esac     
         if [ -z $CHOICE ] && [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then          
@@ -59,8 +54,7 @@ if [ $1 -ge 1 ]; then
                     1 "Manual configuration (no unit is started)" \
                     2 "Automatic selection" \
                     3 "Kmod" \
-                    4 "eBPF" \
-                    5 "Modern eBPF" \
+                    4 "Modern eBPF" \
                     2>&1 >/dev/tty)
         fi
         # "auto" case is not managed here since it is already the default, so no CHOICE=2
@@ -72,9 +66,6 @@ if [ $1 -ge 1 ]; then
                 chosen_driver="kmod"
                 ;;
             4)
-                chosen_driver="ebpf"
-                ;;
-            5)
                 chosen_driver="modern_ebpf"
                 ;;
         esac
@@ -82,7 +73,7 @@ if [ $1 -ge 1 ]; then
             echo "[POST-INSTALL] Configure falcoctl '$chosen_driver' driver type:"
             if [ "$chosen_driver" = "auto" ];  then
                 # Configure falcoctl to enable all drivers
-                falcoctl driver config --type "modern_ebpf" --type "kmod" --type "ebpf"
+                falcoctl driver config --type "modern_ebpf" --type "kmod"
                 # Load the actually automatic chosen driver
                 chosen_driver=$(falcoctl driver printenv | grep DRIVER= | cut -d'"' -f2)
             else
@@ -123,11 +114,6 @@ case "$chosen_driver" in
       falcoctl driver install --download=false
       chosen_unit="kmod"
       ;;
-    "ebpf")
-      echo "[POST-INSTALL] Call 'falcoctl driver install for ebpf':"
-      falcoctl driver install
-      chosen_unit="bpf"
-      ;;
     "modern_ebpf")
       chosen_unit="modern-bpf"
       ;;

scripts/rpm/postuninstall.in

@@ -21,7 +21,6 @@ set -e
 if [ -d /run/systemd/system ] && [ $1 -eq 0 ]; then
         echo "[POST-REMOVE] Disable all Falco services:"
         systemctl --system disable 'falco-kmod.service'|| true
-        systemctl --system disable 'falco-bpf.service' || true
         systemctl --system disable 'falco-modern-bpf.service' || true
         systemctl --system disable 'falco-custom.service' || true
         systemctl --system disable 'falcoctl-artifact-follow.service' || true

scripts/rpm/preuninstall.in

@@ -20,7 +20,6 @@ set -e
 # Currently running falco service uses the driver, so stop it before driver cleanup
 echo "[PRE-REMOVE] Stop all Falco services:"
 systemctl --system stop 'falco-kmod.service' || true
-systemctl --system stop 'falco-bpf.service' || true
 systemctl --system stop 'falco-modern-bpf.service' || true
 systemctl --system stop 'falco-custom.service' || true
 systemctl --system stop 'falcoctl-artifact-follow.service' || true
@@ -36,7 +35,6 @@ falcoctl driver cleanup
 # if preuninstall:
 #  `systemd-update-helper remove-system-units <service>`
 %systemd_preun 'falco-kmod.service'
-%systemd_preun 'falco-bpf.service'
 %systemd_preun 'falco-modern-bpf.service'
 %systemd_preun 'falco-custom.service'
 %systemd_preun 'falcoctl-artifact-follow.service'

scripts/systemd/falco-bpf.service

@@ -1,27 +0,0 @@
-[Unit]
-Description=Falco: Container Native Runtime Security with ebpf
-Documentation=https://falco.org/docs/
-Before=falcoctl-artifact-follow.service
-Wants=falcoctl-artifact-follow.service
-
-[Service]
-Type=simple
-User=root
-ExecStart=/usr/bin/falco -o engine.kind=ebpf
-ExecReload=kill -1 $MAINPID
-UMask=0077
-TimeoutSec=30
-RestartSec=15s
-Restart=on-failure
-PrivateTmp=true
-NoNewPrivileges=yes
-ProtectHome=read-only
-ProtectSystem=full
-ProtectKernelTunables=true
-RestrictRealtime=true
-RestrictAddressFamilies=~AF_PACKET
-StandardOutput=null
-
-[Install]
-WantedBy=multi-user.target
-Alias=falco.service

scripts/systemd/falcoctl-artifact-follow.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=Falcoctl Artifact Follow: automatic artifacts update service
 Documentation=https://falco.org/docs/
-PartOf=falco-bpf.service falco-kmod.service falco-modern-bpf.service falco-custom.service
+PartOf=falco-kmod.service falco-modern-bpf.service falco-custom.service
 
 [Service]
 Type=simple

unit_tests/CMakeLists.txt

@@ -25,8 +25,7 @@ FetchContent_Declare(
 
 FetchContent_MakeAvailable(googletest)
 
-# Create a libscap_test_var.h file with some variables used by our tests for example the kmod path
-# or the bpf path.
+# Create a libscap_test_var.h file with some variables used by our tests (e.g: the kmod path).
 configure_file(
 	${CMAKE_CURRENT_SOURCE_DIR}/falco_test_var.h.in ${CMAKE_CURRENT_BINARY_DIR}/falco_test_var.h
 )
@@ -45,6 +44,7 @@ add_executable(
 	engine/test_plugin_requirements.cpp
 	engine/test_rule_loader.cpp
 	engine/test_rulesets.cpp
+	falco/test_capture.cpp
 	falco/test_configuration.cpp
 	falco/test_configuration_rule_selection.cpp
 	falco/test_configuration_config_files.cpp

unit_tests/README.md

@@ -7,7 +7,7 @@ Under `unit_tests/engine` and `unit_tests/falco` directories, we have different
 ## Build and Run
 
 ```bash
-cmake -DMINIMAL_BUILD=On -DBUILD_BPF=Off -DBUILD_DRIVER=Off -DBUILD_FALCO_UNIT_TESTS=On ..
+cmake -DMINIMAL_BUILD=On -DBUILD_DRIVER=Off -DBUILD_FALCO_UNIT_TESTS=On ..
 make falco_unit_tests
 sudo ./unit_tests/falco_unit_tests
 ```

unit_tests/engine/test_filter_warning_resolver.cpp

@@ -15,14 +15,16 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+#include <string>
 #include <gtest/gtest.h>
 #include <engine/filter_warning_resolver.h>
 
 static bool warns(const std::string& condition) {
-	std::set<falco::load_result::warning_code> w;
 	auto ast = libsinsp::filter::parser(condition).parse();
-	filter_warning_resolver().run(ast.get(), w);
-	return !w.empty();
+	rule_loader::context ctx("test");
+	rule_loader::result res("test");
+	filter_warning_resolver().run(ctx, res, *ast.get());
+	return res.has_warnings();
 }
 
 TEST(WarningResolver, warnings_in_filtering_conditions) {
@@ -38,4 +40,8 @@ TEST(WarningResolver, warnings_in_filtering_conditions) {
 	ASSERT_TRUE(warns("ka.field intersects (otherval, <NA>)"));
 	ASSERT_TRUE(warns("ka.field pmatch (<NA>)"));
 	ASSERT_TRUE(warns("ka.field pmatch (otherval, <NA>)"));
+	ASSERT_TRUE(warns("evt.dir = <"));
+	ASSERT_TRUE(warns("evt.dir = >"));
+	ASSERT_TRUE(warns("proc.name=test and evt.dir = <"));
+	ASSERT_TRUE(warns("evt.dir = < and proc.name=test"));
 }

unit_tests/engine/test_rule_loader.cpp

@@ -1327,3 +1327,192 @@ TEST_F(test_falco_engine, empty_string_source_addl_rule) {
 
 	EXPECT_TRUE(load_rules(rules_content, "rules.yaml"));
 }
+
+// Phase 1: Schema correctness — no false positives for valid rule properties
+
+TEST_F(test_falco_engine, rule_with_warn_evttypes) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule description
+  condition: evt.type = close
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+  warn_evttypes: false
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+}
+
+TEST_F(test_falco_engine, rule_with_skip_if_unknown_filter) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule description
+  condition: evt.type = close
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+  skip-if-unknown-filter: true
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+}
+
+TEST_F(test_falco_engine, override_replace_warn_evttypes) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule description
+  condition: evt.type = close
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+  warn_evttypes: true
+
+- rule: test_rule
+  warn_evttypes: false
+  override:
+    warn_evttypes: replace
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+}
+
+TEST_F(test_falco_engine, override_replace_capture) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule description
+  condition: evt.type = close
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+
+- rule: test_rule
+  capture: true
+  override:
+    capture: replace
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+}
+
+TEST_F(test_falco_engine, override_replace_tags) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule description
+  condition: evt.type = close
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+  tags: [filesystem]
+
+- rule: test_rule
+  tags: [network]
+  override:
+    tags: replace
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+}
+
+// Phase 2: Unknown key detection
+
+TEST_F(test_falco_engine, rule_unknown_key) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule description
+  condition: evt.type = close
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+  typo_field: some_value
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_TRUE(check_warning_message("Unknown key 'typo_field'"));
+}
+
+TEST_F(test_falco_engine, list_unknown_key) {
+	std::string rules_content = R"END(
+- list: my_list
+  items: [cat, bash]
+  typo_field: some_value
+
+- rule: test_rule
+  desc: test rule description
+  condition: evt.type = close and proc.name in (my_list)
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_TRUE(check_warning_message("Unknown key 'typo_field'"));
+}
+
+TEST_F(test_falco_engine, macro_unknown_key) {
+	std::string rules_content = R"END(
+- macro: my_macro
+  condition: evt.type = close
+  typo_field: some_value
+
+- rule: test_rule
+  desc: test rule description
+  condition: my_macro
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_TRUE(check_warning_message("Unknown key 'typo_field'"));
+}
+
+TEST_F(test_falco_engine, list_cross_type_key_priority) {
+	std::string rules_content = R"END(
+- list: my_list
+  items: [cat, bash]
+  priority: INFO
+
+- rule: test_rule
+  desc: test rule description
+  condition: evt.type = close and proc.name in (my_list)
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	// The flat-union schema accepts 'priority' on a list (validation_ok),
+	// but procedural detection catches the cross-type misuse.
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+	ASSERT_TRUE(check_warning_message("Unknown key 'priority'"));
+}
+
+TEST_F(test_falco_engine, deprecated_field_in_output) {
+	std::string rules_content = R"END(
+- rule: test_rule_with_evt_dir_in_output
+  desc: test rule with evt.dir in output
+  condition: evt.type = close
+  output: user=%user.name command=%proc.cmdline file=%fd.name evt.dir=%evt.dir
+  priority: INFO
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+	ASSERT_TRUE(has_warnings());
+	ASSERT_TRUE(check_warning_message(
+	        "usage of deprecated field 'evt.dir' has been detected in the rule output"))
+	        << m_load_result_string;
+	EXPECT_EQ(num_rules_for_ruleset(), 1);
+}
+
+TEST_F(test_falco_engine, no_deprecated_field_warning_in_output) {
+	std::string rules_content = R"END(
+- rule: test_rule_without_evt_dir
+  desc: test rule without evt.dir in output
+  condition: evt.type = close
+  output: user=%user.name command=%proc.cmdline file=%fd.name
+  priority: INFO
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+	ASSERT_FALSE(check_warning_message("evt.dir")) << m_load_result_string;
+	EXPECT_EQ(num_rules_for_ruleset(), 1);
+}

unit_tests/falco/app/actions/test_load_config.cpp

@@ -31,19 +31,11 @@ TEST(ActionLoadConfig, check_kmod_engine_config) {
 	EXPECT_EQ(s.config->m_kmod.m_buf_size_preset, 2);
 	EXPECT_FALSE(s.config->m_kmod.m_drop_failed_exit);
 
-	// Check that all other engine params are empty
-	EXPECT_TRUE(s.config->m_ebpf.m_probe_path.empty());
-	EXPECT_EQ(s.config->m_ebpf.m_buf_size_preset, 0);
-	EXPECT_FALSE(s.config->m_ebpf.m_drop_failed_exit);
-
 	EXPECT_EQ(s.config->m_modern_ebpf.m_cpus_for_each_buffer, 0);
 	EXPECT_EQ(s.config->m_modern_ebpf.m_buf_size_preset, 0);
 	EXPECT_FALSE(s.config->m_modern_ebpf.m_drop_failed_exit);
 
 	EXPECT_TRUE(s.config->m_replay.m_capture_file.empty());
-
-	EXPECT_TRUE(s.config->m_gvisor.m_config.empty());
-	EXPECT_TRUE(s.config->m_gvisor.m_root.empty());
 }
 
 TEST(ActionLoadConfig, check_modern_engine_config) {
@@ -63,14 +55,7 @@ TEST(ActionLoadConfig, check_modern_engine_config) {
 	EXPECT_EQ(s.config->m_kmod.m_buf_size_preset, 0);
 	EXPECT_FALSE(s.config->m_kmod.m_drop_failed_exit);
 
-	EXPECT_TRUE(s.config->m_ebpf.m_probe_path.empty());
-	EXPECT_EQ(s.config->m_ebpf.m_buf_size_preset, 0);
-	EXPECT_FALSE(s.config->m_ebpf.m_drop_failed_exit);
-
 	EXPECT_TRUE(s.config->m_replay.m_capture_file.empty());
-
-	EXPECT_TRUE(s.config->m_gvisor.m_config.empty());
-	EXPECT_TRUE(s.config->m_gvisor.m_root.empty());
 }
 
