Plugins
This repository is the central hub for the Falco Plugin ecosystem. It serves two main purposes:
- Be a registry: A comprehensive catalog of plugins recognized by The Falco Project, regardless of where their source code is hosted.
- Monorepo for Falcosecurity plugins: Official plugins hosted and maintained by The Falco Project, with robust release and distribution processes.
Plugin Registry
The registry contains metadata and information about every plugin known and recognized by the Falcosecurity organization. It lists plugins hosted either in this repository or in other repositories. These plugins are developed for Falco and made available to the community.
Check out the Registering a Plugin to know how to add your plugin to this registry.
Registered Plugins
The tables below list all the plugins currently registered. The tables are automatically generated from the registry.yaml file.
| Name | Capabilities | Description
| --- | --- | --- |
| plugin-id-zero-value | Event Sourcing
ID: 0
` | This ID is reserved for particular purposes and cannot be registered. A plugin author should not use this ID unless specified by the documentation. test
Authors: N/A
License: N/A |
| test | Event Sourcing
ID: 999 | This ID is reserved for source plugin development. Any plugin author can use this ID, but authors can expect events from other developers with this ID. After development is complete, the author should request an actual ID k8s_audit
Authors: N/A
License: N/A |
| k8saudit | Event Sourcing
ID: 1 k8s_audit
Field Extraction
| Read Kubernetes Audit Events and monitor Kubernetes Clusters aws_cloudtrail
Authors: The Falco Authors
License: Apache-2.0 |
| cloudtrail | Event Sourcing
ID: 2 aws_cloudtrail
Field Extraction
| Reads Cloudtrail JSON logs from files/S3 and injects as events dummy
Authors: The Falco Authors
License: Apache-2.0 |
| json | Field Extraction
All Sources | Extract values from any JSON payload
Authors: The Falco Authors
License: Apache-2.0 |
| dummy | Event Sourcing
ID: 3 dummy
Field Extraction
| Reference plugin used to document interface dummy_c
Authors: The Falco Authors
License: Apache-2.0 |
| dummy_c | Event Sourcing
ID: 4 dummy_c
Field Extraction
| Like dummy, but written in C++ docker
Authors: The Falco Authors
License: Apache-2.0 |
| docker | Event Sourcing
ID: 5 docker
Field Extraction
| Docker Events seccompagent
Authors: Thomas Labarussias
License: Apache-2.0 |
| seccompagent | Event Sourcing
ID: 6 seccompagent
Field Extraction
| Seccomp Agent Events okta
Authors: Alban Crequy
License: Apache-2.0 |
| okta | Event Sourcing
ID: 7 okta
Field Extraction
| Okta Log Events github
Authors: The Falco Authors
License: Apache-2.0 |
| github | Event Sourcing
ID: 8 github
Field Extraction
| Github Webhook Events k8s_audit
Authors: The Falco Authors
License: Apache-2.0 |
| k8saudit-eks | Event Sourcing
ID: 9 k8s_audit
Field Extraction
| Read Kubernetes Audit Events from AWS EKS Clusters nomad
Authors: The Falco Authors
License: Apache-2.0 |
| nomad | Event Sourcing
ID: 10 nomad
Field Extraction
| Read Hashicorp Nomad Events Stream dnscollector
Authors: Alberto Llamas
License: Apache-2.0 |
| dnscollector | Event Sourcing
ID: 11 dnscollector
Field Extraction
| DNS Collector Events gcp_auditlog
Authors: Daniel Moloney
License: Apache-2.0 |
| gcpaudit | Event Sourcing
ID: 12 gcp_auditlog
Field Extraction
| Read GCP Audit Logs syslogsrv
Authors: The Falco Authors
License: Apache-2.0 |
| syslogsrv | Event Sourcing
ID: 13 syslogsrv
Field Extraction
| Syslog Server Events salesforce
Authors: Maksim Nabokikh
License: Apache-2.0 |
| salesforce | Event Sourcing
ID: 14 salesforce
Field Extraction
| Falco plugin providing basic runtime threat detection and auditing logging for Salesforce box
Authors: Andy
License: Apache-2.0 |
| box | Event Sourcing
ID: 15 box
Field Extraction
| Falco plugin providing basic runtime threat detection and auditing logging for Box syscall
Authors: Andy
License: Apache-2.0 |
| k8smeta | Field Extraction
| Enriche Falco syscall flow with Kubernetes Metadata k8s_audit
Authors: The Falco Authors
License: Apache-2.0 |
| k8saudit-gke | Event Sourcing
ID: 16 k8s_audit
Field Extraction
| Read Kubernetes Audit Events from GKE Clusters journal
Authors: The Falco Authors
License: Apache-2.0 |
| journald | Event Sourcing
ID: 17 journal
Field Extraction
| Read Journald events into Falco kafka
Authors: Grzegorz Nosek
License: Apache-2.0 |
| kafka | Event Sourcing
ID: 18 | Read events from Kafka topics into Falco gitlab
Authors: Hunter Madison
License: Apache-2.0 |
| gitlab | Event Sourcing
ID: 19 gitlab
Field Extraction
| Falco plugin providing basic runtime threat detection and auditing logging for GitLab keycloak
Authors: Andy
License: Apache-2.0 |
