►
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Falco to Pluginfinity and Beyond - Leonardo Grasso & Jason Dellaluce, Sysdig
This track will walk you through the astonishing things happening in Falco: a cloud-native runtime security project, the de facto Kubernetes threat detection engine. Two core maintainers, Jason and Leonardo, will give you a practical overview of Falco and its history but also updates on recently introduced features and the evolution of its ecosystem. This talk will deep dive into a new and very amazing feature introduced in Falco: the plugin system! Plugins are a game-changer, making Falco evolve to the next level: the all-in-one tool for cloud security and this maintainer track will show you how!
A
A
A
And
also
twitter,
all
the
links
are
in
the
deck.
We
are
both
here
on
behalf
of
the
falco
community,
to
give
you
some
updates
about
the
project.
So,
let's
start
with
the
agenda
in
this
talk,
we
will
give
you
a
brief
overview
about
what
is
and
then
we'll
continue
with
the
project
updates
from
the
last
year.
Until
now,
in
the
second
part
of
the
presentation,
we
will
deep
dive
into
the
new
amazing
feature
of
falco
the
plugin
system.
We
will
also
describe
the
plugin
sdk
and
the
plugin
registry.
B
Okay,
let's
get
to
work,
maybe
you're
familiar
with
falco,
or
maybe
it's
the
first
time
you
heard
about
it.
So
I'm
going
to
give
a
brief
review
for
everyone
to
to
be
impaired.
Falco
is
a
cloud
native
runtime
security
tool
that
monitors
everything
that
happens
in
your
system
and
send
security
alerts
whenever
something
suspicious
or
a
cyber
attack
is
detected.
Falco
is
pretty
easy
to
deploy
and
configure
and
catches
cyber
attacks
right
in
the
moment
they
happen
so
that
you
can
take
immediate
action.
B
Falco's
design,
consume
a
stream
of
events,
extract
information
from
them
and
then
send
you
alerts
whenever
something
bad
is
detected,
data
flows
only
in
one
direction
and
is
not
retained
or
stored
everywhere
everything
happens
in
real
time.
Following
the
activity
of
your
system,
the
core
data
source
falco
is
able
to
consume,
is
system
calls
system
calls
tell
you
a
lot
about.
B
What's
going
on
in
your
system
from
that,
you
have
visibility
over
all
the
processes
that
are
running
and
all
the
containers,
all
the
kind
of
stuff
events
are
collected
at
the
kernel
level,
with
either
a
a
kernel,
module
or
a
bpf
probe
and
in
time
falco
started
supporting
many
more
event
sources.
Thank
you
to
the
new
plugin
system,
but
we'll
get
back
to
it
later
and
then,
when
an
event
matches
a
given
security
rule
falco
sends
you
an
alert
in
many
different
outputs,
for
example,
simple
std
out
that's
trivial
or
http
web
book
or
jrpc.
B
So
it's
very
easy
to
make
focus
with
your
specific
use
case.
So
now
you
pretty
much
know
where
we
are,
but
let's
also
get
give
a
quick
look
about.
Falco's
history
in
2016
sysdix
started
developing
falco
as
an
open
source
project
trying
to
fill
some
of
the
gaps
in
the
cloud
security
industry
and
then
later
falco
was
donated
to
the
cncf
as
the
as
a
sandbox
level
project.
B
You
know
looking
forward
to
create
a
community
around
it
and
make
the
governance
truly
open,
and
two
years
ago
falco
was
promoted
to
in
the
cncf
into
a
an
incubate
11
project,
and
the
community
of
falco
lovers
started
to
grow
even
further
right
now,
the
present
day
at
least
the
two
of
us
are
pretty
proud
of
how
the
community
is
doing
so
far,
and
we
look
forward
to
see
more
so
pretty
much.
This
is
the
introduction,
so
let's
say
we
can
go
to
the
news
part.
A
Yeah
from
this
point
on,
we
will
cover
the
most
exciting
achievement
of
the
falco
project
during
the
last
year.
So
let's
go
with
the
project
updates
one
of
the
first
another
will
change,
was
the
new
release
currents
until
version
0.30,
a
new
falco
conversion
came
out
every
two
months
or
so
the
maintenance
of
the
community.
After
a
very
long
discussion,
I
participated
in
that
discussion.
I
remember
very
well
decided
to
decide
to
switch
to
just
to
release
per
year.
It's
like
kubernetes
that
also
is
given
to
release
per
year.
A
The
new
release
now
happen
at
the
precise
moments
of
the
year.
At
the
end
of
the
january
may
and
september.