 #endif

unit_tests/falco/test_capture.cpp

@@ -0,0 +1,134 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2025 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include <falco/app/actions/helpers.h>
+#include <falco/configuration.h>
+#include <gtest/gtest.h>
+
+TEST(Capture, generate_scap_file_path_realistic_scenario) {
+	// Simulate a realistic timestamp (nanoseconds since epoch)
+	uint64_t timestamp = 1648178040000000000ULL;  // 2022-03-25 04:14:00 CET (03:14:00 UTC) in ns,
+	                                              // birth date of my son Michelangelo :)
+	uint64_t evt_num = 1011;
+	std::string prefix = "/var/log/falco/captures/security_event";
+
+	std::string result = falco::app::actions::generate_scap_file_path(prefix, timestamp, evt_num);
+
+	std::string expected =
+	        "/var/log/falco/captures/security_event_01648178040000000000_00000000000000001011.scap";
+	EXPECT_EQ(result, expected);
+}
+
+TEST(Capture, generate_scap_file_path_lexicographic_ordering) {
+	std::string prefix = "/tmp/test";
+
+	// Generate multiple file paths with different timestamps
+	std::string path1 = falco::app::actions::generate_scap_file_path(prefix, 1000, 1);
+	std::string path2 = falco::app::actions::generate_scap_file_path(prefix, 2000, 1);
+	std::string path3 = falco::app::actions::generate_scap_file_path(prefix, 10000, 1);
+
+	// Verify lexicographic ordering (important for file sorting)
+	EXPECT_LT(path1, path2);
+	EXPECT_LT(path2, path3);
+
+	// Also test with same timestamp but different event numbers
+	std::string path4 = falco::app::actions::generate_scap_file_path(prefix, 1000, 1);
+	std::string path5 = falco::app::actions::generate_scap_file_path(prefix, 1000, 2);
+	std::string path6 = falco::app::actions::generate_scap_file_path(prefix, 1000, 100);
+
+	EXPECT_LT(path4, path5);
+	EXPECT_LT(path5, path6);
+}
+
+TEST(Capture, generate_scap_file_path_empty_prefix) {
+	std::string prefix = "";
+	uint64_t timestamp = 123;
+	uint64_t evt_num = 456;
+
+	std::string result = falco::app::actions::generate_scap_file_path(prefix, timestamp, evt_num);
+
+	std::string expected = "_00000000000000000123_00000000000000000456.scap";
+	EXPECT_EQ(result, expected);
+}
+
+TEST(Capture, capture_config_disabled_by_default) {
+	std::string config_content = R"(
+plugins:
+)";
+
+	falco_configuration config;
+	config_loaded_res res;
+	ASSERT_NO_THROW(res = config.init_from_content(config_content, {}));
+
+	// Capture should be disabled by default
+	EXPECT_FALSE(config.m_capture_enabled);
+	EXPECT_EQ(config.m_capture_path_prefix, "/tmp/falco");
+	EXPECT_EQ(config.m_capture_mode, capture_mode_t::RULES);
+	EXPECT_EQ(config.m_capture_default_duration_ns, 5000 * 1000000LL);  // 5 seconds in ns
+}
+
+TEST(Capture, capture_config_enabled_rules_mode) {
+	std::string config_content = R"(
+capture:
+  enabled: true
+  path_prefix: /var/log/captures/falco
+  mode: rules
+  default_duration: 10000
+)";
+
+	falco_configuration config;
+	config_loaded_res res;
+	ASSERT_NO_THROW(res = config.init_from_content(config_content, {}));
+
+	EXPECT_TRUE(config.m_capture_enabled);
+	EXPECT_EQ(config.m_capture_path_prefix, "/var/log/captures/falco");
+	EXPECT_EQ(config.m_capture_mode, capture_mode_t::RULES);
+	EXPECT_EQ(config.m_capture_default_duration_ns, 10000 * 1000000LL);  // 10 seconds in ns
+}
+
+TEST(Capture, capture_config_enabled_all_rules_mode) {
+	std::string config_content = R"(
+capture:
+  enabled: true
+  path_prefix: /tmp/debug/falco
+  mode: all_rules
+  default_duration: 30000
+)";
+
+	falco_configuration config;
+	config_loaded_res res;
+	ASSERT_NO_THROW(res = config.init_from_content(config_content, {}));
+
+	EXPECT_TRUE(config.m_capture_enabled);
+	EXPECT_EQ(config.m_capture_path_prefix, "/tmp/debug/falco");
+	EXPECT_EQ(config.m_capture_mode, capture_mode_t::ALL_RULES);
+	EXPECT_EQ(config.m_capture_default_duration_ns, 30000 * 1000000LL);  // 30 seconds in ns
+}
+
+TEST(Capture, capture_config_invalid_mode) {
+	std::string config_content = R"(
+capture:
+  enabled: true
+  mode: invalid_mode
+)";
+
+	falco_configuration config;
+	config_loaded_res res;
+
+	// Should throw an exception for invalid mode
+	EXPECT_THROW(res = config.init_from_content(config_content, {}), std::logic_error);
+}

unit_tests/falco/test_configs/engine_kmod_config.yaml

@@ -25,16 +25,9 @@ engine:
   kmod:
     buf_size_preset: 2
     drop_failed_exit: false
-  ebpf:
-    probe: /path/to/probe.o
-    buf_size_preset: 7
-    drop_failed_exit: true
   modern_ebpf:
     cpus_for_each_buffer: 2
     buf_size_preset: 4
     drop_failed_exit: false
   replay:
     capture_file: /path/to/file.scap
-  gvisor:
-    config: /path/to/gvisor_config.yaml
-    root: ""

unit_tests/falco/test_configs/engine_modern_config.yaml

@@ -25,16 +25,9 @@ engine:
   kmod:
     buf_size_preset: 1
     drop_failed_exit: true
-  ebpf:
-    probe: /path/to/probe.o
-    buf_size_preset: 4
-    drop_failed_exit: false
   modern_ebpf:
     cpus_for_each_buffer: 1
     # missing `buf_size_preset` should be defaulted
     drop_failed_exit: true
   replay:
     capture_file: /path/to/file.scap
-  gvisor:
-    config: /path/to/gvisor_config.yaml
-    root: ""

unit_tests/falco/test_configuration_config_files.cpp

@@ -92,7 +92,6 @@ TEST(Configuration, configuration_config_files_ok) {
 	outfile.close();
 
 	std::vector<std::string> cmdline_config_options;
-	std::vector<std::string> loaded_conf_files;
 	falco_configuration falco_config;
 	config_loaded_res res;
 	ASSERT_NO_THROW(res = falco_config.init_from_file("main.yaml", cmdline_config_options));

unit_tests/test_falco_engine.cpp

@@ -1,10 +1,9 @@
 #include "test_falco_engine.h"
 
-test_falco_engine::test_falco_engine() {
+test_falco_engine::test_falco_engine(): m_engine(std::make_shared<falco_engine>()) {
 	// create a falco engine ready to load the ruleset
 	m_filter_factory = std::make_shared<sinsp_filter_factory>(&m_inspector, m_filterlist);
 	m_formatter_factory = std::make_shared<sinsp_evt_formatter_factory>(&m_inspector, m_filterlist);
-	m_engine = std::make_shared<falco_engine>();
 	m_engine->add_source(m_sample_source, m_filter_factory, m_formatter_factory);
 }
 

userspace/engine/CMakeLists.txt

@@ -21,6 +21,7 @@ add_library(
 	filter_ruleset.cpp
 	evttype_index_ruleset.cpp
 	formats.cpp
+	field_formatter.cpp
 	filter_details_resolver.cpp
 	filter_macro_resolver.cpp
 	filter_warning_resolver.cpp

userspace/engine/evttype_index_ruleset.cpp

@@ -56,7 +56,7 @@ bool evttype_index_ruleset::run_wrappers(sinsp_evt *evt,
                                          filter_wrapper_list &wrappers,
                                          uint16_t ruleset_id,
                                          falco_rule &match) {
-	for(auto &wrap : wrappers) {
+	for(const auto &wrap : wrappers) {
 		if(wrap->m_filter->run(evt)) {
 			match = wrap->m_rule;
 			return true;
@@ -72,7 +72,7 @@ bool evttype_index_ruleset::run_wrappers(sinsp_evt *evt,
                                          std::vector<falco_rule> &matches) {
 	bool match_found = false;
 
-	for(auto &wrap : wrappers) {
+	for(const auto &wrap : wrappers) {
 		if(wrap->m_filter->run(evt)) {
 			matches.push_back(wrap->m_rule);
 			match_found = true;

userspace/engine/evttype_index_ruleset.h

@@ -43,7 +43,7 @@ struct evttype_index_wrapper {
 class evttype_index_ruleset : public indexable_ruleset<evttype_index_wrapper> {
 public:
 	explicit evttype_index_ruleset(std::shared_ptr<sinsp_filter_factory> factory);
-	virtual ~evttype_index_ruleset();
+	virtual ~evttype_index_ruleset() override;
 
 	// From filter_ruleset
 	void add(const falco_rule &rule,

userspace/engine/falco_common.h

@@ -29,6 +29,8 @@ limitations under the License.
 #define DEFAULT_OUTPUTS_QUEUE_CAPACITY_UNBOUNDED_MAX_LONG_VALUE std::ptrdiff_t(~size_t(0) / 2)
 
 #define DEFAULT_FALCO_LIBS_THREAD_TABLE_SIZE 262144
+#define DEFAULT_FALCO_LIBS_THREAD_TABLE_AUTO_PURGING_INTERVAL_S (5 * 60)        // 5 minutes.
+#define DEFAULT_FALCO_LIBS_THREAD_TABLE_AUTO_PURGING_THREAD_TIMEOUT_S (5 * 60)  // 5 minutes.
 
 //
 // Most falco_* classes can throw exceptions. Unless directly related

userspace/engine/falco_engine.cpp

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /*
-Copyright (C) 2023 The Falco Authors.
+Copyright (C) 2025 The Falco Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -42,6 +42,7 @@ limitations under the License.
 #include "falco_engine_version.h"
 
 #include "formats.h"
+#include "field_formatter.h"
 
 #include "evttype_index_ruleset.h"
 
@@ -117,7 +118,7 @@ static std::string fieldclass_key(const sinsp_filter_factory::filter_fieldclass_
 void falco_engine::list_fields(const std::string &source,
                                bool verbose,
                                bool names_only,
-                               bool markdown) const {
+                               output_format format) const {
 	// Maps from field class name + short desc to list of event
 	// sources for which this field class can be used.
 	std::map<std::string, std::set<std::string>> fieldclass_event_sources;
@@ -138,6 +139,10 @@ void falco_engine::list_fields(const std::string &source,
 	// printing field classes multiple times for different sources
 	std::set<std::string> seen_fieldclasses;
 
+	// Create the appropriate formatter and use it
+	auto formatter = FieldFormatter::create(format, verbose);
+	formatter->begin();
+
 	// In the second pass, actually print info, skipping duplicate
 	// field classes and also printing info on supported sources.
 	for(const auto &it : m_sources) {
@@ -160,21 +165,15 @@ void falco_engine::list_fields(const std::string &source,
 						continue;
 					}
 
-					printf("%s\n", field.name.c_str());
+					formatter->print_field_name(field.name);
 				}
-			} else if(markdown) {
-				printf("%s\n",
-				       fld_class.as_markdown(fieldclass_event_sources[fieldclass_key(fld_class)])
-				               .c_str());
 			} else {
-				printf("%s\n",
-				       fld_class
-				               .as_string(verbose,
-				                          fieldclass_event_sources[fieldclass_key(fld_class)])
-				               .c_str());
+				formatter->print_fieldclass(fld_class, fieldclass_event_sources[key]);
 			}
 		}
 	}
+
+	formatter->end();
 }
 
 std::unique_ptr<load_result> falco_engine::load_rules(const std::string &rules_content,
@@ -413,6 +412,8 @@ std::unique_ptr<std::vector<falco_engine::rule_result>> falco_engine::process_ev
 		rule_result.source = rule.source;
 		rule_result.format = rule.output;
 		rule_result.priority_num = rule.priority;
+		rule_result.capture = rule.capture;
+		rule_result.capture_duration_ns = uint64_t(rule.capture_duration) * 1000000LL;
 		rule_result.tags = rule.tags;
 		rule_result.exception_fields = rule.exception_fields;
 		rule_result.extra_output_fields = rule.extra_output_fields;
@@ -568,6 +569,8 @@ void falco_engine::get_json_details(
 	rule_info["description"] = r.description;
 	rule_info["enabled"] = info.enabled;
 	rule_info["source"] = r.source;
+	rule_info["capture"] = r.capture;
+	rule_info["capture_duration"] = r.capture_duration;
 	rule_info["tags"] = sequence_to_json_array(info.tags);
 	out["info"] = std::move(rule_info);
 

userspace/engine/falco_engine.h

@@ -34,6 +34,7 @@ limitations under the License.
 #include "falco_source.h"
 #include "falco_load_result.h"
 #include "filter_details_resolver.h"
+#include "output_format.h"
 
 //
 // This class acts as the primary interface between a program and the
@@ -62,7 +63,10 @@ public:
 
 	// Print to stdout (using printf) a description of each field supported by this engine.
 	// If source is non-empty, only fields for the provided source are printed.
-	void list_fields(const std::string &source, bool verbose, bool names_only, bool markdown) const;
+	void list_fields(const std::string &source,
+	                 bool verbose,
+	                 bool names_only,
+	                 output_format format) const;
 
 	// Provide an alternate rule reader, collector, and compiler
 	// to compile any rules provided via load_rules*
@@ -201,11 +205,10 @@ public:
 	                             const std::set<std::string> &tags,
 	                             const std::string &rule);
 
-	// You can optionally add fields that will only show up in the object
-	// output (e.g. json, gRPC) alongside other output_fields
-	// and not in the text message output.
-	// You can add two types of fields: formatted which will act like
-	// an additional output format that appears in the output field
+	// You can optionally add fields that will only show up in the object output (e.g. json)
+	// alongside other output_fields and not in the text message output. You can add two types of
+	// fields: formatted which will act like an additional output format that appears in the output
+	// field
 	void add_extra_output_formatted_field(const std::string &key,
 	                                      const std::string &format,
 	                                      const std::string &source,
@@ -228,6 +231,8 @@ public:
 		std::set<std::string> exception_fields;
 		std::set<std::string> tags;
 		extra_output_field_t extra_output_fields;
+		bool capture;
+		uint64_t capture_duration_ns;
 	};
 
 	//

userspace/engine/falco_engine_version.h

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /*
-Copyright (C) 2023 The Falco Authors.
+Copyright (C) 2025 The Falco Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ limitations under the License.
 
