76f64f5d79
Properly parse multi-document yaml files e.g. blocks separated by ---. This is easily handled by lyaml itself--you just need to pass the option all = true to yaml.load, and each document will be provided as a table. This does break the table iteration a bit, so some more refactoring: - Create a load_state table that holds context like the current - document index, the required_engine_version, etc. - Pull out the parts that parse a single document to load_rules_doc(), which is given the table for a single document + load_state. - Simplify get_orig_yaml_obj to just provide a single row index and - return all rows from that point to the next blank line or line starting with '-' Signed-off-by: Mark Stemm <mark.stemm@gmail.com> |
||
|---|---|---|
| .github | ||
| cmake/modules | ||
| cpack/debian | ||
| docker | ||
| examples | ||
| integrations | ||
| rules | ||
| scripts | ||
| test | ||
| tests | ||
| userspace | ||
| .clang-format | ||
| .cmake-format | ||
| .gitignore | ||
| .luacheckrc | ||
| .travis.yml | ||
| .yamllint.conf | ||
| CHANGELOG.md | ||
| CMakeCPackOptions.cmake | ||
| CMakeLists.txt | ||
| CODE_OF_CONDUCT | ||
| CONTRIBUTING.md | ||
| COPYING | ||
| falco.yaml | ||
| GOVERNANCE | ||
| MAINTAINERS | ||
| OWNERS | ||
| README.md | ||
Falco
Latest release
v0.17.0 Read the change log
Dev Branch: 
Master Branch: 
CII Best Practices:
Falco is a behavioral activity monitor designed to detect anomalous activity in your applications. Powered by sysdig’s system call capture infrastructure, Falco lets you continuously monitor and detect container, application, host, and network activity—all in one place—from one source of data, with one set of rules.
Falco is hosted by the Cloud Native Computing Foundation (CNCF) as a sandbox level project. If you are an organization that wants to help shape the evolution of technologies that are container-packaged, dynamically-scheduled and microservices-oriented, consider joining the CNCF. For details read the Falco CNCF project proposal.
What kind of behaviors can Falco detect?
Falco can detect and alert on any behavior that involves making Linux system calls. Falco alerts can be triggered by the use of specific system calls, their arguments, and by properties of the calling process. For example, Falco can easily detect incidents including but not limited to:
- A shell is running inside a container.
- A container is running in privileged mode, or is mounting a sensitive path, such as
/proc, from the host. - A server process is spawning a child process of an unexpected type.
- Unexpected read of a sensitive file, such as
/etc/shadow. - A non-device file is written to
/dev. - A standard system binary, such as
ls, is making an outbound network connection.
Installing Falco
A comprehensive installation guide for Falco is available in the documentation website.
How do you compare Falco with other security tools?
One of the questions we often get when we talk about Falco is “How does Falco differ from other Linux security tools such as SELinux, AppArmor, Auditd, etc.?”. We wrote a blog post comparing Falco with other tools.
Documentation
See Falco Documentation to quickly get started using Falco.
Join the Community
- Website for Falco.
- We are working on a blog for the Falco project. In the meantime you can find Falco posts over on the Sysdig blog.
- Join our Public Slack channel for open source Sysdig and Falco announcements and discussions.
License Terms
Falco is licensed to you under the Apache 2.0 open source license.
Contributing
See the CONTRIBUTING.md.