https://cybertoolchain.io/tools/falco New releases and features in Falco, tracked by The Cyber Toolchain. en Mon, 21 Sep 2026 12:23:40 GMT https://github.com/falcosecurity/falco/releases/tag/0.45.0 https://github.com/falcosecurity/falco/releases/tag/0.45.0 Mon, 21 Sep 2026 12:23:40 GMT Falco 0.45.0 adds a `GET /reload` API endpoint, raw-byte rule matching with `\xHH` escape sequences, and a `--dry-run` suggestion on `--validate`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes reload status via `GET /reload` and adds optional reload control over a protected Unix socket on Linux, preserving SIGHUP reception and pending requests across reloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Evaluates rule conditions on raw field bytes, enabling matching of invalid and non-printable UTF-8 sequences with string operators and single-byte matching with the new `\xHH` escape sequence; `regex` now operates on sanitized input and non-printable characters are escaped at output encoding time. • Adds `serviceAccount.labels` to the Helm chart to set custom labels on the ServiceAccount. • Suggests `--dry-run` when `--validate` receives a Falco configuration file. Breaking changes: • Rules that matched the UTF-8 replacement character using non-regex operators must be reviewed: rule conditions now operate on raw field bytes, and `FALCO_ENGINE_VERSION` is bumped from `0.62.0` to `0.63.0`. • Configurations still setting the removed `container_engines` key will now log a schema validation warning at startup (the key has been dropped from the configuration JSON schema). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.44.1 https://github.com/falcosecurity/falco/releases/tag/0.44.1 Thu, 11 Jun 2026 07:53:06 GMT Falco 0.44.1 adds support for disabling BPF iterators for environments where they cause issues. • Adds configuration support for disabling BPF iterators, giving operators a workaround for environments where BPF iterator usage is problematic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.44.1 https://github.com/falcosecurity/falco/releases/tag/0.44.1 Thu, 11 Jun 2026 07:53:06 GMT Falco 0.44.1 adds support for disabling BPF iterators in userspace. • Adds configuration support for disabling BPF iterators, giving operators control over BPF iterator usage in environments where they cause issues. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.44.0 https://github.com/falcosecurity/falco/releases/tag/0.44.0 Tue, 26 May 2026 14:29:36 GMT Falco 0.44.0 adds string comparator modifiers, capture stop conditions, list transformer exceptions, and drops gRPC/gVisor/legacy BPF support. • Adds `oneof`, `allof`, and `anyof` string comparator modifiers to the rule engine for richer multi-value matching in conditions. • Adds `capture_events` and `capture_filesize` stop conditions to cap capture file size or event count via config. • Adds validation for unknown keys in rules, surfacing misconfigured or misspelled rule fields at load time. • Adds support for list transformer exceptions in rule exception handling. • Enables HTTP output, webserver, and metrics on macOS and Windows. • Adds backslash escaping support to the `-o` key-path parser, allowing literal dots and brackets in YAML key names (e.g., `-o 'my\.dotted\.key=val'`). • Adds kernel iterator metrics support for deeper eBPF performance observability. Breaking changes: • gRPC output and gRPC server support have been removed; any deployment relying on Falco's gRPC output channel will stop working. • gVisor engine support has been dropped; rules and configs targeting the gVisor source will no longer function. • The legacy BPF probe has been removed; setups using the legacy BPF driver must migrate to the modern eBPF probe. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://falco.org/docs/reference/changelog/ https://falco.org/docs/reference/changelog/ Tue, 26 May 2026 00:00:00 GMT Falco 0.44.0 adds string comparator modifiers, capture file stop conditions, and macOS/Win HTTP output support. • Adds `oneof`, `allof`, `anyof` modifiers to the string comparator in rules for complex logic • Adds `capture_events` and `capture_filesize` as stop conditions for capture file actions • Enables `http_output`, `webserver`, and `metrics` features on macOS and Windows • Adds support for list transformer exception in the userspace engine Breaking changes: • Drops gRPC output and server support, removing related configuration keys and CLI flags • Drops gVisor engine support, preventing execution on containers using this runtime • Drops legacy BPF probe support, requiring a new kernel driver or eBPM-based setup Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.42.0 https://github.com/falcosecurity/falco/releases/tag/0.42.0 Wed, 22 Oct 2025 10:42:42 GMT Falco 0.42.0 adds live .scap capture recording, static output fields, thread-table