Falco

No entries match these filters. Clear filters

1. announced seen Sep 22, 2026 · issue 082

   Falco 0.45.0 adds raw byte matching in rules, reload control endpoints, and GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. detection rules⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Write a rule that detects a process argument containing a specific non-UTF-8 byte sequence, now possible with raw byte escapes.
   /etc/falco/rules.d/raw_byte.yaml copy

   - rule: Suspicious Raw Byte Argument
     desc: Detects a process argument containing a specific non-UTF-8 byte
     condition: proc.args contains \xc0\xae
     output: 'Suspicious raw byte in argument (proc=%proc.name args=%proc.args)'
     priority: WARNING

   • Adds GET /reload webserver endpoint reporting process identity, reload generations, and readiness so integrations can verify a completed reload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds reload_control configuration key that opens a Unix socket accepting POST /reload for local reload requests (disabled by default).
   • Adds \xHH byte escape syntax in rule conditions for matching filenames or process arguments containing arbitrary bytes not representable as valid UTF-8.
   • Adds engine_timeout option to the container plugin (defaults to 10 seconds) to prevent an unresponsive runtime socket from blocking Falco startup indefinitely; set to 0 to disable.
   • Adds two sandbox rules — Container Accessing GPU Device and GPU Management Tool Run in Container — for detecting GPU resource hijacking inside containers (both disabled by default; tune user_known_gpu_workloads before enabling).

   +6 more show less

   • Adds new eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. counters exposing drops caused by reentrancy and exhausted auxiliary buffers, and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. migrations, to help distinguish preemption-related capture pressure from other drop causes.
   • Supports FALCO_DRIVER_CHOICE=none to skip driver setup and FALCOCTL_DRIVER_VERSION to specify an explicit driver version during DEB/RPM package upgrade transactions.
   • Preserves raw bytes when extracting field values for rule matching, so rule conditions now see original bytes rather than sanitized replacements.
   • Both text and JSON output now escape control characters and replace invalid UTF-8 sequences for printable alert output.
   • Modern eBPF probe uses two auxiliary buffers per CPU to protect event construction on preemptible kernels, with graceful fallback and a warning on kernels lacking required BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. atomic operations.
   • Container plugin 0.7.4 keeps already-collected metadata and retrieves missing container info in the background when an initial listing is interrupted at startup.
   • Adds GET /reload webserver endpoint reporting process identity, reload generations, and readiness so integrations can verify a completed reload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds reload_control configuration key that opens a Unix socket accepting POST /reload for local reload requests (disabled by default).
   • Adds \xHH byte escape syntax in rule conditions for matching filenames or process arguments containing arbitrary bytes not representable as valid UTF-8.
   • Adds two sandbox rules — Container Accessing GPU Device and GPU Management Tool Run in Container — for detecting GPU resource hijacking inside containers (both disabled by default; tune user_known_gpu_workloads before enabling).
   • Adds new eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. counters exposing drops caused by reentrancy and exhausted auxiliary buffers, and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. migrations, to help distinguish preemption-related capture pressure from other drop causes.

   6 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Falco 0.45.0 refuses to load kernel modules or probes not compatible with driver API 11.0.0 — deploy updated drivers before upgrading.
   • !Modern eBPF now uses two auxiliary buffers per CPU, doubling auxiliary map memory per CPU — account for this before upgrading.
   • !Rule conditions that relied on UTF-8 sanitization before comparisons will behave differently; review and update custom rules accordingly.
   • !Output consumers that parsed Falco's formatted text or JSON output must account for the new control-character escaping and invalid-UTF-8 replacement.
   • !The container_engines.* configuration keys have been removed from the configuration schema — migrate to the container plugin configuration (e.g. engines.cri.sockets) instead.
   • !DEB/RPM upgrades now start the selected Falco service and install the driver — unattended upgrade scripts and custom driver pins must be reviewed to avoid unintended changes.
2. docs update Sep 21, 2026 · issue 081

   Falco 0.45 adds raw-byte string matching and string comparison modifiers (anyof, allof, oneof) for multi-value conditions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Detect processes invoking common exfiltration tools without writing a separate rule for each binary, using the anyof modifier to match multiple values in one condition.
   text copy

   proc.cmdline contains anyof (curl, wget, nc, scp)

   Catch filenames containing a raw null byte or other non-printable byte (e.g. evasion via NUL-injection) using the new \xHH hex escape in a byte-buffer condition.
   text copy

   evt.buffer contains "\x00"

   Exclude multiple known-good shell names in a single condition using allof with !=, rather than chaining separate inequality checks.
   env copy

   proc.name != allof (bash, sh)

   • Adds anyof, allof, and oneof string comparison modifiers (since Falco 0.44) so a single condition can test one field against multiple values or patterns, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ proc.cmdline contains anyof (curl, wget).
   • Adds support for referencing a Falco list inside modifier parentheses, e.g. fd.name contains anyof (suspicious_paths).
   • The regex operator remains an exception: it replaces invalid UTF-8 bytes with the Unicode replacement character U+FFFD (�) before matching, so fd.name regex "/tmp/bad�" and fd.name regex "/tmp/bad." both match /tmp/bad followed by byte 0xFF.
   • Adds anyof, allof, and oneof string comparison modifiers (since Falco 0.44) so a single condition can test one field against multiple values or patterns, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ proc.cmdline contains anyof (curl, wget).

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !When upgrading from Falco 0.44 or earlier, conditions that used non-regex operators to match the Unicode replacement character U+FFFD in place of invalid bytes will no longer behave the same — those conditions must be updated to match the original raw bytes instead.
3. docs update Sep 21, 2026 · issue 081

   Falco 0.45.0 adds reload status reporting to the /reload endpoint and a new reload_control Unix socket setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • The /reload webserver endpoint now reports the reload status after a reload request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds reload_control setting in falco.yaml to enable reload requests over a Unix socket.

   2 details in Everything

4. docs update Sep 21, 2026 · issue 081

   Falco: Adds FALCOCTL_DRIVER_VERSION environment variable to pin an explicit driver version during package upgrades, preventing the pin from following the new package default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Enable reload requests over a Unix socket so a privileged process can trigger Falco rule reloads without exposing the HTTP interface.
   /etc/falco/falco.yaml copy

   reload_control:
     enabled: true

   • DEB and RPM packages now automatically configure and start the selected Falco service after an upgrade, with FALCO_DRIVER_CHOICE=none available to skip driver configuration and startup.

