falcosecurity/falco

Features

• eBPF Tooling - Captures system calls and kernel events in real-time using eBPF probes for runtime security monitoring.
• Cloud Security Monitoring - Monitors system calls and kernel events in real time to detect and alert on malicious behavior in cloud environments.
• Runtime Threat Detection - Functions as a cloud-native detection engine that evaluates system activity against a library of rules to identify threats.
• Threat Detection - Monitors system calls and kernel events in real-time to identify malicious patterns and security threats.
• System Call Tracing - Tracking of kernel-level syscalls and parameters to identify unauthorized file access, network connections, or process executions.
• System Capability Extensions - Integrates custom libraries and external modules to add new operational capabilities to the monitoring daemon.
• Kubernetes Security - Provides visibility into environment changes by auditing and monitoring Kubernetes cluster activity.
• Audit Log Analysis - Analyzes Kubernetes audit logs to identify unauthorized changes and security threats in containerized environments.
• System Event Stream Integrations - Introduces new streams of system events into the processing pipeline to enable monitoring of non-standard data sources.
• Non-Syscall Event Sources - Integrates external plugins to capture events from non-syscall sources and maps them to security rules.
• Plugin Development Kits - Offers SDKs and APIs for developers to implement custom event sources and field extraction logic.
• Container Context Filtering - Correlates events with container IDs and image names to isolate threats in containerized environments.
• Event Filtering Rules - Evaluates system events against boolean expressions and macros to trigger security alerts.
• Event Ingestion - Captures and normalizes logs and events from cloud providers and third-party services for security monitoring.
• Rule-Based Detection Engines - Implements a detection system using custom rules, macros, and exception lists to trigger security alerts.
• Threat Detection Rule Repositories - Creates detection logic using event fields and macros to identify abnormal system behavior and security threats.
• Kernel-Mode Interception Mechanisms - Intercepts system calls and kernel events using eBPF probes or kernel modules to detect abnormal behavior.
• Process Ancestry Filtering - Evaluates the executable path and process ancestry of executing threads to identify malicious activity.
• Compliance & Audit Tools - Applies rule-based detection and system auditing to ensure infrastructure adheres to regulatory security standards.
• Container Security - Provides container security observability by enriching raw kernel events with Kubernetes metadata.
• Custom Detection Rules - Allows the adjustment of existing security lists, macros, and rules through appending values or replacing configurations.
• Intrusion Detection Systems - Provides host-based intrusion detection by monitoring system calls and kernel activity for malicious behavior.
• Security Monitor Extensions - Provides a dedicated API and SDK to extend the security monitor with new event sources and output destinations.
• Security Monitoring - Monitors system calls and kernel events in real-time using eBPF to detect abnormal behavior.
• Plugin-Based Logic Extensions - Extends monitoring scope by integrating external data sources and field extractors via a Go SDK.
• Alert Generation Engines - Evaluates telemetry data and system activity to trigger security notifications when suspicious patterns are matched.
• Alert Routing - Directs security notifications to multiple channels including standard output, files, syslog, and HTTP endpoints.
• JSON Alert Serialization - Serializes security alerts into structured JSON formats for delivery to SIEMs and webhooks.
• Audit Logs - Tracks requests and responses to the Kubernetes API server to detect suspicious cluster changes.
• Event Field Extractions - Provides mechanisms to extract specific values from system events for rule filtering and detailed security alerts.
• Event Monitoring Systems - Collects and analyzes kernel events and system calls from multiple sources to detect malicious activity.
• Kernel Event Tracers - Gathers system call data and kernel events using eBPF probes for real-time activity monitoring.
• Security Auditing - Captures and analyzes syscalls and kernel tracepoints using eBPF for deep security auditing.
• Event Payload Inspections - Implements interception of event streams to inspect payload content and maintain state before field extraction.
• Event Stream Integrations - Integrates new data streams into the monitoring pipeline to be evaluated by security rules and filtering expressions.
• Extended Event Data Sources - Broadens monitoring coverage by integrating additional data streams beyond system calls through a plugin architecture.
• Filesystem Filters - Inspects resolved or raw filesystem paths in syscalls to monitor file operations like moves or deletions.
• System Event Monitors - Uses system event monitors to track wide-ranging activity and broaden the scope of tracked system events.
• Event Contextualization - Addition of process, user, and container metadata to raw events to provide visibility into the origin of a system call.
• Container Label Enrichment - Augments raw kernel events with container and cluster context from the orchestration control plane.
• Kernel Metadata Enrichment - Addition of context to kernel events by integrating metadata from the container engine or cluster control plane.
• Security Event Logic - Implements boolean operators and comparison expressions to evaluate system call data for triggering security alerts.
• Multi-Source Ingestion - Uses a plugin architecture to ingest events from diverse system sources beyond standard system calls.
• Event Data Processing - Processes raw event content prior to field extraction to prepare data for the detection engine.
• Alert Context Enrichers - Augments security alerts with custom fields and prioritizes them before forwarding to destination systems.
• Reusable Rule Logic - Groups common conditions into named macros to simplify complex rule definitions across multiple rules.
• Rule Activation Controls - Provides mechanisms to enable or disable specific security rules via selective loading or tagging.
• Configuration Hot-Reloading - Automatically applies updates to configuration and rule files without requiring a service restart.
• Runtime Configuration Managers - Manages the loading of system settings from primary and override files to maintain behavior across versions.