auto-purging, and mimalloc support. • New ability to record live `.scap` capture files directly from a running Falco instance. • Adds `static_fields` configuration option to attach statically defined key-value fields to every Falco alert output. • Adds `falco_libs.thread_table_auto_purging_interval_s` and `thread_table_auto_purging_thread_timeout_s` config options to automatically purge stale thread-table entries. • Logs plugin name and version at plugin load time for easier auditability of loaded plugin inventory. • Engine now emits a warning when rules use the deprecated `evt.dir` field in conditions or output strings. • Adds mimalloc allocator support for improved memory performance. • Docker images now include the source SHA in image labels for supply-chain traceability. • Default ruleset upgraded to v5.0.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://falco.org/docs/reference/changelog/ https://falco.org/docs/reference/changelog/ Wed, 22 Oct 2025 00:00:00 GMT Falco v0.42.0 adds static fields, scap capture, thread table purging, plugin version logging, and mimalloc support • Adds `falco_libs.thread_table_auto_purging_interval_s` and `thread_table_auto_purging_thread_timeout_s` configuration options to control automatic thread table cleanup • Adds ability to define static fields via the `static_fields` configuration section in `falco.yaml` • Adds the ability to record `.scap` files (capture feature) for post-capture analysis • Logs plugin version information at loading time for easier troubleshooting • Emit a warning when a rule contains the deprecated `evt.dir` field or uses it in conditions • Includes SHA hashes on Docker image labels for provenance verification • Adds mimalloc support via CMake configuration options Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.41.0 https://github.com/falcosecurity/falco/releases/tag/0.41.0 Thu, 29 May 2025 07:32:47 GMT Falco 0.41.0 adds JSON output field control, container plugin architecture, and ISO 8601 timestamps in Docker images. • Adds `json_include_output_fields` config option to control which fields appear in JSON alert output. • Switches container metadata handling to the new container plugin architecture. • Enables ISO 8601 time format by default on official Docker images via an override config file. • Enables `libs_logger` by default at info level for improved internal diagnostics. Breaking changes: • Only `.yaml` and `.yml` files are now loaded as rule files; any rule files with other extensions will be silently ignored on upgrade. • CLI flags deprecated in 0.40.0 have been removed; any startup scripts or wrappers using those flags will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://falco.org/docs/reference/changelog/ https://falco.org/docs/reference/changelog/ Thu, 29 May 2025 00:00:00 GMT Falco v0.41.0 adds `json_include_output_fields` config option and switches build system to container plugin. • Adds `json_include_output_fields` option in `.falco/config.yaml` to control which output fields are included in JSON events • Switches build system to use the container plugin for image builds • Enables ISO 8601 time format by default in Docker images via override config • Deprecates print of `container.info` in userspace, requiring migration of rule outputs • Drops CLI flags deprecated in v0.40.0 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.40.0 https://github.com/falcosecurity/falco/releases/tag/0.40.0 Tue, 28 Jan 2025 09:02:46 GMT Falco 0.40.0 migrates key CLI flags to falco.yaml config options, adds plugin output format hints, and reintroduces static builds. • Adds `buffer_format_base64` option to `falco.yaml`, replacing the deprecated `-b` flag for base64-encoded output. • Adds `base_syscalls.all` option to `falco.yaml`, replacing the deprecated `-A` flag for enabling all syscalls. • Adds `falco_libs.snaplen` option to `falco.yaml`, replacing the deprecated `-S`/`--snaplen` flag for capture snap length. • Supports plugin-exposed suggested output formats, letting Falco automatically honor the output format a plugin recommends. • Adds ability to entirely disable plugin hostinfo support via configuration. • Reintroduces static builds of Falco, available as `tgz-static-x86_64` packages. • Switches release artifacts to use the jemalloc allocator by default, improving memory performance under high event load. • Streamlines official Docker images with a simplified image layout. Breaking changes: • Deprecated CLI options removed — any working setup passing the old deprecated flags will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://falco.org/docs/reference/changelog/ https://falco.org/docs/reference/changelog/ Tue, 28 Jan 2025 00:00:00 GMT Falco v0.40.0 adds YAML config keys for buffer format, syscalls, and snaplen while deprecating CLI flags. • `buffer_format_base64` option allows base64 output