| keycloak | Event Sourcing
ID: 20 keycloak
Field Extraction
| Falco plugin for sourcing and extracting Keycloak user/admin events k8s_audit
Authors: Mattia Forcellese
License: Apache-2.0 |
| k8saudit-aks | Event Sourcing
ID: 21 k8s_audit
Field Extraction
| Read Kubernetes Audit Events from Azure AKS Clusters k8s_audit
Authors: The Falco Authors
License: Apache-2.0 |
| k8saudit-ovh | Event Sourcing
ID: 22 k8s_audit
Field Extraction
| Read Kubernetes Audit Events from OVHcloud MKS Clusters dummy_rs
Authors: Aurélie Vache
License: Apache-2.0 |
| dummy_rs | Event Sourcing
ID: 23 dummy_rs
Field Extraction
| Like dummy, but written in Rust syscall
Authors: The Falco Authors
License: Apache-2.0 |
| container | Field Extraction
| Enriche Falco syscall flow with Container Metadata syscall
Authors: The Falco Authors
License: Apache-2.0 |
| krsi | Field Extraction
| Security (KRSI) events support for Falco collector
Authors: The Falco Authors
License: Apache-2.0 |
| collector | Event Sourcing
ID: 24 | Generic collector to ingest raw payloads into Falco awselb
Authors: The Falco Authors
License: Apache-2.0 |
| awselb | Event Sourcing
ID: 25 awselb
Field Extraction
| AWS Elastic Load Balancer access logs events edera_zone
Authors: Yuki Nakamura
License: Apache-2.0 |
| edera | Event Sourcing
ID: 26 edera_zone
Field Extraction
| A Falco plugin for forwarding libscap events out of Edera zones. nginx
Authors: Edera
License: Apache-2.0 |
| nginx | Event Sourcing
ID: 27 nginx
Field Extraction
| Real-time nginx access log monitoring for security threats. Detects SQL injection, XSS, path traversal, command injection, brute force attacks, and OWASP Top 10 vulnerabilities.
Authors: takaosgb3
License: Apache-2.0 |
Falcosecurity Plugins
Along with the registry, this repository hosts the official plugins maintained by the Falcosecurity organization. Each plugin is an independent project with its own directory in the plugins folder.
The main branch reflects the latest development state, and plugins are released on a regular basis. Development builds are published automatically when a Pull Request is merged into main, while stable builds are released only when a new tag is created. You can find all published artifacts at download.falco.org. For details on the release process, please see our Release Process.
The instructions below explain how to install and apply only to plugins from this repository.
Installing Plugins
Plugins hosted in this repository are built and distributed through Falco's official channels. You can easily install them using either falcoctl or the Falco Helm chart.
Using falcoctl
- Install falcoctl: If you haven't already, follow the falcoctl installation guide.
- Install a Plugin: Execute the following command, replacing
with the name of the plugin you wish to install:
falcoctl index update falcosecurity
falcoctl artifact install <plugin-name>.
- Configure Falco to load the plugin as described in the plugin's documentation.
Using the Falco Helm Chart
When installing Falco using the Helm chart, you can instruct the chart to install a specific plugin by setting the
falcoctl.config.artifact.install.refs value and then adding the relevant plugin configuration under falco.
The Helm charts provides a preset values-k8saudit.yaml file that can be used to install the
k8saudit plugin or as example for installing other plugins.
Contributing
If you want to help and wish to contribute, please review our contribution guidelines. Code contributions are always encouraged and welcome!
If you wish to contribute a plugin to The Falco Project, simply open a Pull Request to add your plugin to the
/plugins folder and update the registry accordingly. Note that to be hosted in this repository, plugins must be licensed under the Apache 2.0 License.
Enforcing coding style and repo policies locally
This repository supports enforcing coding style and policies locally through the
pre-commit framework. pre-commit
allows to automatically install git-hooks that will be executed at every new commit. The following is the list of
git-hooks defined in .pre-commit-config.yaml (notice that some of them only target files written in a specific
language):
- the
rust-fmt hook - a pre-commit git hook running rust fmt on the staged changes
the dco hook - a pre-commit-msg git hook running adding the DCO on the commit if not present
The following steps describe how to install these hooks.
##### Step 1
Install
pre-commit framework following the official documentation.
__Please note__: you have to follow only the "Installation" section.
Step 2
Install
pre-commit` git hooks:
pre-commit install --hook-type pre-commit --hook-type prepare-commit-msg --overwriteLicense
This project is licensed to you under the Apache 2.0 Open Source License.