Falco

https://falco.org/docs
Admin
Falco is a cloud native runtime security tool that detects and alerts on abnormal behavior and...
Tokens:180,088
Snippets:2,169
Trust Score:9.9
Update:1 month ago
Show doc for...
Tokens:
Raw
### Example: Install Docker Rules Artifact

Source: https://falco.org/docs/developer-guide/plugins/how-to-distribute

Illustrates the installation process for a specific artifact, the `docker-rules`, using `falcoctl`, including output logs.

```bash
❯ sudo falcoctl artifact install docker-rules
 INFO  Reading all configured index files from "/root/.config/falcoctl/indexes.yaml"
 INFO  Resolving dependencies ...
 INFO  Installing the following artifacts: [docker:0.3.3 ghcr.io/issif/docker-plugin/ruleset/docker:latest]
 INFO  Preparing to pull "ghcr.io/issif/docker-plugin/plugin/docker:0.3.3"
 INFO  Pulling 9145239be00e: ############################################# 100%
 INFO  Pulling 2073e106ba07: ############################################# 100%
 INFO  Pulling 01ecf22a3821: ############################################# 100%
 INFO  Artifact successfully installed in "/usr/share/falco/plugins"                                                                                                                                          
 INFO  Preparing to pull "ghcr.io/issif/docker-plugin/ruleset/docker:latest"
 INFO  Pulling 3482c7ca931f: ############################################# 100%
 INFO  Pulling 433ad24cb056: ############################################# 100%
 INFO  Pulling e449b880035d: ############################################# 100%
 INFO  Artifact successfully installed in "/etc/falco"

```

--------------------------------

### Start Minikube with VirtualBox Driver

Source: https://falco.org/docs/getting-started/learning-environments

Initiates a Minikube cluster using the VirtualBox driver. This is a prerequisite for certain Falco installations.

```bash
minikube start --driver=virtualbox

```

--------------------------------

### Install apt dependencies and Falco

Source: https://falco.org/docs/getting-started/installation

Commands to prepare the system, install build dependencies, and install the Falco package via apt.

```bash
sudo apt-get install apt-transport-https
```

```bash
sudo apt-get update -y
```

```bash
sudo apt install -y dkms make linux-headers-$(uname -r)
# You can install also the dialog package if you want it
sudo apt install -y dialog
```

```bash
sudo apt-get install -y falco
```

--------------------------------

### Falco Configuration Example

Source: https://falco.org/docs/developer-guide/plugins/how-to-develop

Example of how a plugin is configured in falco.yaml, including init_config.

```yaml
plugins:
  - name: docker
    library_path: /etc/falco/audit/libdocker.so
    init_config: '{"flushinterval": 10}'
    open_params: ''
```

--------------------------------

### Driver repository example

Source: https://falco.org/docs/setup/tarball

An example path for a prebuilt kernel module in a custom repository.

```text
/7.0.0+driver/x86_64/falco_amazonlinux2022_5.10.75-82.359.amzn2022.x86_64_1.ko
```

--------------------------------

### Example: Add Docker Plugin Index

Source: https://falco.org/docs/developer-guide/plugins/how-to-distribute

Demonstrates adding a specific plugin's index to `falcoctl`, using the `docker` plugin as an example.

```bash
❯ sudo falcoctl index add docker  http://issif.github.io/docker-plugin/index.yaml

```

--------------------------------

### Install Falco with zypper

Source: https://falco.org/docs/install-operate/installation

Install the Falco package using zypper on openSUSE systems.

```bash
sudo zypper -n install falco

```

--------------------------------

### Configure and Start Falcosidekick with Systemd

Source: https://falco.org/docs/concepts/outputs/forwarding

Set up Falcosidekick to run as a systemd service. This includes enabling the service to start on boot and starting the service immediately, using a specified configuration file.

```bash
[Unit]
Description=Falcosidekick
After=network.target
StartLimitIntervalSec=0

[Service]
Type=simple
Restart=always
RestartSec=1
ExecStart=/usr/local/bin/falcosidekick -c /etc/falcosidekick/config.yaml
EOF

