falco helm release - kubesearch

No introduction found. Create it?

Name	Repo	Stars	Version	Timestamp
falco	oscaromeu/home-ops	34	9.2.0	3 days ago
falco	xunholy/k8s-gitops	641	9.2.1	6 months ago

Name

Repo

Stars

Version

Timestamp

falco

oscaromeu/home-ops

9.2.0

3 days ago

falco

xunholy/k8s-gitops

641

9.2.1

6 months ago

Key	Types
driver.kind (3) `modern_ebpf`	string
driver.enabled (1) `true`	boolean
falcosidekick.enabled (3) `true`	boolean
falcosidekick.replicaCount (3) `1`	number
falcosidekick.webui.enabled (3) `true`	boolean
falcosidekick.webui.replicaCount (2) `1`	number
falcosidekick.webui.disableauth (1) `true`	boolean
falcosidekick.webui.ingress.annotations."cert-manager.io/cluster-issuer" (1) `letsencrypt-prod`	string
falcosidekick.webui.ingress.enabled (1) `true`	boolean
falcosidekick.webui.ingress.hosts[].host (1) `falco.${DOMAIN}`	string
falcosidekick.webui.ingress.hosts[].paths[].path (1) `/`	string
falcosidekick.webui.ingress.ingressClassName (1) `nginx`	string
falcosidekick.webui.ingress.tls[].hosts[] (1) `- falco.${DOMAIN}`	string
falcosidekick.webui.ingress.tls[].secretName (1) `falco-${DOMAIN/./-}-tls`	string
falcosidekick.config.alertmanager.hostport (2) `http://vmalertmanager-victoria-metrics.observability.svc.cluster.local:9093`	string
falcosidekick.config.alertmanager.customseveritymap (1) `emergency:critical,alert:critical,critical:critical,error:warning,warning:warning,notice:info,informational:info,debug:info`	string
falcosidekick.config.alertmanager.endpoint (1) `/api/v2/alerts`	string
falcosidekick.config.alertmanager.extralabels (1) `category:security,component:falco`	string
falcosidekick.config.alertmanager.minimumpriority (1) `warning`	string
falcosidekick.config.customfields (1) `cluster:main`	string
falcosidekick.config.debug (1) `false`	boolean
falcosidekick.resources.limits.memory (2) `256Mi`	string
falcosidekick.resources.requests.cpu (2) `10m`	string
falcosidekick.resources.requests.memory (2) `64Mi`	string
falcosidekick.prometheus.serviceMonitor.enabled (1) `true`	boolean
collectors.containerd.enabled (2) `true`	boolean
collectors.containerd.socket (1) `/run/containerd/containerd.sock`	string
collectors.crio.enabled (2) `false`	boolean
collectors.docker.enabled (2) `false`	boolean
collectors.kubernetes.enabled (2) `true`	boolean
collectors.containerEngine.enabled (1) `true`	boolean
collectors.enabled (1) `true`	boolean
falco.json_output (2) `true`	boolean
falco.buffered_outputs (1) `true`	boolean
falco.json_include_output_property (1) `true`	boolean
falco.log_level (1) `info`	string
falco.metrics.enabled (1) `false`	boolean
falco.metrics.interval (1) `15m`	string
falco.priority (1) `notice`	string
falco.syscall_event_drops.actions[] (1) `- log - alert`	string
falco.syscall_event_drops.max_burst (1) `1`	number
falco.syscall_event_drops.rate (1) `0.03333`	number
resources.limits.memory (2) `1Gi`	string
resources.requests.cpu (2) `100m`	string
resources.requests.memory (2) `512Mi`	string
affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1) `kubernetes.io/arch`	string
affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1) `In`	string
affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].values[] (1) `- amd64`	string
controller.kind (1) `daemonset`	string
customRules."overrides.yaml" (1) - rule: Drop and execute new binary in container override: exceptions: append exceptions: - name: cni_plugins fields: [proc.exepath] comps: [startswith] values: - [/opt/cni/bin/] - name: ci_namespaces fields: [k8s.ns.name] comps: [in] values: - [[actions-runner-system, development]] # Patches its bundled chromedriver into /app on every start, so # the binary is always newer than the image layer. - name: flaresolverr_chromedriver fields: [container.image.repository, proc.exepath] comps: [=, =] values: - [ghcr.io/flaresolverr/flaresolverr, /app/chromedriver] # Wazuh's own file-integrity monitoring reads /etc/shadow inside its # container -- that is the product working, not credential theft. - rule: Read sensitive file untrusted override: exceptions: append exceptions: - name: wazuh_fim fields: [container.image.repository, proc.name] comps: [=, in] values: - [docker.io/wazuh/wazuh-manager, [wazuh-syscheckd, wazuh-modulesd]]	string
ebpf.enabled (1) `true`	boolean
falcoctl.artifact.follow.enabled (1) `true`	boolean
falcoctl.artifact.install.enabled (1) `true`	boolean
falcoctl.config.artifact.allowedTypes[] (1) `- rulesfile`	string
falcoctl.config.artifact.follow.refs[] (1) `- falco-rules:4`	string
falcoctl.config.artifact.install.refs[] (1) `- falco-rules:4`	string
metrics.convertMemoryToMB (1) `true`	boolean
metrics.enabled (1) `true`	boolean
metrics.interval (1) `15m`	string
metrics.resourceUtilizationEnabled (1) `true`	boolean
metrics.rulesCountersEnabled (1) `true`	boolean
serviceMonitor.create (1) `true`	boolean
serviceMonitor.interval (1) `30s`	string