Of
course,
we
will
continue
to
release
and
fix
some
minor
patches
whenever
needed.
The
new
release
cycle
reflects
the
current
maturity
level.
For
this
reason,
we
changed
the
release
currency.
Now
our
users
should
expect
more
stable
version
of
falco,
and
also
they
have
a
bit
more
time
at
all
more
time
between
the
two
relative
releases.
A
Important
feature
of
falco
is
that
falco
come
with
a
robust
set
of
rich
richly
extensible
default
roles.
The
community
continues
updates
the
default
rules
set
to
improve
the
detection
of
new
security
traits
in
about
one
year.
We
got
a
lot
of
new
rules,
especially
in
the
privileged
escalation
detection,
but
also
in
the
container
security
context.
A
A
A
A
A
C
A
Another
thing
that
we
really
believe
that
was
very
important
is
to
make
those
largest
drives
consumable
by
other
projects.
We
spend
a
lot
of
time
on
that
also
in
refining
the
phase.
To
be
honest,
there
is
a
lot
of
work
in
progress
still
today,
but
we
were
right.
Indeed,
we
are
very
happy
to
say
that
sysflow
project
from
ibm,
but
also
stack,
rocks
from
red
that
are
using
our
libraries
and
dryers.
A
C
A
Support
is
coming
so
other
improvements,
one
perhaps
one
of
the
most
other
features
we
imp
other
stuff
we
implemented
the
last
year.
Are
security
fix
in
particular
few
to
address
the
two
cvs
discovered
during
the
last
year?
If
you
are
curious
about
death
of
the
cvs
or
in
general
or
security
staff
that
we
continuous
address,
you
can
take
a
look
to
our
security
device.
A
B
At
this
point,
the
plugin
system
was
mentioned
a
couple
of
times
already,
but
we
only
scratched
the
surface.
So,
given
the
fact
that
this
is
one
of
the
most
game
changing
features
that
we
introduced
over
the
past
year,
we
thought
it
was
good
to
have
a
dedicated
section
just
for
it
in
this
presentation.
So
plugins
are
little
modules
that
can
extend
the
functionality
of
falco
basically,
and
they
can
be
loaded
around
time
in
the
form
of
dynamic
share
libraries,
which
also
means
that
you
can
develop
them
in
basically
any
language.
B
B
B
As
you
can
see
here,
we
use
totally
new
fields
in
the
rules
like
just,
for
example,
identity,
type,
to
detect
the
the
unsafe
login
and
then
those
same
new
fields
introduced
by
the
plugins
just
like
before.
With
security
with
system,
events
can
then
be
used
to
create
outputs
to
send,
along
with
the
alerts
on
the
file
output
framework.
B
Sounds
cool
you
may
wonder:
how
do
I
start
how
to
get
involved
with
this?
We
did
our
best
to
provide
sdk
packages
so
that
contributors
could
get
up
to
speed
without
thinking
too
much
about
all
the
technical
details.
We
got
something
in
the
workings
for
c
plus
plus,
for
example,
but
we
got
something
fully
functional
for
go.
We
have
a
go
sdk
with
which
you
can
write
plugins
for
falco
out
of
the
box.
It
works
we
personally
like
go
and
it
is
a
much
loved
language
in
the
cloud
native
community.
B
So
that's
why
the
goal
wasn't
one
of
the
first
languages
which
we
gave
priority
to
support
with
with
an
sdk.
Another
reason
is
that
writing
simple
and
yet
performant
code
between
cngo
is
not
an
easy
task,
so
we
thought
I
mean
reasonably.
We
thought
that
creating
something
built
out
of
the
box
for
the
community
was
a
good
thing.
B
B
This
is
a
pretty
simple
review.
What
you
can
expect
your
developer
experience
to
look
like
with
the
with
ego
sdk.
We
really
try
to
keep
things
as
simple
as
possible,
so
developing
a
plugin
is
just
a
matter
here
of
defining
a
new
type
and
make
it
like
implement
an
interface
with
few
methods.
The
sdk
takes
care
of
implementing
all
and
satisfying
all
the
plugin
api
requirements.
So
you
don't
have
to
think
about
it.
B
So,
once
you're
happy
with
your
work-
and
you
have
your
go
code,
you
can
just
compile
it
to
a
c-share
library
and
hook
it
into
falco.
Plugins
are
part
of
the
file
code
configuration
which
is
kind
of
like
in
the
yaml
file.
You
see
on
the
left,
so
basically
it's
pretty
easy
to
just
set
it
up
and
configure
it
like
you,
like
you
like.
