►
From YouTube: FalcOMG That's AWESOME - New Things, Fixe... L. Di Donato, L. Grasso, R. Puthiyetath, T. Labarussias
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
FalcOMG That's AWESOME - New Things, Fixed Things, and YOU Panel - Leo Di Donato, Leonardo Grasso & Radhika Puthiyetath, Sysdig & Thomas Labarussias, Qonto
On this panel, the Falco maintainers will discuss the great things happening in Falco a cloud-native runtime security project, the de facto Kubernetes threat detection engine. This panel of key Falco maintainers will cover: *Brief Overview of Falco and its history *Updates on Falco and its subprojects (Falco, Falco sidekick etc) *Driver Donation(libsinsp , libscap, the kernel module driver the eBPF driver source) and what this means for the community *Roadmap Capabilities. Whats Coming! *Interactive QA on what you would like to see in the project
A
Welcome
from
the
maintainers
of
falco
to
its
maintainers
track
during
this
talk,
we're
gonna
move
ends
like
real
italians.
Do
to
show
you
the
amazing
things
that
happened
to
falcon
in
this
community
in
2020.
Last
but
not
least,
we
are
gonna
dive
into
the
contribution
of
the
libraries
that
give
its
magic
to
this
ncf.
A
Yes,
we
finally
did
it
contributing
lipscope
live
since
the
current
module
and
the
vpf
probe
to
the
open
was
one
of
my
innermost
desires.
Since
the
first
day
I
started
working
on
falcon
anyways,
I'm
leonardo
di
donato.
As
you
probably
already
know,
one
of
the
maintainers
of
falco
feel
free
to
just
call
me
leo,
but
let
me
give
the
floor
to
another
leo,
hey.
B
B
A
B
A
We
use
the
guitar
milestones
for
disabled
versions.
We
enforce
the
current
and
precise
same
virtue,
versioning
scheme.
We
finally
split
the
falco
driver's
version
from
the
farc
version.
We
ship
dab,
rpm
tables
packages
and
container
images
on
the
docker
app
and
on
the
amazon
ecr
gallery,
but
don't
be
scared.
The
process
is
fully
automated.
We
set
up
release
teams
for
stable
releases
only
to
ensure
that
all
the
preconditions
are
met
and
nothing's
gonna
break.
B
A
A
A
It's
a
kubernetes
cluster,
kindly
provided
by
amazon
on
the
cncf
aws
account
on
which
we
run
a
fully
featured
pro
instance.
It's
fully
reproducible
and
all
of
its
source
code
is
in
testing
for
repository.
We
use
the
pro
plugins
to
run
our
point
about
with
it.
We
also
created
pro
jobs
to
implement,
build
and
test
pipelines
for
various
projects,
for
example.
This
is
how
we
ship
more
than
3
000,
to
build
falco
drivers
to
our
users,
oh
yeah,
but
we
also
use
it
to
create
automations.
B
Yes,
I
saw
it,
it
inspired
me
to
create
a
pro
job
for
automatically
generating
manifest
files
to
deploy
falcon
kubernetes.
Although
we
had
provided
some
example.
Those
examples
were
usually
not
really
up
to
date,
but
I
knew
our
our
falcon
chart
was
working
fine
and
could
generate
those
manifest.
So
I
said
why
not
automatically
generate
them
when
the
m
chart
gets
updated
and
they
did
it
by
implementing
a
project
thanks
to
our
infra,
we
don't
have
to
update
them
manually
anymore,
awesome
leo.
A
B
A
We
built
driverkit
to
let
our
users
manually
preview,
the
falco
drivers.
Then
we
created
that
driver's
build
grid
which
sources
linked
to
choose
slides
before
using
driver
kit
on
top
of
our
falco
infra.
This
means
that
falco,
probably
drivers,
are
possible
thanks
to
pro
and
kubernetes
on
aws,
take
a
look
at
download.falco.org
in
the
driver's
directory
to
find
all
of
them.
There
are
so
many
by
the.
B
B
A
Contribution
is
fundamental
part
of
a
broader
process
of
completely
open
sourcing,
one
of
the
more
complex
and
widely
adapted
ebpf
programs,
focusing
on
runtime
security,
together
with
two
fantastic
libraries
for
enriching
kernel
events.
The
word
process
is
outlined
in
a
proposal
that
lorenzo
and
I
presented
and
discussed
with
the
falco
community
during
the
past
year.
You
can
read
it
in
the
proposal
folder
of
the
falco
repository
following
the
links
in
the
slide
too.
B
These
components
are
at
the
base
of
farco,
which
mainly
operates
on
top
of
a
data
source
system.
Calls
the
drivers
either.
Can
a
modulo
or
ibpf
probe
collect
the
system
codes?
Then
the
collected
data
needs
to
be
enriched
before
being
consumed
by
farco.