Key

Types

driver.kind (3)

modern_ebpf

string

driver.enabled (1)

true

boolean

falcosidekick.enabled (3)

true

boolean

falcosidekick.replicaCount (3)

number

falcosidekick.webui.enabled (3)

true

boolean

falcosidekick.webui.replicaCount (2)

number

falcosidekick.webui.disableauth (1)

true

boolean

falcosidekick.webui.ingress.annotations."cert-manager.io/cluster-issuer" (1)

letsencrypt-prod

string

falcosidekick.webui.ingress.enabled (1)

true

boolean

falcosidekick.webui.ingress.hosts[].host (1)

falco.${DOMAIN}

string

falcosidekick.webui.ingress.hosts[].paths[].path (1)

string

falcosidekick.webui.ingress.ingressClassName (1)

nginx

string

falcosidekick.webui.ingress.tls[].hosts[] (1)

- falco.${DOMAIN}

string

falcosidekick.webui.ingress.tls[].secretName (1)

falco-${DOMAIN/./-}-tls

string

falcosidekick.config.alertmanager.hostport (2)

http://vmalertmanager-victoria-metrics.observability.svc.cluster.local:9093

string

falcosidekick.config.alertmanager.customseveritymap (1)

emergency:critical,alert:critical,critical:critical,error:warning,warning:warning,notice:info,informational:info,debug:info

string

falcosidekick.config.alertmanager.endpoint (1)

/api/v2/alerts

string

falcosidekick.config.alertmanager.extralabels (1)

category:security,component:falco

string

falcosidekick.config.alertmanager.minimumpriority (1)

warning

string

falcosidekick.config.customfields (1)

cluster:main

string

falcosidekick.config.debug (1)

false

boolean

falcosidekick.resources.limits.memory (2)

256Mi

string

falcosidekick.resources.requests.cpu (2)

10m

string

falcosidekick.resources.requests.memory (2)

64Mi

string

falcosidekick.prometheus.serviceMonitor.enabled (1)

true

boolean

collectors.containerd.enabled (2)

true

boolean

collectors.containerd.socket (1)

/run/containerd/containerd.sock

string

collectors.crio.enabled (2)

false

boolean

collectors.docker.enabled (2)

false

boolean

collectors.kubernetes.enabled (2)

true

boolean

collectors.containerEngine.enabled (1)

true

boolean

collectors.enabled (1)

true

boolean

falco.json_output (2)

true

boolean

falco.buffered_outputs (1)

true

boolean

falco.json_include_output_property (1)

true

boolean

falco.log_level (1)

info

string

falco.metrics.enabled (1)

false

boolean

falco.metrics.interval (1)

15m

string

falco.priority (1)

notice

string

falco.syscall_event_drops.actions[] (1)

- log
- alert

string

falco.syscall_event_drops.max_burst (1)

number

falco.syscall_event_drops.rate (1)

0.03333

number

resources.limits.memory (2)

1Gi

string

resources.requests.cpu (2)

100m

string

resources.requests.memory (2)

512Mi

string

affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1)

kubernetes.io/arch

string

affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1)

In

string

affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].values[] (1)

- amd64

string

controller.kind (1)

daemonset

string

customRules."overrides.yaml" (1)

- rule: Drop and execute new binary in container
  override:
    exceptions: append
  exceptions:
    - name: cni_plugins
      fields: [proc.exepath]
      comps: [startswith]
      values:
        - [/opt/cni/bin/]
    - name: ci_namespaces
      fields: [k8s.ns.name]
      comps: [in]
      values:
        - [[actions-runner-system, development]]
    # Patches its bundled chromedriver into /app on every start, so
    # the binary is always newer than the image layer.
    - name: flaresolverr_chromedriver
      fields: [container.image.repository, proc.exepath]
      comps: [=, =]
      values:
        - [ghcr.io/flaresolverr/flaresolverr, /app/chromedriver]

# Wazuh's own file-integrity monitoring reads /etc/shadow inside its
# container -- that is the product working, not credential theft.
- rule: Read sensitive file untrusted
  override:
    exceptions: append
  exceptions:
    - name: wazuh_fim
      fields: [container.image.repository, proc.name]
      comps: [=, in]
      values:
        - [docker.io/wazuh/wazuh-manager, [wazuh-syscheckd, wazuh-modulesd]]

string

ebpf.enabled (1)