   1 more in Everything

5. 0.45.0 Sep 21, 2026 · issue 081

   Falco 0.45.0 adds a GET /reload API endpoint, raw-byte rule matching with \xHH escape sequences, and a --dry-run suggestion on --validate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.45.0 https://github.com/falcosecurity/falco.git
   # already have the repo? check out this version:
   $ git checkout 0.45.0

   └──▷ TRY IT
   Check whether Falco has finished reloading after sending SIGHUP, without restarting the process.
   copy

   $ curl -s --unix-socket /run/falco/falco.sock http://localhost/reload

   • Exposes reload status via GET /reload and adds optional reload control over a protected Unix socket on Linux, preserving SIGHUP reception and pending requests across reloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Evaluates rule conditions on raw field bytes, enabling matching of invalid and non-printable UTF-8 sequences with string operators and single-byte matching with the new \xHH escape sequence; regex now operates on sanitized input and non-printable characters are escaped at output encoding time.
   • Adds serviceAccount.labels to the Helm chart to set custom labels on the ServiceAccount.
   • Suggests --dry-run when --validate receives a Falco configuration file.
   • Exposes reload status via GET /reload and adds optional reload control over a protected Unix socket on Linux, preserving SIGHUP reception and pending requests across reloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Rules that matched the UTF-8 replacement character using non-regex operators must be reviewed: rule conditions now operate on raw field bytes, and FALCO_ENGINE_VERSION is bumped from 0.62.0 to 0.63.0.
   • !Configurations still setting the removed container_engines key will now log a schema validation warning at startup (the key has been dropped from the configuration JSON schema).
6. 0.44.1 Jun 11, 2026 · release notes

   Falco 0.44.1 adds support for disabling BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. iterators for environments where they cause issues.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.44.1 https://github.com/falcosecurity/falco.git
   # already have the repo? check out this version:
   $ git checkout 0.44.1

7. 0.44.1 Jun 11, 2026 · issue 003

   Falco 0.44.1 adds support for disabling BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. iterators in userspace.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.44.1 https://github.com/falcosecurity/falco.git
   # already have the repo? check out this version:
   $ git checkout 0.44.1

8. 0.44.0 May 26, 2026 · release notes

   Falco 0.44.0 adds string comparator modifiers, capture stop conditions, list transformer exceptions, and drops gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication./gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM./legacy BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.44.0 https://github.com/falcosecurity/falco.git
   # already have the repo? check out this version:
   $ git checkout 0.44.0

   └──▷ USE IT
   Cap a capture file at 10,000 events to prevent runaway disk usage during incident capture.
   yaml copy

   capture_events: 10000
   capture_filesize: 100

   • Adds oneof, allof, and anyof string comparator modifiers to the rule engine for richer multi-value matching in conditions.
   • Adds capture_events and capture_filesize stop conditions to cap capture file size or event count via config.
   • Adds validation for unknown keys in rules, surfacing misconfigured or misspelled rule fields at load time.
   • Adds support for list transformer exceptions in rule exception handling.
   • Enables HTTP output, webserver, and metrics on macOS and Windows.

   +2 more show less

   • Adds backslash escaping support to the -o key-path parser, allowing literal dots and brackets in YAML key names (e.g., -o 'my\.dotted\.key=val').
   • Adds kernel iterator metrics support for deeper eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. performance observability.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !gRPC output and gRPC server support have been removed; any deployment relying on Falco's gRPC output channel will stop working.
   • !gVisor engine support has been dropped; rules and configs targeting the gVisor source will no longer function.
   • !The legacy BPF probe has been removed; setups using the legacy BPF driver must migrate to the modern eBPF probe.
9. Version0.44.0 May 26, 2026 · release notes

   Falco 0.44.0 adds string comparator modifiers, capture file stop conditions, and macOS/Win HTTP output support.

   └──▷ USE IT
   Define a rule that triggers only when multiple specific strings match using the new modifiers.
   yaml copy

   rules:
     - rule: MultiMatchRule
       condition: evt.type = open and proc.name oneof ("bash", "sh")

   • Adds oneof, allof, anyof modifiers to the string comparator in rules for complex logic
   • Adds capture_events and capture_filesize as stop conditions for capture file actions
   • Enables http_output, webserver, and metrics features on macOS and Windows
   • Adds support for list transformer exception in the userspace engine

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Drops gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. output and server support, removing related configuration keys and CLI flags
   • !Drops gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. engine support, preventing execution on containers using this runtime
   • !Drops legacy BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. probe support, requiring a new kernel driver or eBPM-based setup
10. 0.42.0 Oct 22, 2025 · release notes

    Falco 0.42.0 adds live .scap capture recording, static output fields, thread-table auto-purging, and mimalloc support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.42.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.42.0

    └──▷ USE IT
    Attach a static environment label to every alert — useful for distinguishing prod vs. staging alerts in a shared SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    yaml copy

    static_fields:
      environment: production
      cluster: k8s-us-east-1

    Enable automatic thread-table purging to reclaim memory in long-running deployments with high process churn.
    yaml copy

    falco_libs:
      thread_table_auto_purging_interval_s: 60
      thread_table_auto_purging_thread_timeout_s: 300

    • New ability to record live .scap capture files directly from a running Falco instance.
    • Adds static_fields configuration option to attach statically defined key-value fields to every Falco alert output.
    • Adds falco_libs.thread_table_auto_purging_interval_s and thread_table_auto_purging_thread_timeout_s config options to automatically purge stale thread-table entries.
    • Logs plugin name and version at plugin load time for easier auditability of loaded plugin inventory.
    • Engine now emits a warning when rules use the deprecated evt.dir field in conditions or output strings.

    +3 more show less

    • Adds mimalloc allocator support for improved memory performance.
    • Docker images now include the source SHA in image labels for supply-chain traceability.
    • Default ruleset upgraded to v5.0.0.

