falco/proposals/20191030-api.md

Falco APIs

Summary

With this proposal we inted to present the intent of creating a Falco API.

This proposal also intends to list the set of the gRPC services such API will expose.

Motivation

We want users to interface with Falco data, rules, and configurations via thirdy-part clients.

Such ability would enable the community to create a whole set of OSS tools, built on Falco.

Some examples, already in place, are:

• falcoctl
• falco-exporter

Goals

Non-Goals

Proposal

Use cases

• Receive Falco events with a well-defined contract over wire --> outputs
• Receive Falco drops with a well-defined contract over wire --> drops
• Receive current Falco version and related meta information (commit hash, built type, etc.) --> version
• Config Falco via API (CRUD) -> configs
• Inject and/or modify Falco rules via API (CRUD) --> rules
• Send input events to Falco over wire --> inputs

Diagrams