```

```bash
systemctl enable falcosidekick
systemctl start falcosidekick

```

--------------------------------

### Install Falco Plugin and Rules

Source: https://falco.org/docs/developer-guide/plugins/how-to-distribute

Commands to install your plugin and its associated rules file using `falcoctl` after adding its index.

```bash
sudo falcoctl artifact install {PLUGIN_NAME}
sudo falcoctl artifact install {PLUGIN_NAME}-rules

```

--------------------------------

### Example of Byte Starts With Operator

Source: https://falco.org/docs/concepts/rules/conditions

Illustrates the 'bstartswith' operator for checking if a raw string of bytes, provided as a hexadecimal input, matches the beginning of a field.

```falco
evt.buffer bstartswith 012AB3CC
```

--------------------------------

### C++ Plugin Example: Implementing Async Event Handler

Source: https://falco.org/docs/reference/plugins/plugin-api-reference

Demonstrates how to set up and manage an asynchronous event handler within a C++ plugin. This includes starting and stopping a worker thread that sends events via the provided handler, ensuring proper thread synchronization and cleanup.

```cpp
typedef struct my_plugin
{
    std::thread async_thread;
    std::atomic<bool> async_thread_run;
}
my_plugin;

extern "C" ss_plugin_t* plugin_init(const ss_plugin_init_input* in, ss_plugin_rc* rc)
{
    my_plugin *ret = new my_plugin();
    ret->async_thread_run = false;
    *rc = SS_PLUGIN_SUCCESS;
    return ret;
}

extern "C" void plugin_destroy(ss_plugin_t* s)
{
    // stop the async thread if it's running
    my_plugin *ps = (my_plugin *) s;
    if (ps->async_thread_run)
    {
        ps->async_thread_run = false;
        if (ps->async_thread.joinable())
        {
            ps->async_thread.join();
        }
    }
    delete ps;
}

...

extern "C" ss_plugin_rc plugin_set_async_event_handler(ss_plugin_t* s, ss_plugin_owner_t* owner, const ss_plugin_async_event_handler_t handler)
{
    my_plugin *ps = (my_plugin *) s;

    // stop the async thread if it's running
    if (ps->async_thread_run)
    {
        ps->async_thread_run = false;
        if (ps->async_thread.joinable())
        {
            ps->async_thread.join();
        }
    }

    // if an handler is provided, launch an async worker
    if (handler)
    {
        ps->async_thread_run = true;
        ps->async_thread = std::thread([ps, owner, handler]()
        {
            char err[PLUGIN_MAX_ERRLEN];
            while (ps->async_thread_run)
            {
                ss_plugin_event* evt = ps->do_some_work();
                if (handler(owner, evt, err) != SS_PLUGIN_SUCCESS)
                {
                    // report the error somehow
                }
            }
        });
    }

    return SS_PLUGIN_SUCCESS;
}
```

--------------------------------

### Install Falco with apt

Source: https://falco.org/docs/install-operate/installation

Install the Falco package using apt on Debian/Ubuntu systems.

```bash
sudo apt-get install -y falco

```

--------------------------------

### Example JSON for plugin_list_open_params

Source: https://falco.org/docs/reference/plugins/plugin-api-reference

An example of the JSON string format for suggested parameters, including value, description, and optional separator.

```json
[
    {"value": "resource1", "desc": "An example of openable resource"},
    {"value": "resource2", "desc": "Another example of openable resource"}
    {
        "value": "res1;res2;res3",
        "desc": "Some names",
        "separator": ";"
    }
]
```

--------------------------------

### Configure and install the kernel module

Source: https://falco.org/docs/setup/tarball

Use falcoctl to configure the driver type and install the kernel module.

```bash
# If you want to use the kernel module, configure Falco for it
falcoctl driver config --type kmod
# Install the chosen driver
falcoctl driver install
```

--------------------------------

### Install Falco

Source: https://falco.org/docs/getting-started/falco-linux-quickstart

Installs the latest stable version of Falco on the system.

```bash
sudo apt-get install -y falco
```

--------------------------------

### Install Build Dependencies on openSUSE

Source: https://falco.org/docs/developer-guide/source

Install required development packages for building on openSUSE.

```bash
zypper -n install git gcc12 gcc12-c++ cmake make libelf-devel gawk
```