B
Here,
instead,
you
can
see
some
go
interfaces
for
implementing
either
the
event
sourcing
or
the
field
extraction
capabilities
that
I
showed
before
the
sdk
defines
the
core
interfaces
in
totally
separate
packages
so
that
you
can
just
import
the
ones
you
need
and
the
component,
your
plugin.
With
with
the
feature
you
want
to
extend
in
the
system.
You
can
also
see
how
those
two
features
specifically
relate
in
the
falco
execution
flow.
A
A
A
We
also
needed
a
way
to
coordinate
plugins
out
outward
because,
for
example,
they
have
to
choose
the
name
of
the
under
the
source.
Okay,
so
the
all
name
of
the
source
must
not
conflict,
and
then
we
decided
at
this
point
to
create
a
record
of
plugin,
officially
acknowledged
by
the
community.
That's
basically
is
our
plugin
registry
that
also
hosts
some
plugins
and
which
also
helps
the
developer
to
share
promote
their
plugin,
and
it
was
a
success.
Indeed,
the
ecosystem
is
growing
fast
in
just
about
three
months.
A
B
A
Plug-In
that
works
with
the
second
pageant
and
another
plug-in
to
create
a
rule
on
the
event
on
on
the
octagon.
There
are
already
other
requests
opened
with
the
new
plugin
that
are
are
coming,
but
we
are
looking
forward
to
seeing
your
plugins.
We
are
waiting
for
you
if,
by
the
way,
if
you
need
any
help
with.
B
A
A
Okay,
so
far,
we
have
talked
about
black
infinity,
but
what's
beyond
that,
let's
find
out
some
developmental
progress
immediately
after
we
implemented
the
plugins
that
which,
which
also
needed
a
dedicated
rule
set
because
you
know
each
plugin
has
each
set
of
rules
that
are
dedicated
for
that
data
source.
We
recognize
that
that
we
needed.
A
We
need
to
distributing
distribu
to
distribute
the
package
artifact,
but
also
the
roots
files.
So
we
made
a
plan.
Basically,
we
are
going
to
develop
a
tool
for
downloading
and
installing
the
plugins
and
rules
in
a
photo
deployment
or
or
if
you
have
flag
fought
crystalline
on
the
host,
but
also
we
want
the
ability
to
automatically
get
updates,
especially
about
rules.
Imagine
that
you
have
our
rules
started
yesterday,
but
a
new
cv
come
out.
The
rules
get
update
and
you
can
receive
automatically
the
updates,
since
we
already.
A
C
A
A
B
A
The
and
we
will
add
the
native
multi-axis
support
so,
of
course,
for
time
constraint.
We
cannot
cover
all
the
detail
here,
but
you
can
find
out
all
detail
the
proposal.
The
link
are
in
the
slide
and
also,
I
believe,
the
author
of
the
proposal
is
in
this
room.
So
if
you
want
to
ask,
I
will
say
later
with
okay,
we
are
reaching
almost
the
end
of
this
talk,
but
before
we
leave,
we
would
like
to
say
that
you
can
find
us
in
our
awesome
community.
We
will
be.
We
will
be
very
happy
to
meet
you.
B
The
falco
channel
and
the
kubernetes
luck
is
where
all
the
conversation
in
the
community
happens.
So
please
feel
free
to
join
and
say
hi.
I
can
assure
you,
everyone
is
very
welcoming
and
nice
plus
we
meet
each
other
every
wednesday
for
the
community
call
and
that's
also
where
we
discuss
all
the
current
developments
and
requirements.
B
If
you
really
want
to
stay
tuned,
you
can
also
subscribe
to
the
mailing
list.
We
write
basically
whatever
happens
like
every
new
release
or
if,
when
the
community
calls
time
changes
which
happens
with
you
know
different
time
zones
and
stuff
so
before
jumping
to
the
q
a
session.
We
we
just
wanted
to
remind
you
that
you
can
download
this
presentation.
You
can
find
the
the
link,
onscreen.com
and
there's
actually
some
value
because
we
realized
we
couldn't
fill
all
these
lights
with
the
qr
codes
and
we
placed
links
all
around
the
place.
B
C
A
But
wasm
it's
something
interesting
to
look
at
that
kind
of.
Basically,
it's
just
a
shared
library.
There
are
a
set
of
sysan
board
that
the
debugging
has
to
export.
It's
just
that
at
the
moment
and
falco
dynamics
load
the
the
doctor
625,
but
it
would
be
very
interesting
to
look
at
the
good
idea.
Thank.