    8 details in Everything

11. Version0.42.0 Oct 22, 2025 · release notes

    Falco v0.42.0 adds static fields, scap capture, thread table purging, plugin version logging, and mimalloc support

    • Adds falco_libs.thread_table_auto_purging_interval_s and thread_table_auto_purging_thread_timeout_s configuration options to control automatic thread table cleanup
    • Adds ability to define static fields via the static_fields configuration section in falco.yaml
    • Adds the ability to record .scap files (capture feature) for post-capture analysis
    • Logs plugin version information at loading time for easier troubleshooting
    • Emit a warning when a rule contains the deprecated evt.dir field or uses it in conditions

    +2 more show less

    • Includes SHA hashes on Docker image labels for provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. verification
    • Adds mimalloc support via CMake configuration options

    7 details in Everything

12. 0.41.0 May 29, 2025 · release notes

    Falco 0.41.0 adds JSON output field control, container plugin architecture, and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 timestamps in Docker images.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.41.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.41.0

    └──▷ USE IT
    Include only specific fields in JSON alert output to reduce noise when forwarding to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    yaml copy

    json_include_output_fields:
      - proc.name
      - container.id
      - evt.type
      - fd.name

    • Adds json_include_output_fields config option to control which fields appear in JSON alert output.
    • Switches container metadata handling to the new container plugin architecture.
    • Enables ISO 8601 time format by default on official Docker images via an override config file.
    • Enables libs_logger by default at info level for improved internal diagnostics.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Only .yaml and .yml files are now loaded as rule files; any rule files with other extensions will be silently ignored on upgrade.
    • !CLI flags deprecated in 0.40.0 have been removed; any startup scripts or wrappers using those flags will break.
13. Version0.41.0 May 29, 2025 · release notes

    Falco v0.41.0 adds json_include_output_fields config option and switches build system to container plugin.

    • Adds json_include_output_fields option in .falco/config.yaml to control which output fields are included in JSON events
    • Switches build system to use the container plugin for image builds
    • Enables ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 time format by default in Docker images via override config
    • Deprecates print of container.info in userspace, requiring migration of rule outputs
    • Drops CLI flags deprecated in v0.40.0

    5 details in Everything

14. 0.40.0 Jan 28, 2025 · release notes

    Falco 0.40.0 migrates key CLI flags to falco.yaml config options, adds plugin output format hints, and reintroduces static builds.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.40.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.40.0

    └──▷ USE IT
    Capture all syscalls (equivalent to the old -A flag) using the new config key so operator intent is version-controlled in falco.yaml.
    yaml copy

    base_syscalls:
      all: true

    Set packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. snap length (equivalent to the old -S/--snaplen flag) persistently in falco.yaml.
    yaml copy

    falco_libs:
      snaplen: 512

    Encode alert output fields in base64 (equivalent to the old -b flag) via falco.yaml for structured log pipelines.
    yaml copy

    buffer_format_base64: true

    • Adds buffer_format_base64 option to falco.yaml, replacing the deprecated -b flag for base64-encoded output.
    • Adds base_syscalls.all option to falco.yaml, replacing the deprecated -A flag for enabling all syscalls.
    • Adds falco_libs.snaplen option to falco.yaml, replacing the deprecated -S/--snaplen flag for capture snap length.
    • Supports plugin-exposed suggested output formats, letting Falco automatically honor the output format a plugin recommends.
    • Adds ability to entirely disable plugin hostinfo support via configuration.

    +3 more show less

    • Reintroduces static builds of Falco, available as tgz-static-x86_64 packages.
    • Switches release artifacts to use the jemalloc allocator by default, improving memory performance under high event load.
    • Streamlines official Docker images with a simplified image layout.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated CLI options removed — any working setup passing the old deprecated flags will break on upgrade.
15. Version0.40.0 Jan 28, 2025 · release notes

    Falco v0.40.0 adds YAML config keys for buffer format, syscalls, and snaplen while deprecating CLI flags.

    └──▷ TRY IT
    Configure base64 encoded output for Falco events instead of the default format
    copy

    $ # In falco.yaml:
    buffer_format_base64: true
    # Then restart Falco service

    Capture all raw syscalls for deep forensic analysis without using command-line flags
    copy

    $ # In falco.yaml:
    base_syscalls.all: true
    # Then restart Falco service

    Limit the snaplen (capture length) for network events via configuration
    copy

    $ # In falco.yaml:
    falco_libs.snaplen: 4096
    # Then restart Falco service

    • buffer_format_base64 option allows base64 output formatting in falco.yaml, replacing the deprecated -b flag
    • base_syscalls.all option enables capturing all syscalls via config file, replacing the deprecated -A flag
    • falco_libs.snaplen option sets packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. length via config file, replacing the deprecated -S / --snaplen flags

    3 details in Everything

16. 0.39.0 Oct 1, 2024 · release notes

    Falco 0.39.0 adds host network stats, JSON schema validation for rules/configs, append_output config, and richer CLI override support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.39.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.39.0

    └──▷ USE IT
    Emit a clean message field in JSON alerts (no timestamp or priority prefix) for easier downstream log parsing.
    yaml copy

    # In falco.yaml
    json_include_message_property: true
    json_output: true

    Append extra output fields to every alert without modifying individual rules.
    yaml copy

    # In falco.yaml
    append_output:
      - match:
          source: syscall
        extra_output: "user=%user.name container=%container.id"

    • Adds host_netinfo networking information stats family for richer host-level network observability in metrics.
    • Adds host_ifinfo metric exposing per-interface information.
    • Introduces json_include_message_property config option to emit a clean message field in JSON output without date or priority.
    • Introduces append_output configuration to extend alert output formatting.
    • Adds JSON schema validation for both rule files and Falco config files, catching misconfigurations at startup.

    +4 more show less

    • Adds --config-schema CLI action to print the full Falco configuration JSON schema.
    • Enables setting nested config keys via CLI with -o key={object} syntax for object-type config values.
    • Adds container_engines configuration block in falco.yaml to explicitly control which container engines Falco monitors.
    • Allows all Falco systemd services to be referenced via the consistent alias falco.service.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tags label in falco_metrics is split into multiple tag_-prefixed labels; existing Prometheus queries or dashboards filtering on tags will break.
    • !Prometheus metrics falco_metrics now use full names for configs and rules files labels instead of short names; label matchers using short names will no longer match.
    • !Prometheus metrics n_evts_cpu and n_drops_cpu are rearranged to follow Prometheus best practices; existing queries using their previous naming/label structure will break.
    • !The deprecated CLI options -t, -T, and -D are removed; any scripts or systemd unit files using these flags will fail to start Falco.
17. Version0.39.0 Oct 1, 2024 · release notes

    Falco v0.39.0 adds host_netinfo/stats, JSON message formatting, append_output config, and schema validation.