formatting in `falco.yaml`, replacing the deprecated `-b` flag • `base_syscalls.all` option enables capturing all syscalls via config file, replacing the deprecated `-A` flag • `falco_libs.snaplen` option sets packet capture length via config file, replacing the deprecated `-S / --snaplen` flags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.39.0 https://github.com/falcosecurity/falco/releases/tag/0.39.0 Tue, 01 Oct 2024 08:06:05 GMT Falco 0.39.0 adds host network stats, JSON schema validation for rules/configs, append_output config, and richer CLI override support. • Adds `host_netinfo` networking information stats family for richer host-level network observability in metrics. • Adds `host_ifinfo` metric exposing per-interface information. • Introduces `json_include_message_property` config option to emit a clean `message` field in JSON output without date or priority. • Introduces `append_output` configuration to extend alert output formatting. • Adds JSON schema validation for both rule files and Falco config files, catching misconfigurations at startup. • Adds `--config-schema` CLI action to print the full Falco configuration JSON schema. • Enables setting nested config keys via CLI with `-o key={object}` syntax for object-type config values. • Adds `container_engines` configuration block in `falco.yaml` to explicitly control which container engines Falco monitors. • Allows all Falco systemd services to be referenced via the consistent alias `falco.service`. Breaking changes: • The `tags` label in `falco_metrics` is split into multiple `tag_`-prefixed labels; existing Prometheus queries or dashboards filtering on `tags` will break. • Prometheus metrics `falco_metrics` now use full names for configs and rules files labels instead of short names; label matchers using short names will no longer match. • Prometheus metrics `n_evts_cpu` and `n_drops_cpu` are rearranged to follow Prometheus best practices; existing queries using their previous naming/label structure will break. • The deprecated CLI options `-t`, `-T`, and `-D` are removed; any scripts or systemd unit files using these flags will fail to start Falco. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://falco.org/docs/reference/changelog/ https://falco.org/docs/reference/changelog/ Tue, 01 Oct 2024 00:00:00 GMT Falco v0.39.0 adds host_netinfo/stats, JSON message formatting, append_output config, and schema validation. • Adds `host_netinfo` stats family for networking information • Adds `json_include_message_property` to output a message field without date and priority • Introduces `append_output` configuration option in falco.yaml • Adds `--config-schema` action to print the config schema • Enables CLI options via `-o key={object}` syntax • Adds `container_engines` configuration key in falco.yaml • Adds `host_ifinfo` Prometheus metric Breaking changes: • The `tags` label is split into multiple tag_-prefixed labels in falco_metrics output • Prometheus metrics use full names for configs and rules files instead of short names • n_evts_cpu and n_drops_cpu Prometheus metrics are rearranged to follow best practices • CLI options `-t`, `-T`, and `-D` are removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.38.1 https://github.com/falcosecurity/falco/releases/tag/0.38.1 Wed, 19 Jun 2024 08:20:52 GMT Falco 0.38.1 introduces per-plugin metrics collection and allows the `-p` output format option for all sources. • Enable plugin metrics collection via new(metrics) subsystem to expose counters/gauges from Falco plugins • Allow `-p` (output format) flag to be used with all rule sources, not just syscalls • Restrict `-pk` and `-pc` flags to syscall sources only Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.38.0 https://github.com/falcosecurity/falco/releases/tag/0.38.0 Thu, 30 May 2024 08:01:11 GMT Falco 0.38.0 adds Prometheus metrics endpoint, rule filtering by name, split config support, and modern eBPF as default driver • Adds `metrics.prometheus_enabled` configuration option to enable a new Prometheus metrics HTTP endpoint (requires `metrics.enabled=true`) • Adds `rules_counters_enabled` configuration option to expose rule hit counters in metrics output • Adds file sha256sum metrics for loaded config and rules files to verify integrity via Prometheus • Adds ability to select specific rules to load via configuration or command-line arguments • Adds support for split config files in userspace • Adds `falco_libs.thread_table_size` configuration option to tune thread table size • Raises warning instead of error when an invalid macro or list name is used in rules Breaking changes: • Modern eBPF is now the default driver and highest priority in automatic driver selection logic, potentially changing behavior if older drivers are needed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.37.1 