 // The version of this Falco engine
 #define FALCO_ENGINE_VERSION_MAJOR 0
-#define FALCO_ENGINE_VERSION_MINOR 50
+#define FALCO_ENGINE_VERSION_MINOR 60
 #define FALCO_ENGINE_VERSION_PATCH 0
 
 #define FALCO_ENGINE_VERSION                                                               \
@@ -36,4 +36,4 @@ limitations under the License.
 // It represents the fields supported by this version of Falco,
 // the event types, and the underlying driverevent schema. It's used to
 // detetect changes in engine version in our CI jobs.
-#define FALCO_ENGINE_CHECKSUM "c111251b08cfb00790515cd62fbe0b6c3d0b62035f7d9bbb1aea80f41d7986f9"
+#define FALCO_ENGINE_CHECKSUM "17c1ac99576c032a58895a10f7091cf777008a1059b7f1bff3c78a6451b17fdf"

userspace/engine/falco_load_result.cpp

@@ -73,10 +73,16 @@ static const std::string warning_codes[] = {"LOAD_UNKNOWN_SOURCE",
                                             "LOAD_EXCEPTION_NAME_NOT_UNIQUE",
                                             "LOAD_INVALID_MACRO_NAME",
                                             "LOAD_INVALID_LIST_NAME",
-                                            "LOAD_COMPILE_CONDITION"};
+                                            "LOAD_COMPILE_CONDITION",
+                                            "LOAD_UNKNOWN_KEY"};
+
+// Compile-time check to ensure warning_codes array has the correct size
+static_assert(std::size(warning_codes) ==
+                      static_cast<int>(falco::load_result::warning_code::LOAD_UNKNOWN_KEY) + 1,
+              "warning_codes array size must match the last warning_code enum value + 1");
 
 const std::string& falco::load_result::warning_code_str(warning_code wc) {
-	return warning_codes[wc];
+	return warning_codes[static_cast<int>(wc)];
 }
 
 static const std::string warning_strings[] = {"Unknown event source",
@@ -92,10 +98,16 @@ static const std::string warning_strings[] = {"Unknown event source",
                                               "Multiple exceptions defined with the same name",
                                               "Invalid macro name",
                                               "Invalid list name",
-                                              "Warning in rule condition"};
+                                              "Warning in rule condition",
+                                              "Unknown key in item definition"};
+
+// Compile-time check to ensure warning_strings array has the correct size
+static_assert(std::size(warning_strings) ==
+                      static_cast<int>(falco::load_result::warning_code::LOAD_UNKNOWN_KEY) + 1,
+              "warning_strings array size must match the last warning_code enum value + 1");
 
 const std::string& falco::load_result::warning_str(warning_code wc) {
-	return warning_strings[wc];
+	return warning_strings[static_cast<int>(wc)];
 }
 
 static const std::string warning_descs[] = {
@@ -119,8 +131,63 @@ static const std::string warning_descs[] = {
         "A rule is defining multiple exceptions with the same name",
         "A macro is defined with an invalid name",
         "A list is defined with an invalid name",
-        "A rule condition or output have been parsed with a warning"};
+        "A rule condition or output have been parsed with a warning",
+        "An item in the rules content contains an unrecognized key. The key will be ignored. "
+        "This may indicate a typo or a property placed on the wrong item type."};
+
+// Compile-time check to ensure warning_descs array has the correct size
+static_assert(std::size(warning_descs) ==
+                      static_cast<int>(falco::load_result::warning_code::LOAD_UNKNOWN_KEY) + 1,
+              "warning_descs array size must match the last warning_code enum value + 1");
 
 const std::string& falco::load_result::warning_desc(warning_code wc) {
-	return warning_descs[wc];
+	return warning_descs[static_cast<int>(wc)];
+}
+
+static const std::string deprecated_fields[] = {"evt.dir",
+                                                "evt.latency",
+                                                "evt.latency.s",
+                                                "evt.latency.ns",
+                                                "evt.latency.human",
+                                                "evt.wait_latency"};
+
+// Compile-time check to ensure deprecated_fields array has the correct size
+static_assert(
+        std::size(deprecated_fields) ==
+                static_cast<int>(falco::load_result::deprecated_field::DEPRECATED_FIELD_NOT_FOUND),
+        "deprecated_fields array size must match DEPRECATED_FIELD_NOT_FOUND enum value");
+
+const std::string& falco::load_result::deprecated_field_str(deprecated_field df) {
+	return deprecated_fields[static_cast<int>(df)];
+}
+
+// Shared description suffix for latency fields
+static const std::string latency_field_desc_suffix =
+        "field is not available due to the drop of enter events.";
+
+static const std::string deprecated_field_descs[] = {
+        "due to the drop of enter events, 'evt.dir = <' always evaluates to true, and 'evt.dir = "
+        ">' always evaluates to false. The rule expression can be simplified by removing the "
+        "condition on 'evt.dir'",
+        latency_field_desc_suffix,
+        latency_field_desc_suffix,
+        latency_field_desc_suffix,
+        latency_field_desc_suffix,
+        latency_field_desc_suffix};
+
+// Compile-time check to ensure deprecated_field_descs array has the correct size
+static_assert(
+        std::size(deprecated_field_descs) ==
+                static_cast<int>(falco::load_result::deprecated_field::DEPRECATED_FIELD_NOT_FOUND),
+        "deprecated_field_descs array size must match DEPRECATED_FIELD_NOT_FOUND enum value");
+
+const std::string& falco::load_result::deprecated_field_desc(deprecated_field df) {
+	return deprecated_field_descs[static_cast<int>(df)];
+}
+
+falco::load_result::deprecated_field falco::load_result::deprecated_field_from_str(
+        const std::string& f) {
+	return falco::load_result::deprecated_field(
+	        std::find(std::begin(deprecated_fields), std::end(deprecated_fields), f) -
+	        std::begin(deprecated_fields));
 }

userspace/engine/falco_load_result.h

@@ -46,7 +46,9 @@ public:
 	// impact.
 	static const std::string& error_desc(error_code ec);
 
-	enum warning_code {
+	virtual ~load_result() = default;
+
+	enum class warning_code {
 		LOAD_UNKNOWN_SOURCE = 0,
 		LOAD_UNSAFE_NA_CHECK,
 		LOAD_NO_EVTTYPE,
@@ -60,11 +62,10 @@ public:
 		LOAD_EXCEPTION_NAME_NOT_UNIQUE,
 		LOAD_INVALID_MACRO_NAME,
 		LOAD_INVALID_LIST_NAME,
-		LOAD_COMPILE_CONDITION
+		LOAD_COMPILE_CONDITION,
+		LOAD_UNKNOWN_KEY
 	};
 
-	virtual ~load_result() = default;
-
 	// The warning code as a string
 	static const std::string& warning_code_str(warning_code ec);
 
@@ -75,6 +76,27 @@ public:
 	// impact.
 	static const std::string& warning_desc(warning_code ec);
 
+	enum class deprecated_field {
+		DEPRECATED_FIELD_EVT_DIR,
+		DEPRECATED_FIELD_EVT_LATENCY,
+		DEPRECATED_FIELD_EVT_LATENCY_S,
+		DEPRECATED_FIELD_EVT_LATENCY_NS,
+		DEPRECATED_FIELD_EVT_LATENCY_HUMAN,
+		DEPRECATED_FIELD_EVT_WAIT_LATENCY,
+		DEPRECATED_FIELD_NOT_FOUND
+	};
+
+	// The deprecated field as a string
+	static const std::string& deprecated_field_str(deprecated_field df);
+
+	// A longer description of what the deprecated field represents and the
+	// impact.
+	static const std::string& deprecated_field_desc(deprecated_field df);
+
+	// Return the deprecated field from a field string name, or DEPRECATED_FIELD_NOT_FOUND if the
+	// field is not deprecated
+	static deprecated_field deprecated_field_from_str(const std::string& f);
+
 	// If true, the rules were loaded successfully and can be used
 	// against events. If false, there were one or more
 	// errors--use one of the as_xxx methods to return information

userspace/engine/falco_rule.h

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /*
-Copyright (C) 2023 The Falco Authors.
+Copyright (C) 2025 The Falco Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -77,7 +77,11 @@ struct falco_macro {
     The rule ID must be unique across all the rules loaded in the engine.
 */
 struct falco_rule {
-	falco_rule(): id(0), priority(falco_common::PRIORITY_DEBUG) {}
+	falco_rule():
+	        id(0),
+	        priority(falco_common::PRIORITY_DEBUG),
+	        capture(false),
+	        capture_duration(0) {}
 	falco_rule(falco_rule&&) = default;
 	falco_rule& operator=(falco_rule&&) = default;
 	falco_rule(const falco_rule&) = default;
@@ -91,7 +95,9 @@ struct falco_rule {
 		return (this->id == rhs.id && this->source == rhs.source && this->name == rhs.name &&
 		        this->description == rhs.description && this->output == rhs.output &&
 		        this->tags == rhs.tags && this->exception_fields == rhs.exception_fields &&
-		        this->priority == rhs.priority && this->condition.get() == rhs.condition.get() &&
+		        this->priority == rhs.priority && this->capture == rhs.capture &&
+		        this->capture_duration == rhs.capture_duration &&
+		        this->condition.get() == rhs.condition.get() &&
 		        this->filter.get() == rhs.filter.get());
 	}
 
@@ -104,6 +110,8 @@ struct falco_rule {
 	std::set<std::string> tags;
 	std::set<std::string> exception_fields;
 	falco_common::priority_type priority;
+	bool capture;
+	uint32_t capture_duration;
 	std::shared_ptr<libsinsp::filter::ast::expr> condition;
 	std::shared_ptr<sinsp_filter> filter;
 };

userspace/engine/falco_utils.cpp

@@ -120,11 +120,10 @@ uint64_t parse_prometheus_interval(std::string interval_str) {
 		                                                            ONE_MS_TO_MS};
 
 		for(size_t i = 0; i < sizeof(all_prometheus_units) / sizeof(const char*); i++) {
-			std::string cur_interval_str;
-			uint64_t cur_interval = 0;
 			const auto& group_it = named_groups.find(all_prometheus_units[i]);
 			if(group_it != named_groups.end()) {
-				cur_interval_str = args[group_it->second - 1];
+				uint64_t cur_interval = 0;
+				std::string cur_interval_str = args[group_it->second - 1];
 				if(!cur_interval_str.empty()) {
 					cur_interval = std::stoull(cur_interval_str, nullptr, 0);
 				}