--------------------------------

### Enable and Start Falcosidekick Service

Source: https://falco.org/docs/outputs/forwarding

Commands to enable the Falcosidekick service to start on boot and to start it immediately.

```bash
systemctl enable falcosidekick
systemctl start falcosidekick

```

--------------------------------

### Install Falco dependencies

Source: https://falco.org/docs/getting-started/installation

Install the required kernel development headers and optional dialog package.

```bash
sudo zypper -n install kernel-default-devel-$(uname -r | sed s/\-default//g)
sudo zypper -n install dialog
```

--------------------------------

### Falco Plugin Makefile

Source: https://falco.org/docs/developer-guide/plugins/how-to-develop

A sample Makefile for building and installing Falco plugins. It handles cleaning, building, and installation to the standard Falco plugins directory.

```makefile
SHELL=/bin/bash -o pipefail
GO ?= go

NAME := docker
OUTPUT := lib$(NAME).so
DESTDIR := /usr/share/falco/plugins

ifeq ($(DEBUG), 1)
	GODEBUGFLAGS= GODEBUG=cgocheck=2
else
	GODEBUGFLAGS= GODEBUG=cgocheck=0
endif

all: build

clean:
	@rm -f lib$(NAME).so

build: clean
	@$(GODEBUGFLAGS) $(GO) build -buildmode=c-shared -buildvcs=false -o $(OUTPUT) ./plugin

install: build
	mv $(OUTPUT) $(DESTDIR)/

```

--------------------------------

### Install Falcosidekick on Host System

Source: https://falco.org/docs/concepts/outputs/forwarding

Download and install the Falcosidekick binary on a host system. This involves creating a directory, downloading the tarball, and extracting the binary to the system's PATH.

```bash
sudo mkdir -p /etc/falcosidekick
wget https://github.com/falcosecurity/falcosidekick/releases/download/2.27.0/falcosidekick_2.27.0_linux_amd64.tar.gz && sudo tar -C /usr/local/bin/ -xzf falcosidekick_2.27.0_linux_amd64.tar.gz

```

--------------------------------

### Install Kernel Module Dependencies for zypper

Source: https://falco.org/docs/getting-started/installation

Install required build tools for openSUSE. Not required if using Modern eBPF.

```bash
sudo zypper -n install dkms make
```

--------------------------------

### Kubernetes Audit Rules Example

Source: https://falco.org/docs/concepts/event-sources/plugins/kubernetes-audit

An example rule from the default k8s_audit_rules.yaml file, demonstrating the definition of a list for Kubernetes audit stages.

```yaml
- list: k8s_audit_stages
  items: ["ResponseComplete"]

```

--------------------------------

### Install Falco with Embedded Rules via Helm

Source: https://falco.org/docs/concepts/rules/default-custom

Install Falco using the Helm chart, disabling runtime rule file downloads to use the rules embedded within the Falco image. This simplifies setup by using pre-packaged rules.

```bash
helm install falco \
    --set falcoctl.artifact.install.enabled=false \
    --set falcoctl.artifact.follow.enabled=false

```

--------------------------------

### Create Ubuntu VM with Lima

Source: https://falco.org/docs/getting-started/falco-linux-quickstart

Starts an Ubuntu LTS virtual machine named 'falco-quickstart' using Lima.

```bash
limactl start --name=falco-quickstart template://ubuntu-lts
```

--------------------------------

### Falco Rule with 'and not' Exceptions

Source: https://falco.org/docs/concepts/rules/custom-ruleset

This example shows how to add exceptions to a Falco rule using the `and not` operator within the condition. It excludes privileged containers if their image repository is in a trusted list or starts with a local registry.

```yaml
- list: trusted_images
  items: [docker.io/user/image1, quay.io/user/image2]

- rule: Launch Privileged Container
  desc: Detect the start of a privileged container. Exceptions are made for known trusted images.
  condition: >
    container_started and container
    and container.privileged=true
    and not ( container.image.repository in (trusted_images) or
              container.image.repository startswith registry.local/ )
  output: Privileged container
  priority: debug

