falco helm

No introduction found. Create it?

Install

Install with:

helm repo add falco oci://ghcr.io/falcosecurity/charts/falco
helm install falco falco/falco -f values.yaml

Examples

See examples from other people.

Top Repositories (2 out of 6)

NameRepoStarsVersionTimestamp
falcooscaromeu/home-ops349.2.222 days ago
falcoxunholy/k8s-gitops6449.2.27 months ago

Values

See the most popular values for this chart:

KeyTypes
driver.kind (5)
modern_ebpf
string
driver.enabled (1)
true
boolean
falcosidekick.enabled (4)
true
boolean
falcosidekick.replicaCount (4)
1
number
falcosidekick.webui.enabled (4)
true
boolean
falcosidekick.webui.replicaCount (2)
1
number
falcosidekick.webui.disableauth (1)
true
boolean
falcosidekick.webui.ingress.annotations."cert-manager.io/cluster-issuer" (1)
letsencrypt-prod
string
falcosidekick.webui.ingress.enabled (1)
true
boolean
falcosidekick.webui.ingress.hosts[].host (1)
falco.${DOMAIN}
string
falcosidekick.webui.ingress.hosts[].paths[].path (1)
/
string
falcosidekick.webui.ingress.ingressClassName (1)
nginx
string
falcosidekick.webui.ingress.tls[].hosts[] (1)
- falco.${DOMAIN}
string
falcosidekick.webui.ingress.tls[].secretName (1)
falco-${DOMAIN/./-}-tls
string
falcosidekick.resources.limits.memory (3)
256Mi
string
falcosidekick.resources.requests.cpu (3)
10m
string
falcosidekick.resources.requests.memory (3)
64Mi
string
falcosidekick.config.alertmanager.hostport (2)
http://vmalertmanager-victoria-metrics.observability.svc.cluster.local:9093
string
falcosidekick.config.alertmanager.customseveritymap (1)
emergency:critical,alert:critical,critical:critical,error:warning,warning:warning,notice:info,informational:info,debug:info
string
falcosidekick.config.alertmanager.endpoint (1)
/api/v2/alerts
string
falcosidekick.config.alertmanager.extralabels (1)
category:security,component:falco
string
falcosidekick.config.alertmanager.minimumpriority (1)
warning
string
falcosidekick.config.customfields (2)
cluster:dev
string
falcosidekick.config.debug (1)
false
boolean
falcosidekick.config.extraEnv[].name (1)
SLACK_WEBHOOKURL
string
falcosidekick.config.extraEnv[].valueFrom.secretKeyRef.key (1)
SLACK_WEBHOOKURL_MINIMUMPRIORITY_WARNING
string
falcosidekick.config.extraEnv[].valueFrom.secretKeyRef.name (1)
falcosidekick-slack
string
falcosidekick.config.slack.channel (1)
#falco-minimumpriority-warning
string
falcosidekick.config.slack.messageformat (1)
:warning: *[Falco Alert - {{ .Priority }}] [Cluster: {{ index .OutputFields "cluster" }}]* *Rule:* `{{ .Rule }}` *Details:* {{ .Output }} *Hostname:* {{ .Hostname }} *Tags:* {{ .Tags }}
string
falcosidekick.config.slack.minimumpriority (1)
warning
string
falcosidekick.config.slack.outputformat (1)
all
string
falcosidekick.config.webhook.address (1)
http://falcosidekick-critical:2801
string
falcosidekick.podAnnotations."reloader.stakater.com/auto" (1)
true
string
falcosidekick.prometheus.serviceMonitor.enabled (1)
true
boolean
falco.json_output (3)
true
boolean
falco.priority (2)
notice
string
falco.buffered_outputs (1)
true
boolean
falco.json_include_output_property (1)
true
boolean
falco.json_include_tags_property (1)
false
boolean
falco.log_level (1)
info
string
falco.log_syslog (1)
false
boolean
falco.metrics.enabled (1)
false
boolean
falco.metrics.interval (1)
15m
string
falco.rule_matching (1)
all
string
falco.rules_files[] (1)
- /etc/falco/falco_rules.yaml
- /etc/falco/rules.d
string
falco.syscall_event_drops.actions[] (1)
- log
- alert
string
falco.syscall_event_drops.max_burst (1)
1
number
falco.syscall_event_drops.rate (1)