    • Adds host_netinfo stats family for networking information
    • Adds json_include_message_property to output a message field without date and priority
    • Introduces append_output configuration option in falco.yaml
    • Adds --config-schema action to print the config schema
    • Enables CLI options via -o key={object} syntax

    +2 more show less

    • Adds container_engines configuration key in falco.yaml
    • Adds host_ifinfo Prometheus metric

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tags label is split into multiple tag_-prefixed labels in falco_metrics output
    • !Prometheus metrics use full names for configs and rules files instead of short names
    • !n_evts_cpu and n_drops_cpu Prometheus metrics are rearranged to follow best practices
    • !CLI options -t, -T, and -D are removed
18. 0.38.1 Jun 19, 2024 · release notes

    Falco 0.38.1 introduces per-plugin metrics collection and allows the -p output format option for all sources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.38.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.38.1

    └──▷ USE IT
    Collect metrics from loaded plugins (e.g., k8s_audit, aws_cloudtrail) by enabling the new metrics subsystem.
    shell copy

    falco --enable-metrics

    Apply a custom output format string to non-syscall rules (e.g., k8s_audit events) which previously rejected the flag.
    shell copy

    falco -r /etc/falco/k8s_rules.yaml -p '{{k8s.kubelet.name}} {{k8s.pod.name}}'

    • Enable plugin metrics collection via new(metrics) subsystem to expose counters/gauges from Falco plugins
    • Allow -p (output format) flag to be used with all rule sources, not just syscalls
    • Restrict -pk and -pc flags to syscall sources only

    3 details in Everything

19. 0.38.0 May 30, 2024 · release notes

    Falco 0.38.0 adds Prometheus metrics endpoint, rule filtering by name, split config support, and modern eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. as default driver

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.38.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.38.0

    └──▷ USE IT
    Expose Falco's internal metrics for monitoring with Prometheus.
    yaml copy

    # Add to falco.yaml:
    metrics:
      enabled: true
      prometheus_enabled: true

    Configure a custom thread table size for high-concurrency environments.
    yaml copy

    # Add to falco.yaml:
    falco_libs:
      thread_table_size: 1024

    • Adds metrics.prometheus_enabled configuration option to enable a new Prometheus metrics HTTP endpoint (requires metrics.enabled=true)
    • Adds rules_counters_enabled configuration option to expose rule hit counters in metrics output
    • Adds file sha256sum metrics for loaded config and rules files to verify integrity via Prometheus
    • Adds ability to select specific rules to load via configuration or command-line arguments
    • Adds support for split config files in userspace

    +2 more show less

    • Adds falco_libs.thread_table_size configuration option to tune thread table size
    • Raises warning instead of error when an invalid macro or list name is used in rules

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Modern eBPF is now the default driver and highest priority in automatic driver selection logic, potentially changing behavior if older drivers are needed
20. 0.37.1 Feb 13, 2024 · release notes

    Falco v0.37.1 adds insecure HTTP driver download support for falco and driver-loader images.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.37.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.37.1

    • Adds --download-insecure flag to falco and falco-driver-loader docker images to allow downloading kernel modules via insecure HTTP connections.

    1 detail in Everything

21. 0.37.0 Jan 30, 2024 · release notes

    Falco 0.37.0 adds rule engine overrides, HTTP output compression/keep-alive, env var expansion, and removes the --userspace flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.37.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.37.0

    • Adds compress_uploads and keep_alive fields to the http_output block in falco.yaml to control HTTP output behavior
    • Enables environment variable expansion inside YAML strings across all configuration files via FALCO_CONF or standard parser support
    • Adds a new engine-level mechanism for selective overrides of Falco rules
    • Prints system information on startup for easier diagnosis
    • Adds driver selection configuration in falco.yaml to choose the kernel module or no-driver mode

    +3 more show less

    • Adds listen_address field to the webserver block in falco.yaml to configure the HTTP API binding address
    • Adds engine_version_semver key to the /versions endpoint for version checking
    • Enables watch_config_files to monitor configuration file moves and deletions

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --userspace CLI flag is removed; users must use the eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. driver or kernel module.
    • !The outputs.rate and outputs.max_burst configuration keys are removed from falco.yaml; output limiting is now handled differently.
    • !The none value for the driver config key is renamed to nodriver in falco.yaml.
22. 0.36.0 Sep 26, 2023 · release notes

    Falco 0.36.0 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for HTTP output, env var substitution in YAML, driver-loader options, and systemctl reload support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.36.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.36.0

    └──▷ USE IT
    Use the new --list-events flag to inspect all supported event types including tracepoints and plugins.
    shell copy

    falco --list-events

    • Adds http_output.server_tls.cacert_file, http_output.server_tls.cert_file, and http_output.server_tls.key_file config keys to /etc/falco/falco.yaml to enable mTLS for the HTTP output backend
    • Adds support for parsing system environment variables (e.g. ${VAR}) within falco.yaml configuration files
    • Adds --source-only flag to falco-driver-loader to print loader source values as environment variables
    • Enables passing custom options directly to falco-driver-loader via the driver loader container's entrypoint or command arguments
    • Adds the falco-distroless Docker image (Wolfi-based) for a minimal Falco runtime without package managers

    +7 more show less

    • Adds systemctl reload falco.service support for reloading configuration without restarting the daemon
    • Allows multiple rules to match on a single event instead of stopping at the first match
    • Renames the CLI flag --list-syscall-events to --list-events and expands its output to include tracepoints, metaevents, and plugin events
    • Removes the -d daemonize CLI option; Falco no longer supports backgrounding itself via this flag
    • Replaces -s / --stats-interval CLI options with metrics configuration in /etc/falco/falco.yaml
    • Changes the default output of -p presets: -pc prints container metadata, -pk appends Kubernetes namespace and pod name
    • Changes %proc.exepath field behavior to return the on-disk executable path regardless of symbolic links

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default rules file is now stable; install falco-incubating-rules and falco-sandbox-rules separately for previously included rules
    • !The -d daemonize CLI option has been removed; use external process managers to background Falco
    • !The -s / --stats-interval CLI options have been removed; configure metrics in /etc/falco/falco.yaml instead
    • !HTTP output no longer echoes to stdout by default; set http_output.echo: true in /etc/falco/falco.yaml to restore previous behavior
    • !The --list-syscall-events flag is renamed to --list-events; update scripts or CLI calls that reference the old name
    • !The %proc.exepath field now resolves symlinks; rules relying on the symlink path itself may need updating
23. 0.35.0 Jun 7, 2023 · release notes