```

--------------------------------

### Full Stack Falco Ecosystem Quickstart

Source: https://falco.org/docs/setup/operator

Deploys the entire Falco ecosystem, including Falco, rules, plugins, Falcosidekick, and k8s-metacollector, in the 'falco' namespace using a single manifest.

```bash
VERSION=latest
if [ "$VERSION" = "latest" ]; then
  kubectl apply --server-side -f https://github.com/falcosecurity/falco-operator/releases/latest/download/quickstart.yaml
else
  kubectl apply --server-side -f https://github.com/falcosecurity/falco-operator/releases/download/${VERSION}/quickstart.yaml
fi

```

--------------------------------

### Install Dialog Package

Source: https://falco.org/docs/getting-started/falco-linux-quickstart

Installs the 'dialog' package, which is a dependency for the Falco installer.

```bash
sudo apt-get install -y dialog
```

--------------------------------

### Shell into Lima VM

Source: https://falco.org/docs/getting-started/falco-linux-quickstart

Connects to the 'falco-quickstart' Ubuntu VM created with Lima.

```bash
limactl shell falco-quickstart
```

--------------------------------

### Initialize Prebuilt Source Instances

Source: https://falco.org/docs/reference/plugins/go-sdk-walkthrough

Constructors for creating pull and push model source instances.

```go
// sdk/plugins/source

func NewPullInstance(pull source.PullFunc, options ...func(*<unexported-type>)) (source.Instance, error)

func NewPushInstance(evtC <-chan source.PushEvent, options ...func(*<unexported-type>)) (source.Instance, error)
```

--------------------------------

### Install zypper Kernel Module Dependencies

Source: https://falco.org/docs/install-operate/installation

Install dkms, make, and kernel-default-devel required for building the Kernel Module on openSUSE. Do not install if using Modern eBPF.

```bash
sudo zypper -n install dkms make
# If the package was not found by the below command, you might need to run `zypper -n dist-upgrade` in order to fix it. Rebooting the system may be required.
sudo zypper -n install kernel-default-devel-$(uname -r | sed s/\-default//g)
# You can install also the dialog package if you want it
sudo zypper -n install dialog

```

--------------------------------

### Falco Initialization Log Output

Source: https://falco.org/docs/getting-started/learning-environments

Example output showing Falco's initialization process, including rule loading, dependency resolution, and event source activation.

```json
{"level":"INFO","msg":"Resolving dependencies ...","timestamp":"2024-04-17 06:19:49"}
{"level":"INFO","msg":"Installing artifacts","refs":["ghcr.io/falcosecurity/rules/falco-rules:3"],"timestamp":"2024-04-17 06:19:51"}
{"level":"INFO","msg":"Preparing to pull artifact","ref":"ghcr.io/falcosecurity/rules/falco-rules:3","timestamp":"2024-04-17 06:19:51"}
{"level":"INFO","msg":"Pulling layer 1e72f9c4d8fe","timestamp":"2024-04-17 06:19:52"}
{"level":"INFO","msg":"Pulling layer 2e91799fee49","timestamp":"2024-04-17 06:19:52"}
{"level":"INFO","msg":"Pulling layer d4c03e000273","timestamp":"2024-04-17 06:19:52"}
{"digest":"ghcr.io/falcosecurity/rules/falco-rules@sha256:d4c03e000273a0168ee3d9b3dfb2174e667b93c9bfedf399b298ed70f37d623b","level":"INFO","msg":"Verifying signature for artifact","timestamp":"2024-04-17 06:19:52"}
{"level":"INFO","msg":"Signature successfully verified!","timestamp":"2024-04-17 06:19:53"}
{"file":"falco_rules.yaml.tar.gz","level":"INFO","msg":"Extracting and installing artifact","timestamp":"2024-04-17 06:19:53","type":"rulesfile"}
{"digest":"sha256:d4c03e000273a0168ee3d9b3dfb2174e667b93c9bfedf399b298ed70f37d623b","directory":"/rulesfiles","level":"INFO","msg":"Artifact successfully installed","name":"ghcr.io/falcosecurity/rules/falco-rules:3","timestamp":"2024-04-17 06:19:53","type":"rulesfile"}
Wed Apr 17 06:19:54 2024: Falco initialized with configuration file: /etc/falco/falco.yaml
Wed Apr 17 06:19:54 2024: System info: Linux version 5.10.57 (jenkins@ubuntu-iso) (x86_64-minikube-linux-gnu-gcc.br_real (Buildroot 2021.02.12-1-gb75713b-dirty) 9.4.0, GNU ld (GNU Binutils) 2.35.2) #1 SMP Tue Nov 7 06:51:54 UTC 2023
Wed Apr 17 06:19:54 2024: Loading rules from file /etc/falco/falco_rules.yaml
Wed Apr 17 06:19:54 2024: Hostname value has been overridden via environment variable to: minikube
Wed Apr 17 06:19:54 2024: The chosen syscall buffer dimension is: 8388608 bytes (8 MBs)
Wed Apr 17 06:19:54 2024: Starting health webserver with threadiness 4, listening on 0.0.0.0:8765
Wed Apr 17 06:19:54 2024: Loaded event sources: syscall
Wed Apr 17 06:19:54 2024: Enabled event sources: syscall
Wed Apr 17 06:19:54 2024: Opening 'syscall' source with modern BPF probe.
Wed Apr 17 06:19:54 2024: One ring buffer every '2' CPUs.

