Project: Falco (Provisioning / Security & Compliance)
File: CHANGELOG.md

Released on 2024-02-13 new(docker): added option for insecure http driver download to falco and driver-loader images ] - update(cmake): bumped falcoctl to v0.7.2 ] - update(build): link libelf dynamically ] - fix(userspace/engine): always consider all rules (even the ones below minprio) in mrulestatsmanager ] - Added http headers option for driver download in docker images ] - fix(build): install libstdc++ in the Wolfi image ] - Released on 2024-01-30 The deprecated `rate-limiter` mechanism is removed as it is no longer used. the deprecated `outputs.rate` Falco config is removed. the deprecated `outputs.max_burst` Falco config is removed. The deprecated `--userspace` CLI option is removed as it is no longer used. The `falco-driver-loader` script will be removed and embedded into falcoctl. The new falcoctl driven implementation will drop: `--source-only` CLI option. `BPFUSELOCALKERNELSOURCES` environment variable. `DRIVERCURLOPTIONS` environment variable. `FALCOBPFPROBE` environment variable is not used by the new falcoctl driver loader, since it is already deprecated and will be removed in the next major version. Some env vars were renamed: `DRIVERSREPO` env variable has been replaced by `FALCOCTLDRIVER_NAME` or `--name` command line argument for `falcoctl driver` command `DRIVERSNAME` env variable has been replaced by `FALCOCTLDRIVER_REPOS`, or `--repo` command line argument for `falcoctl driver` command `DRIVERKERNELRELEASE` env variable has been replaced by `--kernelrelease` command line argument for `falcoctl driver install` command `DRIVERKERNELVERSION` env variable has been replaced by `--kernelversion` command line argument for `falcoctl driver install` command `DRIVERINSECUREDOWNLOAD` env variable has been replaced by `--http-insecure` command line argument for `falcoctl driver install` command Remove `-K/-k` options from Falco in favor of the new `k8smeta` plugin. Drop plugins shipped with Falco since plugins are now be managed by falcoctl. Falco 0.37.0 allows environment variables to be expanded even if they are part of a string. This introduces small breaking changes: Previously, environment variables used in YAML that were empty or defined as `` would be expanded to the default value. This was not consistent with the way YAML was handled in other cases, where we only returned the default values if the node was not defined. Now expanded env vars retain the same behavior of all other variables. Falco 0.37.0 will return default value for nodes that cannot be parsed to chosen type. `program_output` command will be env-expanded at init time, instead of letting `popen` and thus the `sh` shell expand it. This is technically a breaking change even if no behavioral change is expected. Also, you can avoid env var expansion by using `${{FOO}}` instead of `${FOO}`. It will resolve to `${FOO}` and won't be resolved to the env var value. new!: dropped falco-driver-loader script in favor of new falcoctl driver command ] - update!: bump libs to latest and deprecation of k8s metadata options and configs ] - cleanup(falco)!: remove `outputs.rate` and `outputs.max_burst` from Falco config ] - cleanup(falco)!: remove `--userspace` support ] - new(engine): add selective overrides for Falco rules ] - feat(userspace/falco): falco administrators can now configure the http output to compress the data sent as well as enable keep alive for the connection. Two new fields (compressuploads and keepalive) in the http_output block of the `falco.yaml` file can be used for that purpose. Both are disabled by default. ] - new(userspace): support env variable expansion in all yaml, even inside strings. ] - new(scripts): add a way to enforce driver kind and falcoctl enablement when installing Falco from packages and dialog is not present. ] - new(falco): print system info when Falco starts ] - new: driver selection in

