Glossary

This glossary is intended to be a comprehensive, standardized list of Falco terminology. It includes technical terms that are specific to Falco, as well as more general terms that provide useful context.

Click on the [+] indicators below to get a longer explanation for any particular term.

• Abnormal behaviorLINK

  The behavior of an application, container, or other component considered to be suspicious.
• AlertsLINK

  Downstream actions executed after a rule is triggered.

  [+]

  They can be as simple as logging to stdout or as complex as delivering a gRPC call to a client.

  Falco supports sending alerts to:

  • Standard Output
  • A file
  • Syslog
  • A spawned program
  • An HTTP[s] endpoint
  • A client through the gRPC API
• ConditionsLINK

  Criteria to trigger an alert.

  [+]

  A key part of a rule is the condition field. A condition is a Boolean predicate expressed using the condition syntax. It is possible to express conditions on all supported events using their respective supported fields.

• Data EnrichmentLINK

  With the libsinsp Falco can enrich the events with metadata from the container engine and/or the Kubernetes control plane.
• DetectionLINK

  Identify a suspicious event or behavior.
• DriversLINK

  The global term for the software that sends events from the kernel.

  [+]

  Examples include eBPF probe or the kernel module.

• eBPFLINK

  eBPF is a technology to collect metrics and events from the kernel in a secure way.

  [+]

  eBPF is a technology that can run sandboxed programs in a privileged context, such as the operating system kernel. It is used to extend the kernel's capabilities at runtime without requiring to change kernel source code or load kernel modules. It is considered safer than kernel modules since it cannot crash your system.

  Ref: https://ebpf.io

• eBPF ProbeLINK

  The eBPF probe collects syscall events from the kernel, as the kernel module does.
• Event GeneratorLINK

  Generate a variety of suspect actions that are detected by Falco rulesets.
• ExceptionsLINK

  Exceptions are cases where the behavior detected by the rule should be allowed.
• Extractor PluginsLINK

  An extractor plugin focuses only on field extraction from events.

  [+]

  The events can be generated by other plugins or by the core libraries. It does not provide an event source but can extract fields from other event sources.

• FalcoLINK

  The name of the project and the main engine on which the rest of the project is built.

  [+]

  Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and provide real-time alerts about abnormal behaviors and potential security threats.

  At its core, Falco is a kernel monitoring and detection agent that observes events, such as syscalls, based on custom rules. Falco can enhance these events by integrating metadata from the container runtime and Kubernetes. The collected events can be analyzed off-host in SIEM or data lake systems.

  Ref: https://github.com/falcosecurity/falco

• Falco ExporterLINK

  Prometheus Metrics Exporter for Falco output events.
• FalcoctlLINK

  The official CLI tool for working with Falco and its ecosystem components.

  [+]

  Ref: https://github.com/falcosecurity/falcoctl

• Falcosdidekick-UILINK

  A simple WebUI for displaying the latest events from Falco, it works as an output for Falcosidekick.

  [+]

  Ref: https://github.com/falcosecurity/falcosidekick-ui

• FalcosidekickLINK

  Connect Falco with third parties.

  [+]

  A simple daemon for connecting Falco to an ecosystem, it takes the events and forwards them to different outputs in a fan-out way.

  Ref: https://github.com/falcosecurity/falcosidekick

• FieldsLINK

  The fields are used in the condition of a rule and in the output.

  [+]

  The fields are automatically replaced by their values in the output to have the whole context of the alerts.

• gRPCLINK

  gRPC is a modern open source, high-performance Remote Procedure Call (RPC) framework that can run in any environment.

  [+]

  It can efficiently connect services in and across data centers with pluggable support for load balancing, tracing, health checking, and authentication. It also applies in the last mile of distributed computing to connect devices, mobile applications, and browsers to backend services.

  Ref: https://grpc.io

• IntrusionLINK

  Unsolicited presence in a system.
• KernelLINK

  The kernel is the operating system's core and generally has complete control over everything in the system.