• Plugin Distribution Tools - Publishes plugin artifacts and rule sets to container registries for discovery and installation.
• Metadata Augmentations - Augmentation of raw system events with additional context from containers or security modules for deeper visibility.
• Webhook Notifications - Delivers automated security event-driven updates to external services via webhooks and messaging platforms.
• OCI-Compliant Packaging - Bundles security plugins and rules into OCI-compliant artifacts for standardized versioning and distribution.
• Cloud Service Integrations - Integrates with external cloud providers via plugins to monitor activity across cloud services.
• Configuration Overrides - Provides capabilities to override default macro values in local configuration files to tailor security triggers.
• Configuration File Loading - Imports additional configuration settings from multiple files or directories to organize runtime behavior.
• Kubernetes Operators - Deploys and manages security instances, detection rules, and plugins using a declarative Kubernetes-native operator.
• Selector-Based Rule Filtering - Selects which detection rules to execute based on tags or names to tune alerts for specific environments.
• OCI-Compliant Plugin Packaging - Packages security plugins and rule sets as OCI-compliant artifacts for standardized versioning and deployment.
• Runtime Security Deployment - Installs security monitoring across hosts, containers, or clusters using packages, archives, and operators.
• Rule Set Refresh - Downloads and refreshes detection rule sets distributed as artifacts to keep security signatures current.
• Resource Handle Filtering - Analyzes file descriptor types and network socket details to detect unauthorized resource access.
• Kernel Event Stream Parsing - Analyzes and transforms raw content of captured data streams to make event information structured and readable.
• Security Software Exceptions - Defines exception lists within security rules to prevent known safe behaviors from triggering alerts.
• Exclusion Rules - Allows modification of existing rule exclusions by appending new allowed values to reduce false positives.
• Detection Sensitivity Tuning - Adjusts rules through exceptions and overrides to prevent false positives and adapt policies to specific environments.
• Rule Definition Shortcuts - Uses predefined shortcuts for common security scenarios to reduce complexity when writing custom detection rules.
• Rule Exception Definitions - Specifies permitted behaviors that should be ignored by detection rules to reduce false positive alerts.
• Group Membership Enforcement - Matches system events against specific user IDs and group memberships to track actor behavior.
• Named Value Lists - Organizes collections of items into named lists to apply a single rule or macro to multiple specific values.
• Rule Priority Logic - Controls the execution sequence of security rules to ensure specific detections are processed before general ones.
• Rule Logic Simplification - Simplifies rule definitions and ensures consistency by using named macros and lists for common conditions.
• Security Plugin SDKs - Building of custom event stream integrations using a Go SDK to capture and process security events from external sources.
• Security Information Management - Forwards structured security alerts to external SIEM platforms for centralized security information management and incident response.
• System Call Attribute Filtering - Allows defining security alerts based on specific system call arguments, timestamps, and return codes.
• Contextual Enrichment - Augmentation of detection events with additional data to provide security analysts with more context during triage.
• Automated Rule Distribution - Automatically loads security rules from registries or configuration maps and applies them to running instances.
• Extraction Plugins - Uses plugins to extract granular metadata from event sources to create specific fields for security rules.
• Plugin Registries - Integrates plugins from OCI registries to enable specialized monitoring for infrastructure logs.
• Runtime Parameter Tuning - Allows tuning of event capture and alerting behavior via command line arguments and configuration files.
• JSON Alert Formatting - Structures alert data into machine-readable JSON objects containing timestamps and event-specific fields.
• Event Drop Detections - Identification of missed kernel events and triggering of remedial actions to prevent metadata corruption or rule failure.
• Event Field Transformations - Modifies extracted event field values using functions like case conversion or decoding before performing security comparisons.
• Tracepoint Monitoring - Monitors specific kernel tracepoints, such as process exits and page faults, to identify abnormal behavior.
• Data Extraction - Parsing of structured data such as JSON from event payloads to isolate specific values for security analysis.
• Event Source Controls - Allows toggling specific event sources via command-line options to tailor monitoring for specific use cases.
• Kernel Metrics - Tracking of kernel-side syscall drops through metrics to identify performance bottlenecks and event loss.
• Metric and Performance Monitors - Tracking of event rates, resource usage, and rule detection frequency to verify health in real-time.
• SIEM Integration - Sends detected threats in JSON format to external SIEMs and data lakes for centralized analysis.
• Prometheus Exporters - Exposure of internal performance and detection data via a web endpoint for visualization in external dashboards.
• Security Event Monitoring - Displays detected threats and system alerts within a graphical user interface for easier monitoring.
• Cloud Trail Analyzers - Analyzes cloud trail logs to detect suspicious infrastructure changes and unauthorized logins.
• System Resource Monitors - Tracking of resource utilization and internal statistics to assess the impact on the host system.
• Event Field Definitions - Extracts specific information from captured events to create new searchable or filterable data fields.
• Container Security - Runtime protection for containerized environments.
• Defending - Listed in the “Defending” section of the Awesome K8s Security awesome list.
• Continuous Security Monitoring - Detects threats in containers, hosts, and cloud environments.
• Penetration Testing and Analysis - Provides runtime security monitoring for containers.
• Security and Compliance - Behavioral monitoring for containers.
• Security And Hardening - Runtime security monitor for container activity.

Star history