```

--------------------------------

### Install apt Kernel Module Dependencies

Source: https://falco.org/docs/install-operate/installation

Install dkms, make, and linux-headers required for building the Kernel Module on Debian/Ubuntu. Do not install if using Modern eBPF.

```bash
sudo apt install -y dkms make linux-headers-$(uname -r)
# You can install also the dialog package if you want it
sudo apt install -y dialog

```

--------------------------------

### Install yum Kernel Module Dependencies

Source: https://falco.org/docs/install-operate/installation

Install dkms, make, and kernel-devel required for building the Kernel Module on CentOS/RHEL/Fedora/Amazon Linux. Do not install if using Modern eBPF.

```bash
# If necessary install it using: `yum install epel-release` (or `amazon-linux-extras install epel` in case of amzn2), then `yum install make dkms`.
sudo yum install -y dkms make
# If the package was not found by the below command, you might need to run `yum distro-sync` in order to fix it. Rebooting the system may be required.
sudo yum install -y kernel-devel-$(uname -r)
# You can install also the dialog package if you want it
sudo yum install -y dialog

```

--------------------------------

### Install and Uninstall Falco

Source: https://falco.org/docs/getting-started/installation

Commands to install or remove the Falco package.

```bash
sudo zypper -n install falco
```

```bash
sudo zypper rm falco
```

--------------------------------

### Example: Search for Docker Plugin Artifacts

Source: https://falco.org/docs/developer-guide/plugins/how-to-distribute

Shows how to search for available artifacts (plugins and rules) associated with a registered index using `falcoctl`.

```bash
❯ sudo falcoctl artifact search docker
INDEX 	ARTIFACT    	TYPE     	REGISTRY	REPOSITORY                   
docker	docker      	plugin   	ghcr.io 	issif/docker-plugin/plugin/docker
docker	docker-rules	rulesfile	ghcr.io 	issif/docker-plugin/ruleset/docker

```

--------------------------------

### Build all Falco components

Source: https://falco.org/docs/developer-guide/source

Standard sequence of commands to initialize the build directory and compile the entire project.

```bash
mkdir build
cd build
cmake ..
make
```

--------------------------------

### Install Falco Rules with Falcoctl

Source: https://falco.org/docs/concepts/rules/default-custom

Download and install specific versions of Falco rules files using the falcoctl tool. This command adds an index and then installs a specified artifact version.

```bash
# falcoctl index add falcosecurity https://falcosecurity.github.io/falcoctl/index.yaml
# falcoctl artifact install falco-rules:3.2.0