userspace/engine/field_formatter.cpp

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2026 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include "field_formatter.h"
+#include "formats.h"
+
+using namespace falco;
+
+// Factory method
+std::unique_ptr<FieldFormatter> FieldFormatter::create(output_format format, bool verbose) {
+	switch(format) {
+	case output_format::JSON:
+		return std::make_unique<JsonFieldFormatter>(verbose);
+	case output_format::MARKDOWN:
+		return std::make_unique<MarkdownFieldFormatter>(verbose);
+	case output_format::TEXT:
+	default:
+		return std::make_unique<TextFieldFormatter>(verbose);
+	}
+}
+
+// ============================================================================
+// TextFieldFormatter implementation
+// ============================================================================
+
+TextFieldFormatter::TextFieldFormatter(bool verbose): m_verbose(verbose) {}
+
+void TextFieldFormatter::begin() {
+	// Nothing to do for text format
+}
+
+void TextFieldFormatter::print_fieldclass(
+        const sinsp_filter_factory::filter_fieldclass_info& fld_class,
+        const std::set<std::string>& event_sources) {
+	printf("%s\n", fld_class.as_string(m_verbose, event_sources).c_str());
+}
+
+void TextFieldFormatter::print_field_name(const std::string& name) {
+	printf("%s\n", name.c_str());
+}
+
+void TextFieldFormatter::end() {
+	// Nothing to do for text format
+}
+
+// ============================================================================
+// MarkdownFieldFormatter implementation
+// ============================================================================
+
+MarkdownFieldFormatter::MarkdownFieldFormatter(bool verbose): m_verbose(verbose) {}
+
+void MarkdownFieldFormatter::begin() {
+	// Nothing to do for markdown format
+}
+
+void MarkdownFieldFormatter::print_fieldclass(
+        const sinsp_filter_factory::filter_fieldclass_info& fld_class,
+        const std::set<std::string>& event_sources) {
+	printf("%s\n", fld_class.as_markdown(event_sources).c_str());
+}
+
+void MarkdownFieldFormatter::print_field_name(const std::string& name) {
+	printf("%s\n", name.c_str());
+}
+
+void MarkdownFieldFormatter::end() {
+	// Nothing to do for markdown format
+}
+
+// ============================================================================
+// JsonFieldFormatter implementation
+// ============================================================================
+
+JsonFieldFormatter::JsonFieldFormatter(bool verbose): m_verbose(verbose) {}
+
+void JsonFieldFormatter::begin() {
+	m_fieldclasses_array = nlohmann::json::array();
+	m_fieldnames_array = nlohmann::json::array();
+	m_has_fieldclasses = false;
+	m_has_fieldnames = false;
+}
+
+void JsonFieldFormatter::print_fieldclass(
+        const sinsp_filter_factory::filter_fieldclass_info& fld_class,
+        const std::set<std::string>& event_sources) {
+	std::string json_str = fld_class.as_json(event_sources);
+	if(!json_str.empty()) {
+		m_fieldclasses_array.push_back(nlohmann::json::parse(json_str));
+		m_has_fieldclasses = true;
+	}
+}
+
+void JsonFieldFormatter::print_field_name(const std::string& name) {
+	m_fieldnames_array.push_back(name);
+	m_has_fieldnames = true;
+}
+
+void JsonFieldFormatter::end() {
+	nlohmann::json root;
+
+	if(m_has_fieldclasses) {
+		root["fieldclasses"] = m_fieldclasses_array;
+		printf("%s\n", root.dump(2).c_str());
+	} else if(m_has_fieldnames) {
+		root["fieldnames"] = m_fieldnames_array;
+		printf("%s\n", root.dump(2).c_str());
+	}
+}

userspace/engine/field_formatter.h

@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2026 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#pragma once
+
+#include <string>
+#include <set>
+#include <memory>
+#include <nlohmann/json.hpp>
+
+#include <libsinsp/sinsp.h>
+
+enum class output_format;
+
+namespace falco {
+
+// Abstract formatter interface for field listing
+class FieldFormatter {
+public:
+	virtual ~FieldFormatter() = default;
+
+	// Initialize formatter
+	virtual void begin() = 0;
+
+	// Print a field class with its event sources
+	virtual void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
+	                              const std::set<std::string>& event_sources) = 0;
+
+	// Print a single field name (for names_only mode)
+	virtual void print_field_name(const std::string& name) = 0;
+
+	// Finalize and output
+	virtual void end() = 0;
+
+	// Factory method
+	static std::unique_ptr<FieldFormatter> create(output_format format, bool verbose);
+};
+
+// Text formatter (default)
+class TextFieldFormatter : public FieldFormatter {
+public:
+	explicit TextFieldFormatter(bool verbose);
+
+	void begin() override;
+	void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
+	                      const std::set<std::string>& event_sources) override;
+	void print_field_name(const std::string& name) override;
+	void end() override;
+
+private:
+	bool m_verbose;
+};
+
+// Markdown formatter
+class MarkdownFieldFormatter : public FieldFormatter {
+public:
+	explicit MarkdownFieldFormatter(bool verbose);
+
+	void begin() override;
+	void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
+	                      const std::set<std::string>& event_sources) override;
+	void print_field_name(const std::string& name) override;
+	void end() override;
+
+private:
+	bool m_verbose;
+};
+
+// JSON formatter
+class JsonFieldFormatter : public FieldFormatter {
+public:
+	explicit JsonFieldFormatter(bool verbose);
+
+	void begin() override;
+	void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
+	                      const std::set<std::string>& event_sources) override;
+	void print_field_name(const std::string& name) override;
+	void end() override;
+
+private:
+	bool m_verbose;
+	nlohmann::json m_fieldclasses_array;
+	nlohmann::json m_fieldnames_array;
+	bool m_has_fieldclasses{false};
+	bool m_has_fieldnames{false};
+};
+
+}  // namespace falco

userspace/engine/filter_details_resolver.cpp

@@ -125,5 +125,13 @@ void filter_details_resolver::visitor::visit(ast::field_expr* e) {
 
 void filter_details_resolver::visitor::visit(ast::field_transformer_expr* e) {
 	m_details.transformers.insert(e->transformer);
-	e->value->accept(this);
+	for(auto& value : e->values) {
+		value->accept(this);
+	}
+}
+
+void filter_details_resolver::visitor::visit(ast::transformer_list_expr* e) {
+	for(auto& child : e->children) {
+		child->accept(this);
+	}
 }

userspace/engine/filter_details_resolver.h

@@ -72,6 +72,7 @@ private:
 		void visit(libsinsp::filter::ast::binary_check_expr* e) override;
 		void visit(libsinsp::filter::ast::field_expr* e) override;
 		void visit(libsinsp::filter::ast::field_transformer_expr* e) override;
+		void visit(libsinsp::filter::ast::transformer_list_expr* e) override;
 
 		filter_details& m_details;
 		bool m_expect_list;

userspace/engine/filter_macro_resolver.cpp

@@ -105,6 +105,10 @@ void filter_macro_resolver::visitor::visit(ast::field_transformer_expr* e) {
 	m_node_substitute = nullptr;
 }
 
+void filter_macro_resolver::visitor::visit(ast::transformer_list_expr* e) {
+	m_node_substitute = nullptr;
+}
+
 void filter_macro_resolver::visitor::visit(ast::identifier_expr* e) {
 	const auto& macro = m_macros.find(e->identifier);
 	if(macro != m_macros.end() && macro->second)  // skip null-ptr macros

userspace/engine/filter_macro_resolver.h

@@ -121,6 +121,7 @@ private:
 		void visit(libsinsp::filter::ast::binary_check_expr* e) override;
 		void visit(libsinsp::filter::ast::field_expr* e) override;
 		void visit(libsinsp::filter::ast::field_transformer_expr* e) override;
+		void visit(libsinsp::filter::ast::transformer_list_expr* e) override;
 	};
 
 	std::vector<value_info> m_errors;

userspace/engine/filter_warning_resolver.cpp

@@ -15,6 +15,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+#include <string>
 #include <libsinsp/sinsp.h>
 #include "filter_warning_resolver.h"
 
@@ -32,14 +33,30 @@ static inline bool is_equality_operator(const std::string& op) {
 	       op == "pmatch";
 }
 
-bool filter_warning_resolver::run(libsinsp::filter::ast::expr* filter,
-                                  std::set<load_result::warning_code>& warnings) const {
-	visitor v;
-	auto size = warnings.size();
+bool filter_warning_resolver::run(const rule_loader::context& ctx,
+                                  rule_loader::result& res,
+                                  libsinsp::filter::ast::expr& filter) const {
+	std::set<falco::load_result::warning_code> warnings;
+	std::set<falco::load_result::deprecated_field> deprecated_fields;
+	visitor v(warnings, deprecated_fields);
 	v.m_is_equality_check = false;
-	v.m_warnings = &warnings;
-	filter->accept(&v);
-	return warnings.size() > size;
+	filter.accept(&v);
+	for(auto& w : warnings) {
+		switch(w) {
+		case falco::load_result::warning_code::LOAD_DEPRECATED_ITEM:
+			// add a warning for each deprecated field
+			for(auto& deprecated_field : deprecated_fields) {
+				res.add_deprecated_field_warning(
+				        deprecated_field,
+				        falco::load_result::deprecated_field_desc(deprecated_field),
+				        ctx);
+			}
+			break;
+		default:
+			res.add_warning(w, "", ctx);
+		}
+	}
+	return !warnings.empty();
 }
 
 void filter_warning_resolver::visitor::visit(libsinsp::filter::ast::binary_check_expr* e) {
@@ -54,17 +71,24 @@ void filter_warning_resolver::visitor::visit(libsinsp::filter::ast::binary_check
 
 void filter_warning_resolver::visitor::visit(libsinsp::filter::ast::field_expr* e) {
 	m_last_node_is_unsafe_field = is_unsafe_field(e->field);
+
+	// Check for deprecated dir field usage
+	if(auto df = falco::load_result::deprecated_field_from_str(e->field);
+	   df != falco::load_result::deprecated_field::DEPRECATED_FIELD_NOT_FOUND) {
+		m_deprecated_fields->insert(df);
+		m_warnings->insert(falco::load_result::warning_code::LOAD_DEPRECATED_ITEM);
+	}
 }
 
 void filter_warning_resolver::visitor::visit(libsinsp::filter::ast::value_expr* e) {
 	if(m_is_equality_check && e->value == no_value) {
-		m_warnings->insert(load_result::LOAD_UNSAFE_NA_CHECK);
+		m_warnings->insert(falco::load_result::warning_code::LOAD_UNSAFE_NA_CHECK);
 	}
 }
 
 void filter_warning_resolver::visitor::visit(libsinsp::filter::ast::list_expr* e) {
 	if(m_is_equality_check &&
 	   std::find(e->values.begin(), e->values.end(), no_value) != e->values.end()) {
-		m_warnings->insert(load_result::LOAD_UNSAFE_NA_CHECK);
+		m_warnings->insert(falco::load_result::warning_code::LOAD_UNSAFE_NA_CHECK);
 	}
 }

userspace/engine/filter_warning_resolver.h

@@ -23,6 +23,7 @@ limitations under the License.
 #include <memory>
 #include "falco_common.h"
 #include "falco_load_result.h"
+#include "rule_loader.h"
 
 /*!
     \brief Searches for bad practices in filter conditions and
@@ -31,25 +32,23 @@ limitations under the License.
 class filter_warning_resolver {
 public:
 	/*!
-	    \brief Visits a filter AST and substitutes macro references
-	    according with all the definitions added through set_macro(),
-	    by replacing the reference with a clone of the macro AST.
+	    \brief Runs the filter warning resolver on a filter AST and adds the warnings to the result
+	   object \param ctx The context of the warning \param res The result to add the warnings to
 	    \param filter The filter AST to be visited
-	    \param warnings Set of strings to be filled with warning codes. This
-	    is not cleared up before the visit
-	    \param blocking Filled-out with true if at least one warning is
-	    found and at least one warning prevents the filter from being loaded
 	    \return true if at least one warning is generated
 	*/
-	bool run(libsinsp::filter::ast::expr* filter,
-	         std::set<falco::load_result::warning_code>& warnings) const;
+	bool run(const rule_loader::context& ctx,
+	         rule_loader::result& res,
+	         libsinsp::filter::ast::expr& filter) const;
 
 private:
 	struct visitor : public libsinsp::filter::ast::base_expr_visitor {
-		visitor():
+		visitor(std::set<falco::load_result::warning_code>& warnings,
+		        std::set<falco::load_result::deprecated_field>& deprecated_fields):
 		        m_is_equality_check(false),
 		        m_last_node_is_unsafe_field(false),
-		        m_warnings(nullptr) {}
+		        m_warnings(&warnings),
+		        m_deprecated_fields(&deprecated_fields) {}
 		visitor(visitor&&) = default;
 		visitor& operator=(visitor&&) = default;
 		visitor(const visitor&) = delete;
@@ -58,6 +57,7 @@ private:
 		bool m_is_equality_check;
 		bool m_last_node_is_unsafe_field;
 		std::set<falco::load_result::warning_code>* m_warnings;
+		std::set<falco::load_result::deprecated_field>* m_deprecated_fields;
 
 		void visit(libsinsp::filter::ast::value_expr* e) override;
 		void visit(libsinsp::filter::ast::list_expr* e) override;

userspace/engine/formats.cpp

@@ -57,8 +57,6 @@ std::string falco_formats::format_event(sinsp_evt *evt,
 		message_format = "*" + message_format;
 	}
 
-	std::shared_ptr<sinsp_evt_formatter> formatter;
-
 	auto prefix_formatter = m_falco_engine->create_formatter(source, prefix_format);
 	auto message_formatter = m_falco_engine->create_formatter(source, message_format);
 

userspace/engine/indexable_ruleset.h

@@ -46,7 +46,7 @@ template<class filter_wrapper>
 class indexable_ruleset : public filter_ruleset {
 public:
 	indexable_ruleset() = default;
-	virtual ~indexable_ruleset() = default;
+	virtual ~indexable_ruleset() override = default;
 
 	// Required to implement filter_ruleset
 	void clear() override {
@@ -229,7 +229,7 @@ private:
 	// A group of filters all having the same ruleset
 	class ruleset_filters {
 	public:
-		ruleset_filters(uint16_t ruleset_id): m_ruleset_id(ruleset_id) {}
+		explicit ruleset_filters(uint16_t ruleset_id): m_ruleset_id(ruleset_id) {}
 
 		virtual ~ruleset_filters() {};
 

userspace/engine/logger.cpp

@@ -128,15 +128,9 @@ void falco_logger::log(falco_logger::level priority, const std::string&& msg) {
 			}
 		} else {
 			const struct tm* ltm = std::localtime(&result);
-			char* atime = (ltm ? std::asctime(ltm) : NULL);
-			std::string tstr;
-			if(atime) {
-				tstr = atime;
-				tstr = tstr.substr(0, 24);  // remove trailing newline
-			} else {
-				tstr = "N/A";
-			}
-			fprintf(stderr, "%s: %s", tstr.c_str(), copy.c_str());
+			char tstr[std::size("WWW MMM DD HH:mm:ss YYYY")];
+			std::strftime(std::data(tstr), std::size(tstr), "%a %b %d %H:%M:%S %Y", ltm);
+			fprintf(stderr, "%s: %s", tstr, copy.c_str());
 		}
 	}
 }

userspace/engine/output_format.h

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /*
-Copyright (C) 2023 The Falco Authors.
+Copyright (C) 2026 The Falco Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,14 +17,4 @@ limitations under the License.
 