  [+]

  Ref: https://www.kernel.org/

• Kernel ModuleLINK

  Used to describe the .ko object that would be loaded into the kernel as a potentially risky kernel module.

  [+]

  This is one option used to pass kernel events up to userspace for Falco to consume. Sometimes this word is incorrectly used to refer to a probe.

• Kernel Module DriverLINK

  The Kernel module collects syscalls events from the kernel, as the eBPF Probe does.
• Kernel SpaceLINK

  The memory space where the kernel executes and provides its services.
• Kubernetes Audit LogLINK

  Audit logs from the Kubernetes control plane.

  [+]

  Kubernetes auditing provides a security-relevant, chronological set of records documenting the sequence of actions in a cluster.

• LibscapLINK

  libscap, aka library for System CAPture, is the library used by Falco to collect the events from the ring buffer before forwarding them up to libsinsp.

  [+]

  Ref: https://github.com/falcosecurity/libs

• LibsinspLINK

  libsinsp, aka library for System INSPection, receives the events from libscap and enriches them with machine states.

  [+]

  Ref: https://github.com/falcosecurity/libs

• ListsLINK

  Lists are collections of items that can be included in rules, macros, or other lists.

  [+]

  Unlike rules and macros, lists cannot be parsed as filtering expressions.

• MacrosLINK

  Macros are rule conditions snippets that can be re-used inside rules and even other macros.

  [+]

  Macros provide a way to name common patterns and factor out redundancies in rules.

• Modern eBPF ProbeLINK

  More robust eBPF probe, which brings the CO-RE paradigm, better performances, and maintainability.

  [+]

  It will replace the default eBPF probe in the future.

• MonitoringLINK

  Observing the evolution of a process over time.
• OutputsLINK

  Format of the generated alert, the fields used as keys are automatically replaced with their values.
• PluginsLINK

  A dynamic shared library (a .so file) that conforms to a documented API and allows to extend the possible inputs for Falco.

  [+]

  Ref: https://github.com/falcosecurity/plugins

• PrioritiesLINK

  Every Falco rule has a priority that indicates how serious a violation of the rule is.

  [+]

  This is similar to what we know as the severity of a syslog message. The priority is included in the message/JSON output/etc.

• ProbesLINK

  Used to describe the .o object that would be dynamically loaded into the kernel as a secure and stable eBPF probe.

  [+]

  This is one option used to pass kernel events up to userspace for Falco to consume. Sometimes this word is incorrectly used to refer to a module.

• ReactionLINK

  Action to remediate an incident.

  [+]

  Action following the detection, for example, deleting a compromised container.

• Response EngineLINK

  System of reaction to alerts built on dedicated applications, FaaS or Serverless.
• Ring BufferLINK

  The ring buffer is a memory buffer that behaves as if it had a circular shape, used for FIFO (first in, first out).

  [+]

  It uses to pass the events from the driver (kernel space) to the library libscap (user space)

• RulesLINK

  Rules are conditions under which an alert should be generated.

  [+]

  A rule is accompanied by a descriptive output string that is sent with the alert.

• Rules fileLINK

  A Falco rules file is a YAML file containing three types of elements: rules, macros, and lists.
• Runtime SecurityLINK

  Runtime security is the process of providing protection for your host, containers, and applications while they’re running.
• Source PluginsLINK

  A source plugin provides a new event source.

  [+]

  It has the ability to "open" and "close" a session that provides events. A source plugin can also be an extractor.

• SyscallsLINK

  Syscalls stands for system calls, a way to request a service from the running kernel.

  [+]

  Syscalls are used by the applications to make requests from user space to the Linux kernel to access the resources (CPU, memory, disk, network, etc.).

  Ref: https://man7.org/linux/man-pages/man2/syscalls.2.html

• TagsLINK

  Labels that can be attached to the rules, allow to select the subset of rules to enable.
• TracingLINK

  Following the path of a request through several components and/or applications.
• User SpaceLINK

  The memory space where all user actions and applications are executed.