0.03333
number
falco.syslog_output.enabled (1)
false
boolean
falcoctl.artifact.follow.enabled (3)
true
boolean
falcoctl.artifact.follow.refs[] (1)
- falco-rules:5
string
falcoctl.artifact.install.enabled (3)
true
boolean
falcoctl.artifact.install.refs[] (1)
- falco-rules:5
string
falcoctl.config.artifact.allowedTypes[] (1)
- rulesfile
string
falcoctl.config.artifact.follow.refs[] (1)
- falco-rules:4
string
falcoctl.config.artifact.install.refs[] (1)
- falco-rules:4
string
resources.limits.memory (3)
1Gi
string
resources.requests.cpu (3)
100m
string
resources.requests.memory (3)
256Mi
string
collectors.containerd.enabled (2)
true
boolean
collectors.containerd.socket (1)
/run/containerd/containerd.sock
string
collectors.crio.enabled (2)
false
boolean
collectors.docker.enabled (2)
false
boolean
collectors.kubernetes.enabled (2)
true
boolean
collectors.containerEngine.enabled (1)
true
boolean
collectors.containerEngine.engines.bpm.enabled (1)
false
boolean
collectors.containerEngine.engines.containerd.enabled (1)
false
boolean
collectors.containerEngine.engines.cri.enabled (1)
true
boolean
collectors.containerEngine.engines.cri.sockets[] (1)
- /run/containerd/containerd.sock
string
collectors.containerEngine.engines.docker.enabled (1)
false
boolean
collectors.containerEngine.engines.libvirt_lxc.enabled (1)
false
boolean
collectors.containerEngine.engines.lxc.enabled (1)
false
boolean
collectors.containerEngine.engines.podman.enabled (1)
false
boolean
collectors.enabled (1)
true
boolean
affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1)
kubernetes.io/arch
string
affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1)
In
string
affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].values[] (1)
- amd64
string
controller.annotations."reloader.stakater.com/auto" (1)
true
string
controller.kind (1)
daemonset
string
customRules."overrides.yaml" (1)
- rule: Drop and execute new binary in container override: exceptions: append exceptions: - name: cni_plugins fields: [proc.exepath] comps: [startswith] values: - [/opt/cni/bin/] - name: ci_namespaces fields: [k8s.ns.name] comps: [in] values: - [[actions-runner-system, development]] # Patches its bundled chromedriver into /app on every start, so # the binary is always newer than the image layer. - name: flaresolverr_chromedriver fields: [container.image.repository, proc.exepath] comps: [=, =] values: - [ghcr.io/flaresolverr/flaresolverr, /app/chromedriver]
string
customRules."rules-drop-execute-allowlist.yaml" (1)
# Disabled in dev because CNI and runtime activity cannot be safely distinguished from false positives. - rule: Drop and execute new binary in container enabled: false override: enabled: replace
string
customRules."rules-hermes.yaml" (1)
- rule: Shell in Hermes trusted pod desc: A shell started in a Hermes pod other than the sandbox condition: > spawned_process and container and k8s.ns.name = "hermes" and proc.name in (shell_binaries) and not k8s.pod.name startswith "sandbox-" and not container.name = "init" and proc.vpid != 1 output: > Shell in Hermes trusted pod (command=%proc.cmdline parent=%proc.pname container=%container.name pod=%k8s.pod.name ns=%k8s.ns.name) priority: NOTICE tags: [hermes, shell]
string
customRules."rules-malware.yaml" (1)