 #pragma once
 
-#include "outputs.h"
-
-namespace falco {
-namespace outputs {
-
-class output_grpc : public abstract_output {
-	void output(const message *msg) override;
-};
-
-}  // namespace outputs
-}  // namespace falco
+enum class output_format { TEXT, MARKDOWN, JSON };

userspace/engine/rule_json_schema.h

@@ -74,6 +74,12 @@ const char rule_schema_string[] = LONG_STRING_CONST(
                 "priority": {
                     "$ref": "#/definitions/Priority"
                 },
+                "capture": {
+                    "type": "boolean"
+                },
+                "capture_duration": {
+                    "type": "integer"
+                },
                 "source": {
 	                "type": "string"
                 },
@@ -91,6 +97,12 @@ const char rule_schema_string[] = LONG_STRING_CONST(
                     "items": {
                         "type": "string"
                     }
+                },
+                "warn_evttypes": {
+                    "type": "boolean"
+                },
+                "skip-if-unknown-filter": {
+                    "type": "boolean"
                 }
             },
             "required": [],
@@ -144,7 +156,7 @@ const char rule_schema_string[] = LONG_STRING_CONST(
                 "append",
                 "replace"
             ],
-            "title": "Priority"
+            "title": "OverriddenItem"
         },
         "Override": {
             "type": "object",
@@ -170,6 +182,21 @@ const char rule_schema_string[] = LONG_STRING_CONST(
                 },
                 "exceptions": {
                     "$ref": "#/definitions/OverriddenItem"
+                },
+                "capture": {
+                    "$ref": "#/definitions/OverriddenItem"
+                },
+                "capture_duration": {
+                    "$ref": "#/definitions/OverriddenItem"
+                },
+                "tags": {
+                    "$ref": "#/definitions/OverriddenItem"
+                },
+                "warn_evttypes": {
+                    "$ref": "#/definitions/OverriddenItem"
+                },
+                "skip-if-unknown-filter": {
+                    "$ref": "#/definitions/OverriddenItem"
                 }
             },
             "minProperties": 1,

userspace/engine/rule_loader.cpp

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /*
-Copyright (C) 2023 The Falco Authors.
+Copyright (C) 2025 The Falco Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -116,7 +116,7 @@ void rule_loader::context::init(const std::string& name,
 	m_locs.push_back(loc);
 }
 
-std::string rule_loader::context::as_string() {
+std::string rule_loader::context::as_string() const {
 	std::ostringstream os;
 
 	// All valid contexts should have at least one location.
@@ -142,7 +142,7 @@ std::string rule_loader::context::as_string() {
 	return os.str();
 }
 
-nlohmann::json rule_loader::context::as_json() {
+nlohmann::json rule_loader::context::as_json() const {
 	nlohmann::json ret;
 
 	ret["locations"] = nlohmann::json::array();
@@ -282,9 +282,13 @@ void rule_loader::result::add_error(load_result::error_code ec,
 void rule_loader::result::add_warning(load_result::warning_code wc,
                                       const std::string& msg,
                                       const context& ctx) {
-	warning warn = {wc, msg, ctx};
+	warnings.emplace_back(std::make_unique<warning>(wc, msg, ctx));
+}
 
-	warnings.push_back(warn);
+void rule_loader::result::add_deprecated_field_warning(load_result::deprecated_field df,
+                                                       const std::string& msg,
+                                                       const context& ctx) {
+	warnings.emplace_back(std::make_unique<deprecated_field_warning>(df, msg, ctx));
 }
 
 void rule_loader::result::set_schema_validation_status(const std::vector<std::string>& status) {
@@ -329,7 +333,7 @@ const std::string& rule_loader::result::as_summary_string() {
 
 			os << " " << schema_validation_status.size() << " schema warnings: [";
 			bool first = true;
-			for(auto& status : schema_validation_status) {
+			for(const auto& status : schema_validation_status) {
 				if(!first) {
 					os << " ";
 				}
@@ -369,8 +373,7 @@ const std::string& rule_loader::result::as_summary_string() {
 			}
 			first = false;
 
-			os << load_result::warning_code_str(warn.wc) << " ("
-			   << load_result::warning_str(warn.wc) << ")";
+			os << warn->code_string() << " (" << warn->as_string() << ")";
 		}
 		os << "]";
 	}
@@ -409,7 +412,7 @@ const std::string& rule_loader::result::as_verbose_string(const rules_contents_t
 
 			os << schema_validation_status.size() << " Schema warnings:" << std::endl;
 
-			for(auto& status : schema_validation_status) {
+			for(const auto& status : schema_validation_status) {
 				os << "------" << std::endl;
 				os << status << std::endl;
 			}
@@ -438,14 +441,13 @@ const std::string& rule_loader::result::as_verbose_string(const rules_contents_t
 		os << warnings.size() << " Warnings:" << std::endl;
 
 		for(auto& warn : warnings) {
-			os << warn.ctx.as_string();
+			os << warn->ctx.as_string();
 
 			os << "------" << std::endl;
-			os << warn.ctx.snippet(contents);
+			os << warn->ctx.snippet(contents);
 			os << "------" << std::endl;
 
-			os << load_result::warning_code_str(warn.wc) << " ("
-			   << load_result::warning_str(warn.wc) << "): " << warn.msg;
+			os << warn->code_string() << " (" << warn->as_string() << "): " << warn->msg;
 			os << std::endl;
 		}
 	}
@@ -492,16 +494,7 @@ const nlohmann::json& rule_loader::result::as_json(const rules_contents_t& conte
 
 	j["warnings"] = nlohmann::json::array();
 	for(auto& warn : warnings) {
-		nlohmann::json jwarn;
-
-		jwarn["context"] = warn.ctx.as_json();
-		jwarn["context"]["snippet"] = warn.ctx.snippet(contents);
-
-		jwarn["code"] = load_result::warning_code_str(warn.wc);
-		jwarn["codedesc"] = load_result::warning_desc(warn.wc);
-		jwarn["message"] = warn.msg;
-
-		j["warnings"].push_back(jwarn);
+		j["warnings"].push_back(warn->as_json(contents));
 	}
 
 	res_json = j;
@@ -532,6 +525,8 @@ rule_loader::rule_info::rule_info(context& ctx):
         visibility(0),
         unknown_source(false),
         priority(falco_common::PRIORITY_DEBUG),
+        capture(false),
+        capture_duration(0),
         enabled(true),
         warn_evttypes(true),
         skip_if_unknown_filter(false) {}

userspace/engine/rule_loader.h

@@ -154,8 +154,8 @@ public:
 	std::string snippet(const falco::load_result::rules_contents_t& rules_contents,
 	                    size_t snippet_width = default_snippet_width) const;
 
-	std::string as_string();
-	nlohmann::json as_json();
+	std::string as_string() const;
+	nlohmann::json as_json() const;
 
 private:
 	void init(const std::string& name,
@@ -183,15 +183,53 @@ struct warning {
 	        msg(m),
 	        ctx(c) {}
 	warning(warning&&) = default;
-	warning& operator=(warning&&) = default;
-	warning(const warning&) = default;
-	warning& operator=(const warning&) = default;
+
+	virtual ~warning() = default;
+
+	virtual std::string code_string() const { return falco::load_result::warning_code_str(wc); };
+	virtual std::string as_string() const { return falco::load_result::warning_str(wc); };
+	virtual std::string description() const { return falco::load_result::warning_desc(wc); };
+	virtual nlohmann::json as_json(const falco::load_result::rules_contents_t& contents) const {
+		nlohmann::json jwarn;
+
+		jwarn["context"] = ctx.as_json();
+		jwarn["context"]["snippet"] = ctx.snippet(contents);
+
+		jwarn["code"] = falco::load_result::warning_code_str(wc);
+		jwarn["codedesc"] = falco::load_result::warning_desc(wc);
+		jwarn["message"] = msg;
+		return jwarn;
+	};
 
 	falco::load_result::warning_code wc;
 	std::string msg;
 	context ctx;
 };
 
+struct deprecated_field_warning : warning {
+	deprecated_field_warning(): warning() {}
+	deprecated_field_warning(falco::load_result::deprecated_field df,
+	                         const std::string& m,
+	                         const context& c):
+	        warning(falco::load_result::warning_code::LOAD_DEPRECATED_ITEM, m, c),
+	        df(df) {}
+
+	std::string as_string() const override {
+		return warning::as_string() + ": field '" + falco::load_result::deprecated_field_str(df) +
+		       "'";
+	};
+	std::string description() const override {
+		return warning::description() + ": " + falco::load_result::deprecated_field_desc(df);
+	};
+	nlohmann::json as_json(const falco::load_result::rules_contents_t& contents) const override {
+		auto jwarn = warning::as_json(contents);
+		jwarn["deprecated_field"] = falco::load_result::deprecated_field_str(df);
+		return jwarn;
+	};
+
+	falco::load_result::deprecated_field df;
+};
+
 struct error {
 	error(): ec(falco::load_result::error_code::LOAD_ERR_FILE_READ), ctx("no-filename-given") {}
 	error(falco::load_result::error_code e, const std::string& m, const context& c):
@@ -228,7 +266,7 @@ public:
 class result : public falco::load_result {
 public:
 	explicit result(const std::string& name);
-	virtual ~result() = default;
+	virtual ~result() override = default;
 	result(result&&) = default;
 	result& operator=(result&&) = default;
 	result(const result&) = default;
@@ -248,6 +286,9 @@ public:
 	void add_warning(falco::load_result::warning_code ec,
 	                 const std::string& msg,
 	                 const context& ctx);
+	void add_deprecated_field_warning(falco::load_result::deprecated_field df,
+	                                  const std::string& msg,
+	                                  const context& ctx);
 
 	void set_schema_validation_status(const std::vector<std::string>& status);
 	std::string schema_validation() override;
@@ -260,7 +301,7 @@ protected:
 	std::vector<std::string> schema_validation_status;
 
 	std::vector<error> errors;
-	std::vector<warning> warnings;
+	std::vector<std::unique_ptr<warning>> warnings;
 
 	std::string res_summary_string;
 	std::string res_verbose_string;
@@ -460,6 +501,8 @@ struct rule_info {
 	std::set<std::string> tags;
 	std::vector<rule_exception_info> exceptions;
 	falco_common::priority_type priority;
+	bool capture;
+	uint32_t capture_duration;
 	bool enabled;
 	bool warn_evttypes;
 	bool skip_if_unknown_filter;
@@ -480,7 +523,8 @@ struct rule_update_info {
 	bool has_any_value() {
 		return cond.has_value() || output.has_value() || desc.has_value() || tags.has_value() ||
 		       exceptions.has_value() || priority.has_value() || enabled.has_value() ||
-		       warn_evttypes.has_value() || skip_if_unknown_filter.has_value();
+		       capture.has_value() || capture_duration.has_value() || warn_evttypes.has_value() ||
+		       skip_if_unknown_filter.has_value();
 	}
 
 	context ctx;
@@ -493,6 +537,8 @@ struct rule_update_info {
 	std::optional<std::set<std::string>> tags;
 	std::optional<std::vector<rule_exception_info>> exceptions;
 	std::optional<falco_common::priority_type> priority;
+	std::optional<bool> capture;
+	std::optional<uint32_t> capture_duration;
 	std::optional<bool> enabled;
 	std::optional<bool> warn_evttypes;
 	std::optional<bool> skip_if_unknown_filter;

userspace/engine/rule_loader_collector.cpp

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /*
-Copyright (C) 2023 The Falco Authors.
+Copyright (C) 2025 The Falco Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -188,7 +188,7 @@ void rule_loader::collector::define(configuration& cfg, rule_info& info) {
 	const auto* source = cfg.sources.at(info.source);
 	if(!source) {
 		info.unknown_source = true;
-		cfg.res->add_warning(falco::load_result::LOAD_UNKNOWN_SOURCE,
+		cfg.res->add_warning(falco::load_result::warning_code::LOAD_UNKNOWN_SOURCE,
 		                     "Unknown source " + info.source + ", skipping",
 		                     info.ctx);
 	}
@@ -313,6 +313,14 @@ void rule_loader::collector::selective_replace(configuration& cfg, rule_update_i
 		prev->priority = *info.priority;
 	}
 