```

--------------------------------

### Example Plugin Entry in registry.yaml

Source: https://falco.org/docs/developer-guide/plugins/how-to-register

This snippet shows the required format for a plugin entry within the registry.yaml file. Ensure all fields like id, source, name, description, authors, contact, url, and license are correctly populated.

```yaml
plugins:
    source:
        - id: 2
          source: aws_cloudtrail
          name: cloudtrail
          description: Reads Cloudtrail JSON logs from files/S3 and injects as events
          authors: The Falco Authors
          contact: https://falco.org/community
          url: https://github.com/falcosecurity/plugins/tree/master/plugins/cloudtrail
          license: Apache-2.0

```

--------------------------------

### Install Lima

Source: https://falco.org/docs/getting-started/falco-linux-quickstart

Installs Lima using Homebrew, a package manager for macOS.

```bash
brew install lima
```

--------------------------------

### Plugin Initialization with Logging Callback

Source: https://falco.org/docs/reference/plugins/plugin-api-reference

Demonstrates how a plugin can retain the framework's logging function during initialization to log messages throughout its lifecycle. It shows storing the owner handle and log function pointer.

```cpp
struct my_plugin
{
    ss_plugin_owner_t* owner;
    ss_plugin_log_fn_t log;
};

extern "C" ss_plugin_t* plugin_init(const ss_plugin_init_input* in, ss_plugin_rc* rc)
{
    *rc = SS_PLUGIN_SUCCESS;
    my_plugin *ret = new my_plugin();

    ret->log = in->log_fn;
    ret->owner = in->owner;

    ret->log(ret->owner, NULL, "initializing plugin...", SS_PLUGIN_LOG_SEV_INFO);
    
    return ret;
}

```

--------------------------------

### Run Falco with Plugin

Source: https://falco.org/docs/reference/plugins/go-sdk-walkthrough

Execute the Falco binary pointing to the custom rules and configuration files to observe plugin output.

```bash
$ ./falco -r ../falco-files/dummy_rules.yaml -c ../falco-files/falco.yaml
Wed Feb  2 16:26:35 2022: Falco version 0.31.0 (driver version 319368f1ad778691164d33d59945e00c5752cd27)
Wed Feb  2 16:26:35 2022: Falco initialized with configuration file ../falco-files/falco.yaml
Wed Feb  2 16:26:35 2022: Loading plugin (dummy) from file /tmp/my-plugins/dummy/libdummy.so
Wed Feb  2 16:26:35 2022: Loading rules from file ../rules/dummy_rules.yaml:
Wed Feb  2 16:26:35 2022: Starting internal webserver, listening on port 8765
16:26:35.527827816: Notice A dummy event (event={"sample": "6"} sample=6 sample_str=6 num=1)
16:26:35.527829658: Notice A dummy event (event={"sample": "18"} sample=18 sample_str=18 num=3)
16:26:35.527831048: Notice A dummy event (event={"sample": "33"} sample=33 sample_str=33 num=8)
Events detected: 3
Rule counts by severity:
   INFO: 3
Triggered rules by rule name:
   My Dummy Rule: 3
Syscall event drop monitoring:
   - event drop detected: 0 occurrences
   - num times actions taken: 0
```

--------------------------------

### Falco Plugin Configuration

Source: https://falco.org/docs/developer-guide/plugins/how-to-develop

Example configuration in `falco.yaml` to load and initialize a plugin named 'docker'.

```yaml
plugins:
  - name: docker
    library_path: /usr/share/falco/plugins/libdocker.so
    init_config: '{"flushinterval": 1}'

load_plugins: [docker]

stdout_output:
  enabled: true

```

--------------------------------

### Implement Pull Model Source

Source: https://falco.org/docs/reference/plugins/go-sdk-walkthrough

Example implementation of an event source using the Pull Model prebuilt.

```go
func (m *MyPlugin) Open(params string) (source.Instance, error) {
	counter := uint64(0)
	pull := func(ctx context.Context, evt sdk.EventWriter) error {
		counter++
		if err := gob.NewEncoder(evt.Writer()).Encode(counter); err != nil {
			return err
		}
		evt.SetTimestamp(uint64(time.Now().UnixNano()))
		return nil
	}
	return source.NewPullInstance(pull)
}
```

--------------------------------

### Install Falco with yum

Source: https://falco.org/docs/install-operate/installation

Install the Falco package using yum on CentOS/RHEL/Fedora/Amazon Linux.

```bash
sudo yum install -y falco