https://github.com/falcosecurity/falco/releases/tag/0.37.1 Tue, 13 Feb 2024 10:59:14 GMT Falco v0.37.1 adds insecure HTTP driver download support for falco and driver-loader images. • Adds `--download-insecure` flag to falco and `falco-driver-loader` docker images to allow downloading kernel modules via insecure HTTP connections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.37.0 https://github.com/falcosecurity/falco/releases/tag/0.37.0 Tue, 30 Jan 2024 10:38:44 GMT Falco 0.37.0 adds rule engine overrides, HTTP output compression/keep-alive, env var expansion, and removes the --userspace flag • Adds `compress_uploads` and `keep_alive` fields to the `http_output` block in `falco.yaml` to control HTTP output behavior • Enables environment variable expansion inside YAML strings across all configuration files via `FALCO_CONF` or standard parser support • Adds a new engine-level mechanism for selective overrides of Falco rules • Prints system information on startup for easier diagnosis • Adds driver selection configuration in `falco.yaml` to choose the kernel module or no-driver mode • Adds `listen_address` field to the `webserver` block in `falco.yaml` to configure the HTTP API binding address • Adds `engine_version_semver` key to the `/versions` endpoint for version checking • Enables `watch_config_files` to monitor configuration file moves and deletions Breaking changes: • The `--userspace` CLI flag is removed; users must use the eBPF driver or kernel module. • The `outputs.rate` and `outputs.max_burst` configuration keys are removed from `falco.yaml`; output limiting is now handled differently. • The `none` value for the driver config key is renamed to `nodriver` in `falco.yaml`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.36.0 https://github.com/falcosecurity/falco/releases/tag/0.36.0 Tue, 26 Sep 2023 07:00:42 GMT Falco 0.36.0 adds mTLS for HTTP output, env var substitution in YAML, driver-loader options, and systemctl reload support. • Adds `http_output.server_tls.cacert_file`, `http_output.server_tls.cert_file`, and `http_output.server_tls.key_file` config keys to `/etc/falco/falco.yaml` to enable mTLS for the HTTP output backend • Adds support for parsing system environment variables (e.g. `${VAR}`) within `falco.yaml` configuration files • Adds `--source-only` flag to `falco-driver-loader` to print loader source values as environment variables • Enables passing custom options directly to `falco-driver-loader` via the driver loader container's entrypoint or command arguments • Adds the `falco-distroless` Docker image (Wolfi-based) for a minimal Falco runtime without package managers • Adds `systemctl reload falco.service` support for reloading configuration without restarting the daemon • Allows multiple rules to match on a single event instead of stopping at the first match • Renames the CLI flag `--list-syscall-events` to `--list-events` and expands its output to include tracepoints, metaevents, and plugin events • Removes the `-d` daemonize CLI option; Falco no longer supports backgrounding itself via this flag • Replaces `-s` / `--stats-interval` CLI options with metrics configuration in `/etc/falco/falco.yaml` • Changes the default output of `-p` presets: `-pc` prints container metadata, `-pk` appends Kubernetes namespace and pod name • Changes `%proc.exepath` field behavior to return the on-disk executable path regardless of symbolic links Breaking changes: • The default rules file is now 'stable'; install `falco-incubating-rules` and `falco-sandbox-rules` separately for previously included rules • The `-d` daemonize CLI option has been removed; use external process managers to background Falco • The `-s` / `--stats-interval` CLI options have been removed; configure metrics in `/etc/falco/falco.yaml` instead • HTTP output no longer echoes to stdout by default; set `http_output.echo: true` in `/etc/falco/falco.yaml` to restore previous behavior • The `--list-syscall-events` flag is renamed to `--list-events`; update scripts or CLI calls that reference the old name • The `%proc.exepath` field now resolves symlinks; rules relying on the symlink path itself may need updating Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.35.0 https://github.com/falcosecurity/falco/releases/tag/0.35.0 Wed, 07 Jun 2023 12:15:45 GMT Falco 0.35.0 adds config-driven metrics snapshots, HTTP output CA options, syscall filtering, and cosign signing. • Adds `--metrics-snapshot` option to take a programmatic snapshot of internal metrics via the new metrics subsystem. • Adds `ssl_ca` and `tls_store` configuration keys under `http_output` in the Falco config file to allow custom CA certificates and stores for HTTP output. • Adds `syscall_drop_failed` configuration option to silently drop failed syscall exit events from processing. • Adds `base_syscalls` user option to control which syscalls are tracked by the engine, along with `base_syscalls.repair` to repair base set inconsistencies. • Container images are now signed with cosign, enabling verification of image integrity. Breaking changes: • The `--mesos-api`, `-pmesos`, and `-pm` command-line flags have been removed; Mesos metadata enrichment is no longer supported. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.34.0 https://github.com/falcosecurity/falco/releases/tag/0.34.0 Tue, 07 Feb 2023 14:59:58 GMT Falco 0.34.0 adds PTRACE code injection detection, --version-json output, webserver version endpoint, simulate_drops config, and falcoctl bundling. • `--version-json` flag to print version information in JSON format • New rule to detect attempts to inject code into a process using PTRACE • Webserver endpoint for retrieving internal version numbers • Config key `simulate_drops` added • `falcoctl` is shipped inside the Falco package • Support multiple drivers in systemd units Breaking changes: • `application_rules.yaml` is not shipped anymore with Falco Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.33.0 https://github.com/falcosecurity/falco/releases/tag/0.33.0 Wed, 19 Oct 2022 15:18:15 GMT Falco 0.33.0 adds event source filtering, gVisor default path changes, and selective event source configuration • `--drop-pct` flag added to control the global rate of dropped events for high-volume environments • `falco-driver-loader` `DRIVERS_REPO` environment variable now accepts comma-separated URLs for driver fallbacks • gVisor socket default path changed to `/run/falco/gvisor.sock` (was `/tmp/gvisor.sock`) • gRPC server socket default path changed to `/run/falco/falco.sock` (was `/run/falco.sock.sock`) • `required_engine_version` in `falco.yaml` checks now supports alternative plugin version requirements • notification rate limiter is now disabled by default • Falco automatically creates paths for gRPC unix socket and gvisor endpoint on startup Breaking changes: • The `falco.yaml` `notification.rate_limiter.enabled` field defaults to false in this version (previously true or enabled by configuration) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.32.1 https://github.com/falcosecurity/falco/releases/tag/0.32.1 Mon, 11 Jul 2022 11:48:01 GMT Falco 0.32.1 adds gVisor support and new --plugin-info CLI option • `--plugin-info` CLI argument added to falco for printing plugin metadata. • gVisor runtime is now a supported target for syscall monitoring. Breaking changes: • The `macro` source field in rule definitions has been removed and must be dropped from existing rules files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.32.0 https://github.com/falcosecurity/falco/releases/tag/0.32.0 Fri, 03 Jun 2022 09:56:38 GMT Falco 0.32.0 adds --markdown output, `watch_config_files` reload, new rules, and UBI base image • Adds `--markdown` flag to output detection events in Markdown format • Adds `--list-syscall-events` subcommand to list supported syscall events for the configured source • Adds `watch_config_files` config option to trigger an automatic Falco restart when rules or config files change • Adds new rule to detect excessively capable containers • Adds new rules to detect pods sharing host PID and IPC namespaces • Adds new rule to detect container escape attempts via the release_agent file • Adds `hostname` field to JSON output for detection events • Adds out-of-the-box ruleset for the OKTA Falco Plugin • Adds a new Falco container image based on RedHat UBI Breaking changes: • K8S audit logs are removed from Falco; K8S and Mesos clients are now enabled only when their corresponding syscall source is enabled • Lua rule support is removed; existing Lua rules must be migrated to the new filter parser Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.31.1 https://github.com/falcosecurity/falco/releases/tag/0.31.1 Wed, 09 Mar 2022 17:20:13 GMT Falco 0.31.1 adds a new drop category `n_drops_scratch_map` and supports multiple `--cri` options. • Add `n_drops_scratch_map` to the list of kernel drop counters monitored by Falco • Allow specifying multiple `--cri` flags on the command line to connect to several container runtimes simultaneously Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco https://github.com/falcosecurity/falco/releases/tag/0.31.0 https://github.com/falcosecurity/falco/releases/tag/0.31.0 Mon, 31 Jan 2022 16:06:26 GMT Falco 0.31.0 adds a new plugin framework for extending event sources and custom fields, plus HTTP output User-Agent configuration. • `falco --list` option can now list fields related to plugin event sources • HTTP output now supports custom `user-agent` header via `http_output.user_agent` configuration key Breaking changes: • `--alternate-lua-dir` cmdline option removed (lua scripts are now embedded) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/falco