+	if(info.capture.has_value()) {
+		prev->capture = *info.capture;
+	}
+
+	if(info.capture_duration.has_value()) {
+		prev->capture_duration = *info.capture_duration;
+	}
+
 	if(info.enabled.has_value()) {
 		prev->enabled = *info.enabled;
 	}

userspace/engine/rule_loader_compiler.cpp

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /*
-Copyright (C) 2023 The Falco Authors.
+Copyright (C) 2025 The Falco Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -19,7 +19,6 @@ limitations under the License.
 #include <memory>
 #include <set>
 #include <vector>
-#include <functional>
 
 #include "rule_loader_compiler.h"
 #include "filter_warning_resolver.h"
@@ -73,6 +72,24 @@ static bool is_format_valid(const falco_source& source, std::string fmt, std::st
 	}
 }
 
+static void check_deprecated_fields_in_output(const std::string& fmt,
+                                              const rule_loader::context& ctx,
+                                              rule_loader::result& res) {
+	// Check for evt.dir field usage in output format
+	for(int i = 0;
+	    i < static_cast<int>(falco::load_result::deprecated_field::DEPRECATED_FIELD_NOT_FOUND);
+	    i++) {
+		auto df = falco::load_result::deprecated_field(i);
+		if(fmt.find(falco::load_result::deprecated_field_str(df)) != std::string::npos) {
+			res.add_deprecated_field_warning(df,
+			                                 "usage of deprecated field '" +
+			                                         falco::load_result::deprecated_field_str(df) +
+			                                         "' has been detected in the rule output",
+			                                 ctx);
+		}
+	}
+}
+
 static void build_rule_exception_infos(
         const std::vector<rule_loader::rule_exception_info>& exceptions,
         std::set<std::string>& exception_fields,
@@ -160,13 +177,13 @@ static bool resolve_list(std::string& cnd, const falco_list& list) {
 	static std::string delims = blanks + "(),=";
 	std::string tmp;
 	std::string new_cnd;
-	size_t start, end;
+	size_t start;
 	bool used = false;
 	start = cnd.find(list.name);
 	while(start != std::string::npos) {
 		// the characters surrounding the name must
 		// be delims of beginning/end of string
-		end = start + list.name.length();
+		size_t end = start + list.name.length();
 		if((start == 0 || delims.find(cnd[start - 1]) != std::string::npos) &&
 		   (end >= cnd.length() || delims.find(cnd[end]) != std::string::npos)) {
 			// shift pointers to consume all whitespaces
@@ -271,7 +288,7 @@ static std::shared_ptr<ast::expr> parse_condition(std::string condition,
 	}
 }
 
-void rule_loader::compiler::compile_list_infos(configuration& cfg,
+void rule_loader::compiler::compile_list_infos(const configuration& cfg,
                                                const collector& col,
                                                indexed_vector<falco_list>& out) const {
 	std::list<std::string> used_names;
@@ -300,7 +317,7 @@ void rule_loader::compiler::compile_list_infos(configuration& cfg,
 }
 
 // note: there is a visibility ordering between macros
-void rule_loader::compiler::compile_macros_infos(configuration& cfg,
+void rule_loader::compiler::compile_macros_infos(const configuration& cfg,
                                                  const collector& col,
                                                  indexed_vector<falco_list>& lists,
                                                  indexed_vector<falco_macro>& out) const {
@@ -329,10 +346,11 @@ void rule_loader::compiler::compile_macros_infos(configuration& cfg,
 static bool err_is_unknown_type_or_field(const std::string& err) {
 	return err.find("nonexistent field") != std::string::npos ||
 	       err.find("invalid formatting token") != std::string::npos ||
-	       err.find("unknown event type") != std::string::npos;
+	       err.find("unknown event type") != std::string::npos ||
+	       err.find("unknown filter:") != std::string::npos;
 }
 
-bool rule_loader::compiler::compile_condition(configuration& cfg,
+bool rule_loader::compiler::compile_condition(const configuration& cfg,
                                               filter_macro_resolver& macro_resolver,
                                               indexed_vector<falco_list>& lists,
                                               const indexed_vector<rule_loader::macro_info>& macros,
@@ -356,11 +374,7 @@ bool rule_loader::compiler::compile_condition(configuration& cfg,
 	               parent_ctx);
 
 	// check for warnings in the filtering condition
-	if(warn_resolver.run(ast_out.get(), warn_codes)) {
-		for(const auto& w : warn_codes) {
-			cfg.res->add_warning(w, "", parent_ctx);
-		}
-	}
+	warn_resolver.run(cond_ctx, *cfg.res, *ast_out.get());
 
 	// validate the rule's condition: we compile it into a sinsp filter
 	// on-the-fly and we throw an exception with details on failure
@@ -373,23 +387,23 @@ bool rule_loader::compiler::compile_condition(configuration& cfg,
 		std::string err = e.what();
 		rule_loader::context ctx(compiler.get_pos(), condition, cond_ctx);
 		if(err_is_unknown_type_or_field(err) && allow_unknown_fields) {
-			cfg.res->add_warning(falco::load_result::load_result::LOAD_UNKNOWN_FILTER, err, ctx);
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_UNKNOWN_FILTER, err, ctx);
 			return false;
 		}
 		throw rule_loader::rule_load_exception(
-		        falco::load_result::load_result::LOAD_ERR_COMPILE_CONDITION,
+		        falco::load_result::error_code::LOAD_ERR_COMPILE_CONDITION,
 		        err,
 		        ctx);
 	}
 	for(const auto& w : compiler.get_warnings()) {
 		rule_loader::context ctx(w.pos, condition, cond_ctx);
-		cfg.res->add_warning(falco::load_result::load_result::LOAD_COMPILE_CONDITION, w.msg, ctx);
+		cfg.res->add_warning(falco::load_result::warning_code::LOAD_COMPILE_CONDITION, w.msg, ctx);
 	}
 
 	return true;
 }
 
-void rule_loader::compiler::compile_rule_infos(configuration& cfg,
+void rule_loader::compiler::compile_rule_infos(const configuration& cfg,
                                                const collector& col,
                                                indexed_vector<falco_list>& lists,
                                                indexed_vector<falco_macro>& macros,
@@ -438,7 +452,7 @@ void rule_loader::compiler::compile_rule_infos(configuration& cfg,
 		}
 
 		if(rule.output.find(s_container_info_fmt) != std::string::npos) {
-			cfg.res->add_warning(falco::load_result::load_result::LOAD_DEPRECATED_ITEM,
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_DEPRECATED_ITEM,
 			                     "%container.info is deprecated and no more useful, and will be "
 			                     "dropped by Falco 1.0.0. "
 			                     "The container plugin will automatically add required fields to "
@@ -473,23 +487,28 @@ void rule_loader::compiler::compile_rule_infos(configuration& cfg,
 			// skip the rule silently if skip_if_unknown_filter is true and
 			// we encountered some specific kind of errors
 			if(err_is_unknown_type_or_field(err) && r.skip_if_unknown_filter) {
-				cfg.res->add_warning(falco::load_result::load_result::LOAD_UNKNOWN_FILTER,
+				cfg.res->add_warning(falco::load_result::warning_code::LOAD_UNKNOWN_FILTER,
 				                     err,
 				                     r.output_ctx);
 				continue;
 			}
-			throw rule_load_exception(falco::load_result::load_result::LOAD_ERR_COMPILE_OUTPUT,
+			throw rule_load_exception(falco::load_result::error_code::LOAD_ERR_COMPILE_OUTPUT,
 			                          err,
 			                          r.output_ctx);
 		}
 
+		// check for deprecated fields in output format
+		check_deprecated_fields_in_output(rule.output, r.output_ctx, *cfg.res);
+
 		// validate the rule's extra fields if any
 		for(auto const& ef : rule.extra_output_fields) {
 			if(!is_format_valid(*cfg.sources.at(r.source), ef.second.first, err)) {
-				throw rule_load_exception(falco::load_result::load_result::LOAD_ERR_COMPILE_OUTPUT,
+				throw rule_load_exception(falco::load_result::error_code::LOAD_ERR_COMPILE_OUTPUT,
 				                          err,
 				                          r.output_ctx);
 			}
+			// check for deprecated fields in extra output fields
+			check_deprecated_fields_in_output(ef.second.first, r.output_ctx, *cfg.res);
 		}
 
 		if(!compile_condition(cfg,
@@ -511,7 +530,7 @@ void rule_loader::compiler::compile_rule_infos(configuration& cfg,
 		if(r.source == falco_common::syscall_source) {
 			auto evttypes = libsinsp::filter::ast::ppm_event_codes(rule.condition.get());
 			if((evttypes.empty() || evttypes.size() > 100) && r.warn_evttypes) {
-				cfg.res->add_warning(falco::load_result::load_result::LOAD_NO_EVTTYPE,
+				cfg.res->add_warning(falco::load_result::warning_code::LOAD_NO_EVTTYPE,
 				                     "Rule matches too many evt.type values. This has a "
 				                     "significant performance penalty.",
 				                     r.ctx);
@@ -523,6 +542,8 @@ void rule_loader::compiler::compile_rule_infos(configuration& cfg,
 		rule.source = r.source;
 		rule.description = r.desc;
 		rule.priority = r.priority;
+		rule.capture = r.capture;
+		rule.capture_duration = r.capture_duration;
 		rule.tags = r.tags;
 		auto rule_id = out.insert(rule, rule.name);
 		out.at(rule_id)->id = rule_id;
@@ -549,14 +570,14 @@ void rule_loader::compiler::compile(configuration& cfg,
 	// print info on any dangling lists or macros that were not used anywhere
 	for(const auto& m : out.macros) {
 		if(!m.used) {
-			cfg.res->add_warning(falco::load_result::load_result::LOAD_UNUSED_MACRO,
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_UNUSED_MACRO,
 			                     "Macro not referred to by any other rule/macro",
 			                     macro_info_from_name(col, m.name)->ctx);
 		}
 	}
 	for(const auto& l : out.lists) {
 		if(!l.used) {
-			cfg.res->add_warning(falco::load_result::LOAD_UNUSED_LIST,
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_UNUSED_LIST,
 			                     "List not referred to by any other rule/macro",
 			                     list_info_from_name(col, l.name)->ctx);
 		}

userspace/engine/rule_loader_compiler.h

@@ -56,7 +56,7 @@ protected:
 	   ast_out/filter_out with the compiled filter + ast. Returns false if
 	   the condition could not be compiled and should be skipped.
 	   */
-	bool compile_condition(configuration& cfg,
+	bool compile_condition(const configuration& cfg,
 	                       filter_macro_resolver& macro_resolver,
 	                       indexed_vector<falco_list>& lists,
 	                       const indexed_vector<rule_loader::macro_info>& macros,
@@ -70,16 +70,16 @@ protected:
 	                       std::shared_ptr<sinsp_filter>& filter_out) const;
 
 private:
-	void compile_list_infos(configuration& cfg,
+	void compile_list_infos(const configuration& cfg,
 	                        const collector& col,
 	                        indexed_vector<falco_list>& out) const;
 
-	void compile_macros_infos(configuration& cfg,
+	void compile_macros_infos(const configuration& cfg,
 	                          const collector& col,
 	                          indexed_vector<falco_list>& lists,
 	                          indexed_vector<falco_macro>& out) const;
 
-	void compile_rule_infos(configuration& cfg,
+	void compile_rule_infos(const configuration& cfg,
 	                        const collector& col,
 	                        indexed_vector<falco_list>& lists,
 	                        indexed_vector<falco_macro>& macros,

userspace/engine/rule_loader_reader.cpp

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /*
-Copyright (C) 2023 The Falco Authors.
+Copyright (C) 2025 The Falco Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -356,10 +356,10 @@ static void read_rule_exceptions(rule_loader::configuration& cfg,
 		v_ex.name = name;
 
 		// Check if an exception with the same name has already been defined
-		for(auto& exception : exceptions) {
+		for(const auto& exception : exceptions) {
 			if(v_ex.name == exception.name) {
 				cfg.res->add_warning(
-				        falco::load_result::LOAD_EXCEPTION_NAME_NOT_UNIQUE,
+				        falco::load_result::warning_code::LOAD_EXCEPTION_NAME_NOT_UNIQUE,
 				        "Multiple definitions of exception '" + v_ex.name + "' in the same rule",
 				        ex_ctx);
 			}
@@ -385,7 +385,7 @@ static void read_rule_exceptions(rule_loader::configuration& cfg,
 				v_ex.values.push_back(v_ex_val);
 			}
 		} else if(append) {
-			cfg.res->add_warning(falco::load_result::LOAD_APPEND_NO_VALUES,
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_APPEND_NO_VALUES,
 			                     "Overriding/appending exception with no values",
 			                     ex_ctx);
 		}
@@ -404,6 +404,23 @@ static void read_rule_exceptions(
 	exceptions = decoded;
 }
 