```

--------------------------------

### Example Output for plugin_event_to_string

Source: https://falco.org/docs/reference/plugins/plugin-api-reference

An example of the string representation for an event, as might be returned by the cloudtrail plugin.

```text
us-east-1 masters.some-demo.k8s.local s3 GetObject Size=0 URI=s3://some-demo-env/some-demo.k8s.local/backups/etcd/events/control/etcd-cluster-created
```

--------------------------------

### List Plugins

Source: https://falco.org/docs/reference/daemon/cli-arguments

Print information on all loaded plugins and exit.

```bash
Falco - Cloud Native Runtime Security
Usage:
  falco [OPTION...]

      --list-plugins            Print info on all loaded plugins and exit.
```

--------------------------------

### Plugin Initialization and Registration

Source: https://falco.org/docs/developer-guide/plugins/how-to-develop

The init function registers the plugin with the Falco framework, setting its information and declaring its capabilities as a source and an extractor.

```go
func init() {
	plugins.SetFactory(func() plugins.Plugin {
		p := &docker.Plugin{}
		p.SetInfo(
			ID,
			Name,
			Description,
			Contact,
			Version,
			EventSource,
		)
		extractor.Register(p)
		source.Register(p)
		return p
	})
}

```

--------------------------------

### Install Build Dependencies on Alpine

Source: https://falco.org/docs/developer-guide/source

Install dependencies for Alpine Linux, noting the requirement for musl-optimized builds.

```bash
apk add g++ gcc cmake make git bash perl linux-headers autoconf automake m4 libtool elfutils-dev libelf-static binutils bpftool clang
```

--------------------------------

### Implementing Plugin Info

Source: https://falco.org/docs/reference/plugins/go-sdk-walkthrough

Provides the required Info method to return plugin metadata such as ID, name, and version.

```go
const (
	PluginID          uint32 = 3
	PluginName               = "dummy"
	PluginDescription        = "Reference plugin for educational purposes"
	PluginContact            = "github.com/falcosecurity/plugins"
	PluginVersion            = "0.4.0"
	PluginEventSource        = "dummy"
)

...

func (m *Plugin) Info() *plugins.Info {
	return &plugins.Info{
		ID:                 PluginID,
		Name:               PluginName,
		Description:        PluginDescription,
		Contact:            PluginContact,
		Version:            PluginVersion,
		RequiredAPIVersion: PluginRequiredApiVersion,
		EventSource:        PluginEventSource,
	}
}

...
```

--------------------------------

### Syscall Entry Event Example

Source: https://falco.org/docs/concepts/rules/conditions

Illustrates the syntax for matching a syscall entry event. The '>' indicates the entry point of the syscall.

```falco
> setuid(UID uid)
```

--------------------------------

### Install Build Dependencies on Debian/Ubuntu

Source: https://falco.org/docs/developer-guide/source

Install required packages for building Falco on Debian or Ubuntu systems.

```bash
apt update && apt install git cmake clang build-essential linux-tools-common linux-tools-generic libelf-dev bpftool
```

--------------------------------

### Example Falco Alert on Standard Output

Source: https://falco.org/docs/concepts/outputs/channels

An example of a Falco alert message formatted for standard output.

```text
10:20:05.408091526: Warning Sensitive file opened for reading by non-trusted program (user=root command=cat /etc/shadow file=/etc/shadow)

```

--------------------------------

### Plugin Initialization with State Table Access

Source: https://falco.org/docs/reference/plugins/plugin-api-reference

Example of a plugin initializing and accessing state tables provided by the framework owner. It demonstrates error handling for unsupported features and retrieving table information.

```cpp
extern "C" ss_plugin_t* plugin_init(const ss_plugin_init_input* in, ss_plugin_rc* rc)
{
    *rc = SS_PLUGIN_SUCCESS;
    my_plugin *ret = new my_plugin();

    if (!in || !in->tables)
    {
        *rc = SS_PLUGIN_FAILURE;
        ret->lasterr = "access to the state tables is not supported by the owner";
        return ret;
    }  

    uint32_t ntables = 0;
    auto tables = in->tables->list_tables(in->owner, &ntables);
    if (!tables)
    {
        *rc = SS_PLUGIN_FAILURE;
        ret->lasterr = "can't list state tables: " + std::string(in->get_owner_last_error(in->owner));
        return ret;
    }

    for (uint32_t i = 0; i < ntables; i++)
    {
        auto& ti = tables[i];
        printf("table='%s', key_type=%d\n", ti.name, ti.key_type);
    }
    
    return ret;
}