    Falco 0.35.0 adds config-driven metrics snapshots, HTTP output CA options, syscall filtering, and cosign signing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.35.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.35.0

    • Adds --metrics-snapshot option to take a programmatic snapshot of internal metrics via the new metrics subsystem.
    • Adds ssl_ca and tls_store configuration keys under http_output in the Falco config file to allow custom CA certificates and stores for HTTP output.
    • Adds syscall_drop_failed configuration option to silently drop failed syscall exit events from processing.
    • Adds base_syscalls user option to control which syscalls are tracked by the engine, along with base_syscalls.repair to repair base set inconsistencies.
    • Container images are now signed with cosign, enabling verification of image integrity.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --mesos-api, -pmesos, and -pm command-line flags have been removed; Mesos metadata enrichment is no longer supported.
24. 0.34.0 Feb 7, 2023 · release notes

    Falco 0.34.0 adds PTRACE code injection detection, --version-json output, webserver version endpoint, simulate_drops config, and falcoctl bundling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.34.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.34.0

    └──▷ TRY IT
    Get structured version info for automation or inventory.
    copy

    $ falco --version-json

    • --version-json flag to print version information in JSON format
    • New rule to detect attempts to inject code into a process using PTRACE
    • Webserver endpoint for retrieving internal version numbers
    • Config key simulate_drops added
    • falcoctl is shipped inside the Falco package

    +1 more show less

    • Support multiple drivers in systemd units

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !application_rules.yaml is not shipped anymore with Falco
25. 0.33.0 Oct 19, 2022 · release notes

    Falco 0.33.0 adds event source filtering, gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. default path changes, and selective event source configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.33.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.33.0

    └──▷ USE IT
    Configure fallback driver repositories in environment variables
    shell copy

    export DRIVERS_REPO=https://repo1.example.com/drivers,https://repo2.example.com/drivers
    falco-driver-loader --install

    • --drop-pct flag added to control the global rate of dropped events for high-volume environments
    • falco-driver-loader DRIVERS_REPO environment variable now accepts comma-separated URLs for driver fallbacks
    • gVisor socket default path changed to /run/falco/gvisor.sock (was /tmp/gvisor.sock)
    • gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. server socket default path changed to /run/falco/falco.sock (was /run/falco.sock.sock)
    • required_engine_version in falco.yaml checks now supports alternative plugin version requirements

    +2 more show less

    • notification rate limiter is now disabled by default
    • Falco automatically creates paths for gRPC unix socket and gvisor endpoint on startup

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The falco.yaml notification.rate_limiter.enabled field defaults to false in this version (previously true or enabled by configuration)
26. 0.32.1 Jul 11, 2022 · release notes

    Falco 0.32.1 adds gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. support and new --plugin-info CLI option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.32.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.32.1

    • --plugin-info CLI argument added to falco for printing plugin metadata.
    • gVisor runtime is now a supported target for syscall monitoring.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The macro source field in rule definitions has been removed and must be dropped from existing rules files.
27. 0.32.0 Jun 3, 2022 · release notes

    Falco 0.32.0 adds --markdown output, watch_config_files reload, new rules, and UBI base image

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.32.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.32.0

    └──▷ TRY IT
    Output detection events in Markdown for easier viewing in chat or wiki tools.
    copy

    $ falco --markdown

    List all supported syscall events for the current source configuration.
    copy

    $ falco --list-syscall-events

    • Adds --markdown flag to output detection events in Markdown format
    • Adds --list-syscall-events subcommand to list supported syscall events for the configured source
    • Adds watch_config_files config option to trigger an automatic Falco restart when rules or config files change
    • Adds new rule to detect excessively capable containers
    • Adds new rules to detect pods sharing host PID and IPCIPCInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory. namespaces

    +4 more show less

    • Adds new rule to detect container escape attempts via the release_agent file
    • Adds hostname field to JSON output for detection events
    • Adds out-of-the-box ruleset for the OKTA Falco Plugin
    • Adds a new Falco container image based on RedHat UBI

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !K8S audit logs are removed from Falco; K8S and Mesos clients are now enabled only when their corresponding syscall source is enabled
    • !Lua rule support is removed; existing Lua rules must be migrated to the new filter parser
28. advisory CVE-2022-26316 Mar 11, 2022 · issue 128
    • CVE-2022-26316: TOCTOU issue that could lead to rule bypass (affects <0.31.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
29. 0.31.1 Mar 9, 2022 · release notes

    Falco 0.31.1 adds a new drop category n_drops_scratch_map and supports multiple --cri options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.31.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.31.1

    • Add n_drops_scratch_map to the list of kernel drop counters monitored by Falco
    • Allow specifying multiple --cri flags on the command line to connect to several container runtimes simultaneously

    2 details in Everything

30. 0.31.0 Jan 31, 2022 · release notes

    Falco 0.31.0 adds a new plugin framework for extending event sources and custom fields, plus HTTP output User-Agent configuration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.31.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.31.0

    • falco --list option can now list fields related to plugin event sources
    • HTTP output now supports custom user-agent header via http_output.user_agent configuration key

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !--alternate-lua-dir cmdline option removed (lua scripts are now embedded)
31. 0.30.0 Oct 1, 2021 · release notes

    Falco 0.30.0 adds --k8s-node filtering and rule tags to gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication./json outputs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.30.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.30.0

    └──▷ TRY IT
    Run Falco but only fetch node-specific metadata for worker-01 to reduce API load.
    copy

    $ falco --k8s-node=worker-01

    • Adds --k8s-node CLI flag to filter pod metadata requests by node name
    • Exposes rule_tags and event_source fields in gRPC output for rule context
    • Exposes rule_tags and event_source fields in JSON output for rule context
    • Adds tags configuration option in output settings to control tag inclusion in json outputs

    4 details in Everything

32. 0.29.1 Jul 1, 2021 · release notes

    Falco 0.29.1 adds Unprivileged Delegation of Page Faults Handling to a Userspace Process detection rule and updates engine

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.29.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.29.1

    • Adds Unprivileged Delegation of Page Faults Handling to a Userspace Process rule to detect unprivileged userfaultfd syscalls
    • Adds consider_userfaultfd_activities macro to gate the new page fault delegation rule
    • Adds user_known_userfaultfd_processes list to exclude known processes from the new detection