+static void warn_unknown_keys(const YAML::Node& item,
+                              const std::set<std::string>& expected_keys,
+                              rule_loader::configuration& cfg,
+                              const rule_loader::context& ctx) {
+	if(!item.IsMap()) {
+		return;
+	}
+	for(auto it = item.begin(); it != item.end(); ++it) {
+		std::string key = it->first.as<std::string>();
+		if(expected_keys.find(key) == expected_keys.end()) {
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_UNKNOWN_KEY,
+			                     "Unknown key '" + key + "'. The key will be ignored.",
+			                     ctx);
+		}
+	}
+}
+
 inline static bool check_update_expected(std::set<std::string>& expected_keys,
                                          const std::set<std::string>& overrides,
                                          const std::string& override_type,
@@ -460,6 +477,10 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 		}
 
 		collector.define(cfg, v);
+
+		static const std::set<std::string> expected_required_engine_version_keys{
+		        "required_engine_version"};
+		warn_unknown_keys(item, expected_required_engine_version_keys, cfg, ctx);
 	} else if(item["required_plugin_versions"].IsDefined()) {
 		const YAML::Node& req_plugin_vers = item["required_plugin_versions"];
 		rule_loader::context ctx(req_plugin_vers,
@@ -514,6 +535,14 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 
 			collector.define(cfg, v);
 		}
+
+		static const std::set<std::string> expected_required_plugin_versions_keys{
+		        "required_plugin_versions"};
+		rule_loader::context rpv_ctx(item,
+		                             rule_loader::context::REQUIRED_PLUGIN_VERSIONS,
+		                             "",
+		                             parent);
+		warn_unknown_keys(item, expected_required_plugin_versions_keys, cfg, rpv_ctx);
 	} else if(item["list"].IsDefined()) {
 		std::string name;
 		// Using tmp context until name is decoded
@@ -524,7 +553,7 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 
 		bool invalid_name = !re2::RE2::FullMatch(name, s_rgx_barestr);
 		if(invalid_name) {
-			cfg.res->add_warning(falco::load_result::LOAD_INVALID_LIST_NAME,
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_INVALID_LIST_NAME,
 			                     "List has an invalid name. List names should match a regular "
 			                     "expression: " RGX_BARESTR,
 			                     ctx);
@@ -538,7 +567,9 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 
 		decode_optional_val(item, "append", append, ctx);
 		if(append) {
-			cfg.res->add_warning(falco::load_result::LOAD_DEPRECATED_ITEM, WARNING_APPEND, ctx);
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_DEPRECATED_ITEM,
+			                     WARNING_APPEND,
+			                     ctx);
 		}
 
 		std::set<std::string> override_append, override_replace;
@@ -557,6 +588,12 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 		} else {
 			collector.define(cfg, v);
 		}
+
+		static const std::set<std::string> expected_list_keys{"list",
+		                                                      "items",
+		                                                      "append",
+		                                                      "override"};
+		warn_unknown_keys(item, expected_list_keys, cfg, ctx);
 	} else if(item["macro"].IsDefined()) {
 		std::string name;
 		// Using tmp context until name is decoded
@@ -567,7 +604,7 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 
 		bool invalid_name = !re2::RE2::FullMatch(name, s_rgx_identifier);
 		if(invalid_name) {
-			cfg.res->add_warning(falco::load_result::LOAD_INVALID_MACRO_NAME,
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_INVALID_MACRO_NAME,
 			                     "Macro has an invalid name. Macro names should match a regular "
 			                     "expression: " RGX_IDENTIFIER,
 			                     ctx);
@@ -587,7 +624,9 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 
 		decode_optional_val(item, "append", append, ctx);
 		if(append) {
-			cfg.res->add_warning(falco::load_result::LOAD_DEPRECATED_ITEM, WARNING_APPEND, ctx);
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_DEPRECATED_ITEM,
+			                     WARNING_APPEND,
+			                     ctx);
 		}
 
 		std::set<std::string> override_append, override_replace;
@@ -606,6 +645,12 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 		} else {
 			collector.define(cfg, v);
 		}
+
+		static const std::set<std::string> expected_macro_keys{"macro",
+		                                                       "condition",
+		                                                       "append",
+		                                                       "override"};
+		warn_unknown_keys(item, expected_macro_keys, cfg, ctx);
 	} else if(item["rule"].IsDefined()) {
 		std::string name;
 
@@ -621,7 +666,9 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 		bool has_append_flag = false;
 		decode_optional_val(item, "append", has_append_flag, ctx);
 		if(has_append_flag) {
-			cfg.res->add_warning(falco::load_result::LOAD_DEPRECATED_ITEM, WARNING_APPEND, ctx);
+			cfg.res->add_warning(falco::load_result::warning_code::LOAD_DEPRECATED_ITEM,
+			                     WARNING_APPEND,
+			                     ctx);
 		}
 
 		std::set<std::string> override_append, override_replace;
@@ -634,6 +681,8 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 		                                          "output",
 		                                          "desc",
 		                                          "priority",
+		                                          "capture",
+		                                          "capture_duration",
 		                                          "tags",
 		                                          "exceptions",
 		                                          "enabled",
@@ -756,6 +805,22 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 					v.priority = parsed_priority;
 				}
 
+				if(check_update_expected(expected_keys,
+				                         override_replace,
+				                         "replace",
+				                         "capture",
+				                         ctx)) {
+					decode_val(item, "capture", v.capture, ctx);
+				}
+
+				if(check_update_expected(expected_keys,
+				                         override_replace,
+				                         "replace",
+				                         "capture_duration",
+				                         ctx)) {
+					decode_val(item, "capture_duration", v.capture_duration, ctx);
+				}
+
 				if(check_update_expected(expected_keys,
 				                         override_replace,
 				                         "replace",
@@ -818,6 +883,8 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 			rule_loader::rule_info v(ctx);
 			v.name = name;
 			v.enabled = true;
+			v.capture = false;
+			v.capture_duration = 0;
 			v.warn_evttypes = true;
 			v.skip_if_unknown_filter = false;
 
@@ -829,7 +896,7 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 			if(!item["condition"].IsDefined() && !item["output"].IsDefined() &&
 			   !item["desc"].IsDefined() && !item["priority"].IsDefined()) {
 				decode_val(item, "enabled", v.enabled, ctx);
-				cfg.res->add_warning(falco::load_result::LOAD_DEPRECATED_ITEM,
+				cfg.res->add_warning(falco::load_result::warning_code::LOAD_DEPRECATED_ITEM,
 				                     WARNING_ENABLED,
 				                     ctx);
 				collector.enable(cfg, v);
@@ -863,6 +930,8 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 				      prictx);
 				decode_optional_val(item, "source", v.source, ctx);
 				decode_optional_val(item, "enabled", v.enabled, ctx);
+				decode_optional_val(item, "capture", v.capture, ctx);
+				decode_optional_val(item, "capture_duration", v.capture_duration, ctx);
 				decode_optional_val(item, "warn_evttypes", v.warn_evttypes, ctx);
 				decode_optional_val(item, "skip-if-unknown-filter", v.skip_if_unknown_filter, ctx);
 				decode_tags(item, v.tags, ctx);
@@ -870,9 +939,28 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 				collector.define(cfg, v);
 			}
 		}
+
+		static const std::set<std::string> expected_rule_keys{"rule",
+		                                                      "condition",
+		                                                      "output",
+		                                                      "desc",
+		                                                      "priority",
+		                                                      "source",
+		                                                      "enabled",
+		                                                      "capture",
+		                                                      "capture_duration",
+		                                                      "warn_evttypes",
+		                                                      "skip-if-unknown-filter",
+		                                                      "tags",
+		                                                      "exceptions",
+		                                                      "override",
+		                                                      "append"};
+		warn_unknown_keys(item, expected_rule_keys, cfg, ctx);
 	} else {
 		rule_loader::context ctx(item, rule_loader::context::RULES_CONTENT_ITEM, "", parent);
-		cfg.res->add_warning(falco::load_result::LOAD_UNKNOWN_ITEM, "Unknown top level item", ctx);
+		cfg.res->add_warning(falco::load_result::warning_code::LOAD_UNKNOWN_ITEM,
+		                     "Unknown top level item",
+		                     ctx);
 	}
 }
 

userspace/engine/yaml_helper.h

@@ -383,13 +383,11 @@ private:
 	 */
 	void get_node(YAML::Node& ret, const std::string& key, bool can_append = false) const {
 		try {
-			char c;
-			bool should_shift;
 			std::string nodeKey;
 			ret.reset(m_root);
 			for(std::string::size_type i = 0; i < key.size(); ++i) {
-				c = key[i];
-				should_shift = c == '.' || c == '[' || i == key.size() - 1;
+				char c = key[i];
+				bool should_shift = c == '.' || c == '[' || i == key.size() - 1;
 
 				if(c != '.' && c != '[') {
 					if(i > 0 && nodeKey.empty() && key[i - 1] != '.') {
@@ -458,11 +456,6 @@ namespace YAML {
 template<>
 struct convert<nlohmann::json> {
 	static bool decode(const Node& node, nlohmann::json& res) {
-		int int_val;
-		double double_val;
-		bool bool_val;
-		std::string str_val;
-
 		switch(node.Type()) {
 		case YAML::NodeType::Map:
 			for(auto&& it : node) {
@@ -478,7 +471,11 @@ struct convert<nlohmann::json> {
 				res.emplace_back(sub);
 			}
 			break;
-		case YAML::NodeType::Scalar:
+		case YAML::NodeType::Scalar: {
+			int int_val;
+			double double_val;
+			bool bool_val;
+			std::string str_val;
 			if(YAML::convert<int>::decode(node, int_val)) {
 				res = int_val;
 			} else if(YAML::convert<double>::decode(node, double_val)) {
@@ -488,6 +485,7 @@ struct convert<nlohmann::json> {
 			} else if(YAML::convert<std::string>::decode(node, str_val)) {
 				res = str_val;
 			}
+		}
 		default:
 			break;
 		}

userspace/falco/CMakeLists.txt

@@ -34,23 +34,22 @@ add_library(
 	app/actions/load_plugins.cpp
 	app/actions/load_rules_files.cpp
 	app/actions/process_events.cpp
-	app/actions/print_generated_gvisor_config.cpp
 	app/actions/print_help.cpp
 	app/actions/print_ignored_events.cpp
 	app/actions/print_kernel_version.cpp
 	app/actions/print_plugin_info.cpp
 	app/actions/print_support.cpp
 	app/actions/print_syscall_events.cpp
+	app/actions/event_formatter.cpp
 	app/actions/print_version.cpp
 	app/actions/print_page_size.cpp
 	app/actions/configure_syscall_buffer_size.cpp
 	app/actions/configure_syscall_buffer_num.cpp
 	app/actions/select_event_sources.cpp
-	app/actions/start_grpc_server.cpp
 	app/actions/start_webserver.cpp
 	app/actions/validate_rules_files.cpp
-	app/actions/create_requested_paths.cpp
 	app/actions/close_inspectors.cpp
+	app/actions/cleanup_outputs.cpp
 	app/actions/print_config_schema.cpp
 	app/actions/print_rule_schema.cpp
 	configuration.cpp
@@ -70,9 +69,14 @@ set(FALCO_INCLUDE_DIRECTORIES
 set(FALCO_DEPENDENCIES cxxopts)
 set(FALCO_LIBRARIES falco_engine)
 
-if(USE_JEMALLOC)
-	list(APPEND FALCO_DEPENDENCIES jemalloc)
-	list(APPEND FALCO_LIBRARIES ${JEMALLOC_LIB})
+if(USE_JEMALLOC OR USE_MIMALLOC)
+	list(APPEND FALCO_DEPENDENCIES malloc)
+	list(APPEND FALCO_LIBRARIES ${MALLOC_LIB})
+endif()
+
+if(USE_GPERFTOOLS)
+	list(APPEND FALCO_DEPENDENCIES gperftools)
+	list(APPEND FALCO_LIBRARIES "${GPERFTOOLS_PROFILER_LIB}")
 endif()
 
 if(NOT WIN32)
@@ -80,54 +84,21 @@ if(NOT WIN32)
 endif()
 
 if(CMAKE_SYSTEM_NAME MATCHES "Linux" AND NOT MINIMAL_BUILD)
-	target_sources(
-		falco_application
-		PRIVATE outputs_grpc.cpp
-				outputs_http.cpp
-				falco_metrics.cpp
-				webserver.cpp
-				grpc_context.cpp
-				grpc_request_context.cpp
-				grpc_server.cpp
-				grpc_context.cpp
-				${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
-				${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
-				${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.cc
-				${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.cc
-				${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc
+	target_sources(falco_application PRIVATE outputs_http.cpp falco_metrics.cpp webserver.cpp)
+
+	list(APPEND FALCO_INCLUDE_DIRECTORIES FALCO_INCLUDE_DIRECTORIES "${OPENSSL_INCLUDE_DIR}"
+		 "${CARES_INCLUDE}"
 	)
 