```

--------------------------------

### Configure Source Instance Options

Source: https://falco.org/docs/reference/plugins/go-sdk-walkthrough

Functional options for customizing source instance behavior such as timeouts, batch sizes, and context.

```go
// sdk/plugins/source

func WithInstanceContext(ctx context.Context) func(*<unexported-type>)

func WithInstanceTimeout(timeout time.Duration) func(*<unexported-type>)

func WithInstanceClose(close func()) func(*<unexported-type>)

func WithInstanceBatchSize(size uint32) func(*<unexported-type>)

func WithInstanceEventSize(size uint32) func(*<unexported-type>)

func WithInstanceProgress(progress func() (float64, string)) func(*<unexported-type>)
```

--------------------------------

### Install kernel module dependencies

Source: https://falco.org/docs/setup/tarball

Install necessary packages to build the kernel module if not using eBPF or plugins.

```bash
apt update -y
apt install -y dkms make linux-headers-$(uname -r)
```

--------------------------------

### Example Syslog Entry for Falco Alert

Source: https://falco.org/docs/concepts/outputs/channels

An example of a Falco alert message as it might appear in a syslog service.

```text
Jun  7 10:20:05 ubuntu falco: Sensitive file opened for reading by non-trusted program (user=root command=cat /etc/shadow file=/etc/shadow)

```

--------------------------------

### Run Falco with custom rules

Source: https://falco.org/docs/getting-started/falco-docker-quickstart

Starts the Falco container while mounting a local custom rules file into the container's configuration path.

```bash
docker run --rm -it \
           --name falco \
           --privileged \
           -v /sys/kernel/tracing:/sys/kernel/tracing:ro \
           -v /var/run/docker.sock:/host/var/run/docker.sock \
           -v /proc:/host/proc:ro \
           -v /etc:/host/etc:ro \
           -v $(pwd)/falco_custom_rules.yaml:/etc/falco/falco_rules.local.yaml \
           falcosecurity/falco:0.44.1
```

--------------------------------

### Initialize Vagrant for Ubuntu 24.04 VM

Source: https://falco.org/docs/getting-started/falco-linux-quickstart

Initializes a Vagrant environment for an Ubuntu 24.04 virtual machine.

```bash
vagrant init bento/ubuntu-24.04
vagrant up
```

--------------------------------

### Falco Output Example

Source: https://falco.org/docs/developer-guide/plugins/how-to-develop

This is an example of the output generated by Falco when a rule is triggered, showing event details and rule counts.

```text
17:17:24.008405000: Debug status=create from=alpine type=container action=create name=bold_keller
17:17:24.008953000: Debug status=start from=alpine type=container action=start name=bold_keller
17:17:24.009076000: Debug status=die from=alpine type=container action=die name=bold_keller

Events detected: 3
Rule counts by severity:
   DEBUG: 3
Triggered rules by rule name:
   Container status changed: 3
Syscall event drop monitoring:
   - event drop detected: 0 occurrences
   - num times actions taken: 0

```

--------------------------------

### Install Kernel Module Dependencies for yum

Source: https://falco.org/docs/getting-started/installation

Install required build tools and kernel headers. Not required if using Modern eBPF.

```bash
# If necessary install it using: `yum install epel-release` (or `amazon-linux-extras install epel` in case of amzn2), then `yum install make dkms`.
sudo yum install -y dkms make
# If the package was not found by the below command, you might need to run `yum distro-sync` in order to fix it. Rebooting the system may be required.
sudo yum install -y kernel-devel-$(uname -r)
# You can install also the dialog package if you want it
sudo yum install -y dialog
```
Tokens:
Raw