Falco to Pluginfinity and Beyond
summary
Falco now ships a new plugin system (a year in the making) that loads dynamic shared libraries to add event sources, fields and rule hooks at runtime; a working Go SDK compiles plugins to C shared objects; early ecosystem includes several plugins in three months, notably an AWS CloudTrail plugin and Kubernetes-as-plugin support. Releases move to a three-per-year cadence (Jan/May/Sep), libs/drivers are migrated into Falco ownership and reused by projects like sysflow and StackRox, two CVEs are fixed, and BPF/ARM improvements are underway.
AI-written summary · about
chapters (14)
- 0:00Thank you to our session recording sponsor!
- 0:50In this talk
- 2:00How does Falco work?
- 3:07Falco's Journey
- 4:05New Release Cadence
- 5:06New Security Rules
- 6:01Libs and Drivers: Renovations 2
- 8:14Libs and Drivers: Security
- 9:07The New Plugin System
- 11:08Plugins: event sourcing capability
- 12:19Plugins: field extraction capability
- 14:02Plugin SDK Go: Keep it Simple
- 16:34Lots of plugins in the community
- 20:13Join the community
related talks
30mIn the Eye of Falco: Transforming Your View of Linux Kernel Security
26mFalcOMG That's AWESOME - New Things, Fixe...
28mSecurity In the Cloud With Falco: Overview And Project Updates
47mFalco Conquering Cloud Security
01h 33mCloud Native Runtime Security with Falco
39mDeep Dive: Falco
26mThe Falco Playground: A Cocktail of WebAssembly and Runtime Security
38mDeep Dive: Falco