-	list(
-		APPEND
-		FALCO_INCLUDE_DIRECTORIES
-		FALCO_INCLUDE_DIRECTORIES
-		"${OPENSSL_INCLUDE_DIR}"
-		"${GRPC_INCLUDE}"
-		"${GRPCPP_INCLUDE}"
-		"${PROTOBUF_INCLUDE}"
-		"${CARES_INCLUDE}"
-	)
-
-	if(CMAKE_SYSTEM_NAME MATCHES "Linux" AND USE_BUNDLED_GRPC)
-		list(APPEND FALCO_DEPENDENCIES grpc)
+	if(TARGET c-ares)
+		list(APPEND FALCO_DEPENDENCIES c-ares)
 	endif()
 
 	if(CMAKE_SYSTEM_NAME MATCHES "Linux" AND USE_BUNDLED_CURL)
 		list(APPEND FALCO_DEPENDENCIES curl)
 	endif()
 
-	list(
-		APPEND
-		FALCO_LIBRARIES
-		httplib::httplib
-		"${CURL_LIBRARIES}"
-		"${GRPCPP_LIB}"
-		"${GRPC_LIB}"
-		"${GPR_LIB}"
-		"${GRPC_LIBRARIES}"
-		"${PROTOBUF_LIB}"
-		"${CARES_LIB}"
-	)
+	list(APPEND FALCO_LIBRARIES httplib::httplib "${CURL_LIBRARIES}" "${CARES_LIB}")
 endif()
 
 if(EMSCRIPTEN)
@@ -157,37 +128,6 @@ if(EMSCRIPTEN)
 	target_link_options(falco PRIVATE "-sEXPORTED_FUNCTIONS=['_main','_htons','_ntohs']")
 endif()
 
-if(CMAKE_SYSTEM_NAME MATCHES "Linux" AND NOT MINIMAL_BUILD)
-	add_custom_command(
-		OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
-			   ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.h
-			   ${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
-			   ${CMAKE_CURRENT_BINARY_DIR}/version.pb.h
-			   ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.cc
-			   ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.h
-			   ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.cc
-			   ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.h
-			   ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc
-			   ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.h
-		COMMENT "Generate gRPC API"
-		# Falco gRPC Version API
-		DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
-		COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=.
-				${CMAKE_CURRENT_SOURCE_DIR}/version.proto
-		COMMAND
-			${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=.
-			--plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN} ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
-		# Falco gRPC Outputs API
-		DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
-		COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=.
-				${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto ${CMAKE_CURRENT_SOURCE_DIR}/schema.proto
-		COMMAND
-			${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=.
-			--plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN} ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
-		WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-	)
-endif()
-
 # strip the Falco binary when releasing using musl
 if(MUSL_OPTIMIZED_BUILD AND CMAKE_BUILD_TYPE STREQUAL "release")
 	add_custom_command(

userspace/falco/app/actions/actions.h

@@ -27,7 +27,6 @@ namespace actions {
 falco::app::run_result configure_interesting_sets(falco::app::state& s);
 falco::app::run_result configure_syscall_buffer_size(falco::app::state& s);
 falco::app::run_result configure_syscall_buffer_num(const falco::app::state& s);
-falco::app::run_result create_requested_paths(falco::app::state& s);
 falco::app::run_result create_signal_handlers(falco::app::state& s);
 falco::app::run_result pidfile(const falco::app::state& s);
 falco::app::run_result init_falco_engine(falco::app::state& s);
@@ -39,7 +38,6 @@ falco::app::run_result load_config(const falco::app::state& s);
 falco::app::run_result load_plugins(falco::app::state& s);
 falco::app::run_result load_rules_files(falco::app::state& s);
 falco::app::run_result print_config_schema(falco::app::state& s);
-falco::app::run_result print_generated_gvisor_config(falco::app::state& s);
 falco::app::run_result print_help(falco::app::state& s);
 falco::app::run_result print_ignored_events(const falco::app::state& s);
 falco::app::run_result print_kernel_version(const falco::app::state& s);
@@ -52,13 +50,12 @@ falco::app::run_result print_version(falco::app::state& s);
 falco::app::run_result process_events(falco::app::state& s);
 falco::app::run_result require_config_file(const falco::app::state& s);
 falco::app::run_result select_event_sources(falco::app::state& s);
-falco::app::run_result start_grpc_server(falco::app::state& s);
 falco::app::run_result start_webserver(falco::app::state& s);
-falco::app::run_result stop_grpc_server(falco::app::state& s);
 falco::app::run_result stop_webserver(falco::app::state& s);
 falco::app::run_result unregister_signal_handlers(falco::app::state& s);
 falco::app::run_result validate_rules_files(falco::app::state& s);
 falco::app::run_result close_inspectors(falco::app::state& s);
+falco::app::run_result cleanup_outputs(falco::app::state& s);
 
 };  // namespace actions
 };  // namespace app

userspace/falco/app/actions/cleanup_outputs.cpp

@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2025 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include "actions.h"
+
+using namespace falco::app;
+using namespace falco::app::actions;
+
+falco::app::run_result falco::app::actions::cleanup_outputs(falco::app::state& s) {
+	if(s.outputs) {
+		s.outputs.reset();
+		s.engine->print_stats();
+	}
+	return run_result::ok();
+}

userspace/falco/app/actions/create_requested_paths.cpp

@@ -1,87 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/*
-Copyright (C) 2023 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "actions.h"
-#include "falco_utils.h"
-#include <sys/stat.h>
-#include <filesystem>
-
-using namespace falco::app;
-using namespace falco::app::actions;
-
-static int create_dir(const std::string &path);
-
-falco::app::run_result falco::app::actions::create_requested_paths(falco::app::state &s) {
-	if(s.is_gvisor()) {
-		// This is bad: parsing gvisor config to get endpoint
-		// to be able to auto-create the path to the file for the user.
-		std::ifstream reader(s.config->m_gvisor.m_config);
-		if(reader.fail()) {
-			return run_result::fatal(s.config->m_gvisor.m_config + ": cannot open file");
-		}
-
-		nlohmann::json parsed_json;
-		std::string gvisor_socket;
-		try {
-			parsed_json = nlohmann::json::parse(reader);
-		} catch(const std::exception &e) {
-			return run_result::fatal(s.config->m_gvisor.m_config +
-			                         ": cannot parse JSON: " + e.what());
-		}
-
-		try {
-			gvisor_socket = parsed_json["trace_session"]["sinks"][0]["config"]["endpoint"];
-		} catch(const std::exception &e) {
-			return run_result::fatal(s.config->m_gvisor.m_config +
-			                         ": failed to fetch config.endpoint: " + e.what());
-		}
-
-		int ret = create_dir(gvisor_socket);
-		if(ret != 0) {
-			return run_result::fatal(gvisor_socket + ": " + strerror(errno));
-		}
-	}
-
-	if(s.config->m_grpc_enabled && !s.config->m_grpc_bind_address.empty()) {
-		if(falco::utils::network::is_unix_scheme(s.config->m_grpc_bind_address)) {
-			auto server_path = s.config->m_grpc_bind_address.substr(
-			        falco::utils::network::UNIX_SCHEME.length());
-			int ret = create_dir(server_path);
-			if(ret != 0) {
-				return run_result::fatal(server_path + ": " + strerror(errno));
-			}
-		}
-	}
-
-	// TODO: eventually other files written by Falco whose destination is
-	// customizable by users, must be handled here.
-	return run_result::ok();
-}
-
-// This function operates like `mkdir -p` excluding the last part of
-// the path which we assume to be the filename.
-static int create_dir(const std::string &path) {
-	std::filesystem::path dirPath(path);
-
-	try {
-		std::filesystem::create_directories(dirPath.parent_path());
-	} catch(const std::exception &ex) {
-		return -1;
-	}
-
-	return 0;
-}

userspace/falco/app/actions/event_formatter.cpp

@@ -0,0 +1,199 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2026 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include "event_formatter.h"
+
+#include <libsinsp/sinsp.h>
+#include <libsinsp/event.h>
+
+using namespace falco::app::actions;
+
+static bool is_flag_type(ppm_param_type type) {
+	return (type == PT_FLAGS8 || type == PT_FLAGS16 || type == PT_FLAGS32 ||
+	        type == PT_ENUMFLAGS8 || type == PT_ENUMFLAGS16 || type == PT_ENUMFLAGS32);
+}
+
+// Factory method
+std::unique_ptr<EventFormatter> EventFormatter::create(output_format format) {
+	switch(format) {
+	case output_format::JSON:
+		return std::make_unique<JsonFormatter>();
+	case output_format::MARKDOWN:
+		return std::make_unique<MarkdownFormatter>();
+	case output_format::TEXT:
+	default:
+		return std::make_unique<TextFormatter>();
+	}
+}
+
+// ============================================================================
+// TextFormatter implementation
+// ============================================================================
+
+void TextFormatter::begin(const std::string& schema_version) {
+	printf("The events below are valid for Falco *Schema Version*: %s\n", schema_version.c_str());
+}
+
+void TextFormatter::begin_category(const std::string& category) {
+	printf("## %s\n\n", category.c_str());
+}
+
+void TextFormatter::print_event(const event_entry& e) {
+	char dir = e.is_enter ? '>' : '<';
+	printf("%c %s(", dir, e.name.c_str());
+
+	for(uint32_t k = 0; k < e.info->nparams; k++) {
+		if(k != 0) {
+			printf(", ");
+		}
+		print_param(&e.info->params[k]);
+	}
+
+	printf(")\n");
+}
+
+void TextFormatter::end_category() {
+	printf("\n");
+}
+
+void TextFormatter::end() {
+	// Nothing to do for text format
+}
+
+void TextFormatter::print_param(const struct ppm_param_info* param) {
+	printf("%s **%s**", param_type_to_string(param->type), param->name);
+
+	if(is_flag_type(param->type) && param->info) {
+		auto flag_info = static_cast<const ppm_name_value*>(param->info);
+
+		printf(": ");
+		for(size_t i = 0; flag_info[i].name != NULL; i++) {
+			if(i != 0) {
+				printf(", ");
+			}
+			printf("%s", flag_info[i].name);
+		}
+	}
+}
+
+// ============================================================================
+// MarkdownFormatter implementation
+// ============================================================================
+
+void MarkdownFormatter::begin(const std::string& schema_version) {
+	printf("The events below are valid for Falco *Schema Version*: %s\n", schema_version.c_str());
+}
+
+void MarkdownFormatter::begin_category(const std::string& category) {
+	printf("## %s\n\n", category.c_str());
+	printf("Default | Dir | Name | Params \n");
+	printf(":-------|:----|:-----|:-----\n");
+}
+
+void MarkdownFormatter::print_event(const event_entry& e) {
+	char dir = e.is_enter ? '>' : '<';
+
+	printf(e.available ? "Yes" : "No");
+	printf(" | `%c` | `%s` | ", dir, e.name.c_str());
+
+	for(uint32_t k = 0; k < e.info->nparams; k++) {
+		if(k != 0) {
+			printf(", ");
+		}
+		print_param(&e.info->params[k]);
+	}
+
+	printf("\n");
+}
+
+void MarkdownFormatter::end_category() {
+	printf("\n");
+}
+
+void MarkdownFormatter::end() {
+	// Nothing to do for markdown format
+}
+
+void MarkdownFormatter::print_param(const struct ppm_param_info* param) {
+	printf("%s **%s**", param_type_to_string(param->type), param->name);
+
+	if(is_flag_type(param->type) && param->info) {
+		auto flag_info = static_cast<const ppm_name_value*>(param->info);
+
+		printf(": ");
+		for(size_t i = 0; flag_info[i].name != NULL; i++) {
+			if(i != 0) {
+				printf(", ");
+			}
+			printf("*%s*", flag_info[i].name);
+		}
+	}
+}
+
+// ============================================================================
+// JsonFormatter implementation
+// ============================================================================
+
+void JsonFormatter::begin(const std::string& schema_version) {
+	m_root = nlohmann::json::object();
+	m_root["schema_version"] = schema_version;
+}
+
+void JsonFormatter::begin_category(const std::string& category) {
+	m_current_category = nlohmann::json::array();
+	m_current_category_name = category;
+}
+
+void JsonFormatter::print_event(const event_entry& e) {
+	m_current_category.push_back(event_to_json(e));
+}
+
+void JsonFormatter::end_category() {
+	m_root[m_current_category_name] = m_current_category;
+}
+
+void JsonFormatter::end() {
+	printf("%s\n", m_root.dump(2).c_str());
+}
+
+nlohmann::json JsonFormatter::event_to_json(const event_entry& e) {
+	nlohmann::json event;
+	event["name"] = e.name;
+	event["dir"] = e.is_enter ? ">" : "<";
+	event["available"] = e.available;
+
+	nlohmann::json params = nlohmann::json::array();
+	for(uint32_t k = 0; k < e.info->nparams; k++) {
+		nlohmann::json param;
+		param["type"] = param_type_to_string(e.info->params[k].type);
+		param["name"] = e.info->params[k].name;
+
+		if(is_flag_type(e.info->params[k].type) && e.info->params[k].info) {
+			auto flag_info = static_cast<const ppm_name_value*>(e.info->params[k].info);
+			nlohmann::json flags = nlohmann::json::array();
+			for(size_t i = 0; flag_info[i].name != NULL; i++) {
+				flags.push_back(flag_info[i].name);
+			}
+			param["flags"] = flags;
+		}
+
+		params.push_back(param);
+	}
+	event["params"] = params;
+
+	return event;
+}