# Detect common cryptomining process execution - rule: Detect Crypto Miner Execution desc: Detects execution of known cryptomining software condition: > spawned_process and ( proc.name in (xmrig, minerd, cpuminer, ccminer, ethminer, claymore, xmr-stak) or proc.cmdline contains "stratum+tcp://" or proc.cmdline contains "stratum+ssl://" or proc.cmdline contains "monero" or proc.cmdline contains "nicehash" ) output: > Malicious crypto miner execution detected (user=%user.name user_loginuid=%user.loginuid proc=%proc.name cmdline=%proc.cmdline parent=%proc.pname container_id=%container.id container_name=%container.name image=%container.image.repository) priority: CRITICAL tags: [malware, crypto_miner, mitre_execution] # Detect reverse shells spawned from containers - rule: Reverse Shell Spawned in Container desc: Detects an outbound network connection initiated by an interactive shell process condition: > evt.type = connect and proc.name in (sh, bash, dash, ksh, zsh, ash) and container output: > Possible reverse shell initiated from container (proc=%proc.name cmdline=%proc.cmdline connection=%fd.name user=%user.name container_id=%container.id container_name=%container.name image=%container.image.repository) priority: CRITICAL tags: [malware, reverse_shell, mitre_execution] # Detect downloading and executing external script directly via pipe - rule: Download and Pipe Execution desc: Detects downloading remote scripts via curl/wget directly piped into execution shell condition: > spawned_process and ( (proc.cmdline contains "curl " or proc.cmdline contains "wget ") and (proc.cmdline contains "| sh" or proc.cmdline contains "| bash" or proc.cmdline contains "| python") ) output: > Insecure download and execution via pipe detected (proc=%proc.name cmdline=%proc.cmdline parent=%proc.pname user=%user.name container_id=%container.id container_name=%container.name) priority: WARNING tags: [malware, execution, mitre_execution] # Detect process execution from temporary directories (/tmp, /dev/shm) - rule: Execution from Suspicious Directory desc: Detects binaries executed from temporary or shared memory directories condition: > spawned_process and container and ( proc.exepath startswith "/tmp/" or proc.exepath startswith "/dev/shm/" or proc.exepath startswith "/var/tmp/" ) output: > Binary executed from temporary directory (proc=%proc.name path=%proc.exepath cmdline=%proc.cmdline container_id=%container.id container_name=%container.name) priority: WARNING tags: [malware, defense_evasion, mitre_defense_evasion] # Detect attempts to clear shell history or system logs - rule: Clear Shell History or System Logs desc: Detects attempts to clear command history or delete system audit logs condition: > spawned_process and ( proc.name in (rm, truncate) and ( proc.cmdline contains "/var/log" or proc.cmdline contains ".bash_history" or proc.cmdline contains ".ash_history" ) or proc.cmdline contains "history -c" ) output: > Log clearing or history deletion attempt detected (proc=%proc.name cmdline=%proc.cmdline parent=%proc.pname user=%user.name container_id=%container.id container_name=%container.name) priority: WARNING tags: [malware, defense_evasion, mitre_defense_evasion]
string
ebpf.enabled (1)
true
boolean
image.registry (1)
docker.io
string
image.repository (1)
falcosecurity/falco
string
image.tag (1)
0.45.2@sha256:1562a643953f938e02f47319b5214d93a235f11f646d60e9b8a516fd5a64698e
string
metrics.convertMemoryToMB (1)
true
boolean
metrics.enabled (1)
true
boolean
metrics.interval (1)
15m
string
metrics.resourceUtilizationEnabled (1)
true
boolean
metrics.rulesCountersEnabled (1)
true
boolean
podAnnotations."reloader.stakater.com/auto" (1)
true
string
podPriorityClassName (1)
high
string
serviceMonitor.create (1)
true
boolean
serviceMonitor.interval (1)
30s
string
tty (1)
true
boolean