    3 details in Everything

33. 0.29.0 Jun 22, 2021 · release notes

    Falco 0.29.0 updates driver version and adjusts default rule states for audit and detection coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.29.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.29.0

    • Updates the underlying driver to version 17f5df52a7d9ed6bb12d3b1768460def8439936d
    • Disables the Change thread namespace and Set Setuid or Setgid bit rule by default, changing its initial state from enabled to disabled without requiring manual config edits
    • Expands the known_sa_list rule in kube-system to automatically allow namespace-controller, statefulset-controller, disruption-controller, job-controller, horizontal-pod-autoscaler, and persistent-volume-binder as allowed service accounts

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Change thread namespace and Set Setuid or Setgid bit rule is now disabled by default, which may reduce detection coverage for that specific event pattern until re-enabled in configuration
34. 0.28.1 May 7, 2021 · release notes

    New --support output includes engine version and configurable consecutive timeout alerting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.28.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.28.1

    • --support output now includes info about the Falco engine version
    • Falco outputs an alert when receiving too many consecutive timeouts without an event, controlled by new config field syscall_event_timeouts.max_consecutive

    2 details in Everything

35. 0.28.0 Apr 12, 2021 · release notes

    Falco 0.28.0 adds exceptions to rules, a healthz endpoint, syscall drop tuning, ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. images, and new detection rules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.28.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.28.0

    • Adds support for exceptions as rule attributes to provide a compact way to add exceptions to Falco rules
    • Adds healthz endpoint to the webserver
    • Introduces a new configuration field syscall_event_drops.threshold to tune the drop noisiness
    • Makes falco-driver-loader container images available on AWS ECR gallery (https://gallery.ecr.aws/falcosecurity/falco-driver-loader)
    • Makes falco-no-driver container images available on AWS ECR gallery (https://gallery.ecr.aws/falcosecurity/falco-no-driver)

    +5 more show less

    • Adds DRIVER_NAME env variable support to the falco-driver-loader script
    • Adds new detection rules: Debugfs Launched in Privileged Container and Mount Launched in Privileged Container
    • Updates skip.authors behavior by deprecating SKIP_MODULE_LOAD env variable in favor of SKIP_DRIVER_LOADER
    • Deprecates Bintray, moving package distribution to https://download.falco.org
    • Changes init.d service unit to systemd service file for deb/rpm packages

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The SKIP_MODULE_LOAD env variable no longer disables the driver loading; use SKIP_DRIVER_LOADER instead.
    • !Packages are no longer published at https://dl.bintray.com/falcosecurity/; download from https://download.falco.org instead.
    • !The init.d service unit is removed from deb/rpm packages; systemd service file is used instead.
36. 0.27.0 Jan 18, 2021 · release notes

    Falco 0.27 adds async outputs, slow output detection with output_timeout, and gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. version/subscribe capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.27.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.27.0

    • Adds output_timeout config option for slow outputs detection
    • New gRPC version service includes the falco engine version
    • gRPC clients can now subscribe to drop alerts via gRPC API
    • Asynchronous outputs implementation so output channels no longer block event processing

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Falco now requires a configuration file to be passed; running without one will fail.
37. 0.26.1 Oct 1, 2020 · release notes

    Adds --alternate-lua-dir CLI flag to Falco for loading Lua plugins from custom directories.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.26.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.26.1

    └──▷ USE IT
    Load a custom or updated Lua driver plugin located in a non-standard directory without moving files to the system path.
    shell copy

    falco --alternate-lua-dir /opt/custom/falco/plugins

    • Adds --alternate-lua-dir flag to load Lua plugin files from arbitrary paths instead of the default location.

    1 detail in Everything

38. 0.26.0 Sep 30, 2020 · release notes

    Falco 0.26.0 adds statically-linked musl tgz builds and GCC-based kernel module detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.26.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.26.0

    • Adds a statically-linked musl binary in a .tgz archive published on bintray for easier drop-in deployment.
    • Updates scripts/falco-driver-loader to detect and attempt building the Falco kernel module driver with various GCC versions available in the environment.

    2 details in Everything

39. 0.25.0 Aug 25, 2020 · release notes

    Falco 0.25.0 adds renameat2 syscall support and detects ephemeral containers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.25.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.25.0

    • Add renameat2 syscall update to macro rename
    • Add new rule EphemeralContainers Created to detect ephemeral container created
    • Print the Falco and driver versions at the very beginning of the output

    3 details in Everything

40. 0.24.0 Jul 16, 2020 · release notes

    Falco 0.24.0 adds userspace instrumentation, bi-directional gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. streaming, and unix socket support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.24.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.24.0

    • Adds -u flag to enable userspace instrumentation
    • Supports bi-directional async streaming gRPC outputs via the falco.outputs.service/sub method
    • Enables connecting to the gRPC server over a unix socket
    • Implements auto threadiness for the gRPC server as the new default (0)
    • Changes config key webserver.k8s_audit_endpoint default from /k8s_audit to /k8s-audit

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The CLI flag --stats_interval is renamed to --stats-interval.
    • !The server streaming gRPC outputs method is changed from the previous name to falco.outputs.service/get.
    • !The environment variable SKIP_MODULE_LOAD is renamed to SKIP_DRIVER_LOADER.
41. 0.23.0 May 18, 2020 · release notes

    Falco 0.23.0 adds falco-no-driver image, API exact-match rules, and updated driver-loader env var

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.23.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.23.0

    • Add falcosecurity/falco-no-driver Docker image for running Falco without a host-side kernel module
    • Add ability to specify exact matches when adding rules via the API
    • Update falco-driver-loader to use DRIVERS_REPO environment variable for custom driver sources

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The falco-driver-loader script now references falco-probe.o and falco-probe.ko as falco.o and falco.ko
    • !The falco-driver-loader script environment variable to use a custom repository to download drivers now uses the DRIVERS_REPO environment variable instead of DRIVER_LOOKUP_URL
42. 0.22.0 Apr 17, 2020 · release notes

    New --disable-cri-async flag and decoupled versioning in Falco 0.22.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.22.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.22.0

    └──▷ USE IT
    Disable async CRI fetch when experiencing latency or connection issues with the container runtime.
    shell copy

    falco --disable-cri-async

    • Adds the --disable-cri-async CLI flag to disable asynchronous container metadata (CRI) fetch