In
the
richmond
phase,
the
q
libraries
libsyn's
ellipse
cup
take
place.
This.
A
Contribution
completes
the
effort
of
making
sure
that
community
wally
owns
falco
and
all
its
underlying
components.
It
took
a
bit
of
time
because
it
involved
separating
the
pieces
that
were
initially
part
of
sizzig
and
making
them
independent,
but
from
now
on
also
other
projects
can
benefit
from
them.
We
are
thrilled
to
see
what
fox
will
build
up
on
these
libraries
and.
B
A
C
Welcome
to
the
second
part
of
falco
orange
in
this
one,
I
will
show
you
how
to
connect
falco
to
your
own
ecosystem
and
how
to
go
further
with
it.
In
a
with
an
example
of
a
response
engine,
I'm
thomasias,
I'm
a
currently
sore
at
condo
and
european
yearbook,
and
I
am
a
fico
contributor
for
two
years
now,
not
for
the
current
g,
because
I'm
not
a
supreme
developer,
but
with
the
websites,
the
communication,
I'm
writing
some
blog
posts
and
I'm
trying
to
help
people
and
dislike
about
their
issues
with
falco.
C
I
am
also
the
creator
of
fico
psychic
the
tool
for
wiping
you
to
in
your
usage
with
falco
fico,
currently
uses
file,
different
outputs
jrpc.
We
provide
client
library
go
and
python
file
std
out,
which
is
commonly
used
by
five
bit
3d
or
other
log
collectors
in
kubernetes
shell,
for
sending
full
pipe.
C
C
Then
falco
psychic
push
pushes
this
this
event
in
a
fan
out
mode
to
all
outputs
you
have
set.
You
can
even
filter
the
destination
by
priority.
For
example,
you
want
to
record
all
events
in
an
elastic
search,
slash,
but
only
notify
your
own
call
of
duty
team
for
priorities
of
both
critical,
it's
possible
another.
Another
useful
feature
of
fico
psychic
is
the
possibility
to
add
custom
fields
to
events
like
the
region
or
data
center,
with
a
large
number
of
available
outputs
and
more
and
more
are
added
by
the
community
each
month.
C
Thanks
to
everybody,
you
can
really
connect
falco
to
your
current
ecosystem
and
easily
take
advantages
from
it.
For
now
we
have
around
30
different
outputs
chat
services,
slack
materials,
workshop
discord,
teams,
sorry
and
we
have
log
systems.
Lucky
elasticsearch
got
watch
logs,
pure
streaming
systems
like
nuts
other
azure
herb
kafka,
amazon,
sqs,
fast
cubeless,
openfast,
amazon,
lambda
can
achieve
matrix
with
materials.
I
already
told
you,
but
we
you
can
also
have
matrix,
can
send
to
infix
db
or
data
logs
and
for
alerting
syst
for
alerting.
C
C
C
C
Falco
has
detected
a
shell
as
been
spawned
in
your
clothing
board
and
send
the
event
to
fico
psychic
so
far
goes
like
it
after
sends
the
the
event
to
two
different
outputs
web
ui
and
tubeless
and
cubeless
behind
is
its
function
called
delete
board
and
the
pod
has
been
effectively
deleted
in
less
than
one.
Second,
we
can
check
in
the
ui,
so
here
we
go.
We
have
a
message
of
an
event
by
the
for
the
world
terminal
shell
in
computer.
C
C
D
Falco
encourages
and
stands
for
internationalization
effort
with
three
near
completion
and
one
underway
falco
is
leading
the
way,
and
today
we
would
like
to
share
with
you
how
we
do
internationalization
the
falco
way,
if
you
are,
if
you're
a
translation
enthusiast
and
would
like
to
contribute
to
a
cutting
edge,
runtime
security
project.
This
is
for
you
first
thing.
First,
before
you
initiate
your
translation
project,
do
read
our
contributor
guidelines.
D
D
D
D
D
D
D
D
I
think
I
have
covered
what
are
the
major
things
you
should
focus
on
when
you
start
translating
yeah.
One
point
to
note
down
is
that
when
you
start
translating
make
sure
that
all
the
directories
have
must
have
an
index
dot
empty
file,
which
is
the
landing
page
for
that
particular
topic.
For
example,
the
docs
directory
itself
has
a
index
empty,
and
when
you
go
inside
deep
into
subdirectories,
each
one
will
have
an
indexed
md,
which
would
correspond
to
the
landing
page
for
your
for
that
particular
topic.
D
The
type
of
pr
is
uncommented
and
explain
to
the
reviewers
what
you
are
trying
to
achieve,
for
example,
what
this
pr
show
and,
for
example,
here
sridhaspr,
which
says
it's
for
alert
documentation
and
it's
translate
alerts
and
third-party
sections
within
the
getting
started
directory
and
if
you're
thinking
what
you
have
to
start
with
start
with
the
getting
started
section.
That
is
the
first
document.