    1 detail in Everything

43. 0.21.0 Mar 17, 2020 · release notes

    Falco 0.21.0 adds automated package/docker publishing and renames FALCO_BPF_PROBE

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.21.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.21.0

    └──▷ USE IT
    Set the BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. probe path in a Docker container or shell environment.
    shell copy

    export FALCO_BPF_PROBE=/path/to/bpf/probe.ko

    • FALCO_BPF_PROBE replaces SYSDIG_BPF_PROBE as the environment variable for specifying the BPF probe path.
    • Added falco_version_prerelease field containing the number of commits since the last tag on master.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The SYSDIG_BPF_PROBE environment variable is renamed to FALCO_BPF_PROBE; existing systemd scripts or Kubernetes deployments using the old name will break.
44. 0.20.0 Feb 24, 2020 · release notes

    Introduces gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. version API in Falco 0.20.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.20.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.20.0

    └──▷ TRY IT
    Retrieve the Falco server version programmatically via gRPC.
    copy

    $ grpcurl -plaintext localhost:8765 falcosecurity/falco/version.Version/GetVersion

    • Adds gRPC version API

    1 detail in Everything

45. 0.19.0 Jan 23, 2020 · release notes

    Adds JSON array support to the k8s_audit output endpoint and a hostname field to gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.19.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.19.0

    • k8s_audit endpoint now accepts POST requests with JSON arrays containing Kubernetes audit events
    • gRPC output includes a new hostname field in each event record

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The sysdig_host_root environment variable for Docker usage is replaced by host_root
    • !The Puppet module name changes from sysdig-falco to falco
46. 0.18.0 Oct 31, 2019 · release notes

    Falco 0.18.0 adds gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API, PSP conversion, and event source flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.18.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.18.0

    └──▷ TRY IT
    Disable the k8s audit event source to stop Falco from processing Kubernetes audit logs.
    copy

    $ falco --disable source=k8s_audit

    • Adds falco grpc api server with a subscribe method for streaming outputs to gRPC-capable languages
    • Adds support for converting k8s pod security policies (PSPs) into falco rules to evaluate PSP conditions
    • Adds flags to disable the syscall event source or k8s_audit event source

    3 details in Everything

47. 0.16.0 Jul 16, 2019 · release notes

    Falco 0.16.0 adds ka.useragent field and validates rules with -V

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.16.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.16.0

    └──▷ TRY IT
    Validate a rules file before deploying it to catch syntax errors early.
    copy

    $ falco -V /path/to/rules.yaml

    Build Falco against a specific local Sysdig source tree rather than the system library.
    copy

    $ cmake -DSYSDIG_DIR=/home/user/src/sysdig ..

    • Adds -V flag to print validation results (OK or error) for rule files on standard output
    • Bumps engine version to 4, introducing the new ka.useragent field in k8s audit event fields
    • Adds SYSDIG_DIR CMake option to specify sysdig source location during build

    3 details in Everything

48. 0.15.1 Jun 7, 2019 · release notes

    Falco v0.15.1 introduces performance improvements by dropping events at the kernel level and adds several new detection rules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.15.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.15.1

    • Drop unnecessary events at the kernel level to improve performance
    • Add instructions for k8s audit support in versions >= 1.13
    • Better tracking of rule counts per ruleset

    3 details in Everything

49. 0.15.0 May 13, 2019 · release notes

    Falco 0.15.0 adds actions on dropped events, containerd/CRI-O support, and HTTP output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.15.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.15.0

    └──▷ USE IT
    Customize rules to allow specific write operations by referencing the new macros in your rules file.
    config copy

    # In user_rules.yaml:
    # - rule: MyCustomWrite
    #   condition: user_known_write_root_conditions

    • Adds actions for handling dropped system call events, allowing alerts/logging or process exit.
    • Adds support for detecting containerd and CRI-O container runtimes.
    • Enables asynchronous docker metadata fetches to reduce dropped syscall events.
    • Adds HTTP output capability to send alerts directly to HTTP endpoints.
    • Allows timestamps to be written in ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.-8601 format, used by default in container runs.

    +1 more show less

    • Adds new macros user_known_write_root_conditions, user_known_non_sudo_setuid_conditions, and user_known_write_monitored_dir_conditions for customizing user rules.

    6 details in Everything

50. 0.14.0 Feb 7, 2019 · release notes

    Falco 0.14.0 adds engine versioning, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. for K8s audit endpoint, and --support CLI flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.14.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.14.0

    └──▷ USE IT
    Specify the minimum engine version required by a custom rules file.
    yaml copy

    required_engine_version: 3

    Run Falco in support mode to generate diagnostic JSON for issue reporting.
    copy

    $ falco --support

    • Adds required_engine_version field to rules files for compatibility checking
    • Enables SSL configuration for the K8s audit endpoint and embedded webserver
    • Adds --support CLI flag to print diagnostic information as JSON

    3 details in Everything

51. 0.13.1 Jan 17, 2019 · release notes

    Falco 0.13.1 adds k8s.ns.name to output with -pk and unbuffers stdout by default

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.13.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.13.1

    └──▷ USE IT
    Run Falco with Kubernetes audit rule context to include the namespace in alerts for better filtering.
    shell copy

    falco -pk

    • Adds k8s.ns.name field to output fields when the -pk CLI argument is used, enabling namespace-aware alert formatting.
    • Unbuffers standard output by default, improving log readability in containerized environments like Kubernetes.

    2 details in Everything

52. 0.13.0 Nov 9, 2018 · release notes

    Falco 0.13.0 adds K8s Audit Event support and transparent config reloading via SIGHUP

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.13.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.13.0

    • Adds K8s Audit Events as a second event stream alongside syscalls for Kubernetes environment monitoring
    • Enables Transparent Config/Rule Reloading by processing SIGHUP, allowing config and rules updates without restarting the Falco service

    2 details in Everything

53. 0.12.0 Sep 11, 2018 · release notes

    Falco 0.12.0 adds DNS name filterchecks, loginuid matching, and endswith operator

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.12.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.12.0

    └──▷ TRY IT
    Identify outbound connections to a specific domain using the new DNS name filtercheck.
    copy

    $ evt.type=connect and fd.sip.name=github.com

    Match processes by the original user ID regardless of sudo/su usage with the new loginuid filtercheck.
    copy

    $ user.loginuid==1000

    • Adds fd.*ip.name filterchecks to resolve connection IPs to DNS names for filtering by hostname.
    • Adds user.loginuid and user.loginname filterchecks to match users consistently across sudo/su.
    • Adds endswith operator for suffix matching on strings in Falco rules.

    3 details in Everything

54. 0.11.0 Jul 25, 2018 · release notes

    Falco 0.11.0 adds beta eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. event source and skip-if-unknown-filter rule property

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.11.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.11.0

    • Enables an optional eBPF program as the kernel event source instead of the falco-probe kernel module (Beta).
    • Adds the skip-if-unknown-filter boolean property to rule definitions, allowing rules to gracefully skip when referenced filterchecks are unavailable in the current Falco version.
    • Introduces a new rule named Write below monitored directory for monitoring file writes beneath specified paths.

    3 details in Everything

55. 0.10.0 Apr 24, 2018 · release notes

    Adds rules directory support (/etc/falco/rules.d, -r <dir>), json_include_output_property config key, and new rule-diagnostics flags (-i, -v).

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.10.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.10.0

    └──▷ TRY IT
    Validate and dump multiple rule files in one invocation without running the daemon.
    copy

    $ falco -V /etc/falco/falco_rules.yaml -V /etc/falco/custom_rules.yaml

    • Adds /etc/falco/rules.d as a read path for rules files (in addition to the existing falco_rules.yaml/falco_rules.local.yaml paths), and accepts a directory argument for -r or the rules_file key in falco.yaml
    • Adds -i CLI flag to print all ignored events/syscalls and exit
    • Adds -v flag to print dangling (unused) macros/lists when validating rules
    • Adds -V flag support for multiple validations (-V <file1> -V <file2>)
    • Adds json_include_output_property key to falco.yaml to control whether the formatted string output field appears in JSON output

    +1 more show less

    • Adds new rule Disallowed SSH Connection and Unexpected K8s NodePort Connection detections

    6 details in Everything

56. 0.8.0 Oct 10, 2017 · release notes

    Falco 0.8.0 adds append to lists/macros, -V validation flag, and new rule output formats

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.8.0

    └──▷ USE IT
    Validate syntax of modified rules before starting the service to prevent runtime failures.
    shell copy

    falco -V

    • Add -V flag to validate rules file and exit immediately
    • Support append: true in configuration to merge lists into existing ones
    • Support append: true in configuration to merge macros/rules into existing lists
    • Output JSON with individual templated fields as separate object keys
    • Keep file/program pipe handles open across rule notifications

    +3 more show less

    • Filter rules execution by minimum priority threshold
    • Configure output channels to be unbuffered
    • Add local rules file /etc/falco/falco_rules.local.yaml for custom modifications

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Configuration file moved from /etc/falco.yaml to /etc/falco/falco.yaml
    • !Default rules file moved from /etc/falco_rules.yaml to /etc/falco/falco_rules.yaml
57. 0.7.0 May 30, 2017 · release notes

    Falco 0.7.0 adds multi-level rule priorities and new container shell detection rule.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.7.0

    • Adds new rule Terminal shell in container that detects shells spawned in a container with an attached terminal

    1 detail in Everything

58. 0.6.1 May 15, 2017 · release notes

    Falco 0.6.1 adds throttle control via token bucket changes and a new rule to block apache2 shells in containers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.1 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.6.1

    • Adds configurable token bucket logic to throttle falco events
    • Adds rule 'Don't allow apache2 to spawn shells in containers'

    2 details in Everything

59. 0.6.0 Mar 29, 2017 · release notes

    Falco 0.6.0 adds rule tagging, a dedicated kernel module, and OSX build support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.6.0

    • Adds tags metadata to falco rules for granular grouping
    • Introduces Falco's own dedicated kernel module, removing the sysdig-probe dependency
    • Enables rule override in later files when using multiple -r flags
    • Supports building Falco on OSX (with trace-file reading only)

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Falco no longer depends on sysdig's sysdig-probe kernel module; users must install the new Falco kernel module
60. 0.5.0 Dec 22, 2016 · release notes

    Falco 0.5.0 adds configurable notification throttling via token bucket and event stats output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.5.0

    └──▷ USE IT
    Export event capture statistics to a file for later analysis using the new CLI flag
    shell copy

    falco -s /tmp/stats.txt

    • Add outputs.rate and outputs.max_burst config options in .falcorc to throttle Falco notifications using a token bucket algorithm
    • Add -s <statsfile> CLI flag to write event capture statistics to a specified file during runtime

    2 details in Everything

61. 0.4.0 Oct 25, 2016 · release notes

    Adds privileged/container mount filters, k8s metadata flags (-pk/-pm), glob/pmatch operators, and -w trace file output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.4.0

    • Adds container.privileged filter to match containers running in privileged mode
    • Adds container.image.id filter to match container image ID
    • Adds container.mount* filters to match container mount points
    • Adds -pc, -pk, -pm, -k, and -m CLI flags to pull Kubernetes/Mesos metadata for notifications
    • Adds k8s.deployment.* and k8s.rs.* filters to support latest Kubernetes features

    +3 more show less

    • Adds glob operator for strings in rule expressions to perform shell-style glob matching
    • Adds pmatch operator to test if a pathname is a prefix of any target pathnames
    • Adds -w flag to write event traces to a file for later reproduction

    8 details in Everything

62. 0.3.0 Aug 6, 2016 · release notes

    Falco 0.3.0 adds program output type, set membership operator, and event processing optimizations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.3.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout 0.3.0

    • Add a new output type program that executes a configurable command for every generated alert.
    • Support the in operator for single-statement set membership tests (e.g., x in (a, b)).
    • Enable running Falco on all events including those marked with EF_DROP_FALCO via new configuration.

    3 details in Everything

63. v0.2.0 Jun 9, 2016 · release notes

    v0.2.0 improves JSON output fields and ruleset coverage for session tracking

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    • Adds proc.sname field support for syscalls handling setsid and session id tracking (requires sysdig >= 0.10.0)
    • Improves JSON output to include the rule name, full output string, time, and severity

    2 details in Everything

64. v0.1.0 May 17, 2016 · release notes

    Falco v0.1.0 is the initial release of a cloud-native runtime security tool.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.0 https://github.com/falcosecurity/falco.git
    # already have the repo? check out this version:
    $ git checkout v0.1.0