] - new(build): enable compilation on win32 and macOS. ] - feat(userspace/falco): falco administrators can now configure the address on which the webserver listen using the new listen_address field in the webserver block of the `falco.yaml` file. ] - update(userspace/falco): add `engineversionsemver` key in `/versions` endpoint ] - update: default ruleset upgrade to version 3.0 ] - update!(config): soft deprecation of drop stats counters in `syscalleventdrops` ] - update(cmake): bumped falcoctl tool to v0.7.1. ] - update(rule_loader): deprecate the `append` flag in Falco rules ] - cleanup!(cmake): drop bundled plugins in Falco ] - update(config): clarify deprecation notices + list all env vars ] - update: now the `watchconfigfiles` config option monitors file/directory moving and deletion, too ] - update(userspace): enhancements in rule description feature ] - update(userspace/falco): add libsinsp state metrics option ] - update(doc): Add Thought Machine as adopters ] - update(docs): add Wireshark/Logray as adopter ] - update: engine_version in semver representation ] - update(userspace/engine): modularize rule compiler, fix and enrich rule descriptions ] - fix(userspace/metric): minor fixes in new libsinsp state metrics handling ] - fix(userspace/engine): avoid storing escaped strings in engine defs ] - fix(userspace/engine): cache latest rules compilation output ] - fix(userspace/engine): solve description of macro-only rules ] - fix(userspace/engine): fix memory leak ] - fix: nlohmann_json lib include path ] - chore: bump falco rules ] - chore: bump Falco to libs 0.14.1 ] - chore(build): remove outdated development libs ] - chore(falco): bump Falco to `000d576` libs commit ] - fix(gha): update rpmsign ] - build(deps): Bump submodules/falcosecurity-rules from `424b258` to `1221b9e` ] - build(deps): Bump submodules/falcosecurity-rules from `2ac430b` to `c39d31a` ] - cleanup(falco.yaml): rename `none` in `nodriver` ] - update(config): graduate outputs_queue to stable ] - update(cmake): bump falcoctl to v0.7.0. ] - build(deps): Bump submodules/falcosecurity-rules from `1221b9e` to `2ac430b` ] - chore(ci): bumped rn2md to latest master. ] - chore: bump Falco to latest libs ] - chore: bump driver version ] - Add addl source related methods ] - build(deps): Bump submodules/falcosecurity-rules from `cd33bc3` to `424b258` ] - cleanup(engine): clarify deprecation notice for engines ] - update(cmake): bumped falcoctl to v0.7.0-rc1. ] - chore(ci): revert #2961. ] - build(deps): Bump submodules/falcosecurity-testing from `930170b` to `9b9630e` ] - chore: bump Falco to latest libs ] - build(deps): Bump submodules/falcosecurity-rules from `262f569` to `cd33bc3` ] - Allow enabling rules by ruleset id in addition to name ] - chore(ci): enable aarch64 falco driver loader tests. ] - chore(unit_tests): added more tests for yaml env vars expansion. ] - chore(falco.yaml): use HOME env var for ebpf probe path. ] - chore: bump falco to latest libs ] - build(deps): Bump submodules/falcosecurity-rules from `dd38952` to `262f569` ] - update(readme): add actuated.dev badge ] - chore(cmake,docker): bumped falcoctl to v0.7.0-beta5. ] - build(deps): Bump submodules/falcosecurity-rules from `64e2adb` to `dd38952` ] - fix(docker): small fixes in docker entrypoints for new driver loader. ] - chore(build): allow usage of non-bundled nlohmann-json ] - update(ci): enable actuated.dev ] - cleanup: fix several warnings from a Clang build ] - chore(docker/falco): add back some deps to falco docker

] - build(deps): Bump submodules/falcosecurity-testing from `92c313f` to `5248e6d` ] - build(deps): Bump submodules/falcosecurity-rules from `e206c1a` to `8f0520f` ] - cleanup(falco): remove decode_uri as it is no longer used ] - update(engine): port decode_uri in falco engine ] - chore(falco): update to libs on nov 28th ] - cleanup(falco): remove `init` in the configuration constructor ] - build(deps): Bump submodules/falcosecurity-rules from `8f0520f` to `64e2adb` ] - cleanup(userspace/engine): remove legacy k8saudit implementation ] - fix(gha): disable branch protection rule trigger for scorecard ] - chore(gha): set cosign-installer to v3.1.2 ] - new(docs): sync changelog for 0.36.2. ] - Run OpenSSF Scorecard in pipeline ] - cleanup: replace banned.h with semgrep ] - chore(gha): upgrade GitHub actions ] - build(deps): Bump submodules/falcosecurity-rules from `a22d0d7` to `e206c1a` ] - build(deps): Bump submodules/falcosecurity-rules from `d119706` to `a22d0d7` ] - fix(gha): use fedora instead of centos 7 for package publishing ] - chore(gha): pin versions to hashes ] - build(deps): Bump submodules/falcosecurity-rules from `c366d5b` to `d119706` ] - new(ci): properly link libs and driver releases linked to a Falco release ] - build(deps): Bump submodules/falcosecurity-rules from `7a7cf24` to `c366d5b` ] - build(deps): Bump submodules/falcosecurity-rules from `77ba57a` to `7a7cf24` ] - chore(ci): bumped rn2md to latest master. ] - Released on 2023-10-27 NO CHANGES IN FALCO, ALL CHANGES IN LIBS. Released on 2023-10-16 feat(userspace): remove experimental outputs queue recovery strategies ] - fix(userspace/falco): timer_delete() workaround due to bug in older GLIBC ] - Released on 2023-09-26 The default rules file that is shipped in the Falco image and/or can be downloaded via falcoctl as `falco-rules` is now a stable rule file. This file contains a much smaller number of rules that are less noisy and have been vetted by the community. This serves as a much requested "starter" Falco rule set that covers many common use case. The rest of that file has been expanded and split into `falco-incubating-rules` and `falco-sandbox-rules`. For more information, see the The main `falcosecurity/falco` container image and its `falco-driver-loader` counterpart have been upgraded. Now they are able to compile the kernel module or classic eBPF probe for relatively newer version of the kernel (5.x and above) while we no longer ship toolchains to compile the kernel module for older versions in the default images. Downloading of prebuilt drivers and the modern eBPF will work exactly like before. The older image, meant for compatibility with older kernels (4.x and below), is currently retained as `falcosecurity/falco-driver-loader-legacy`. The Falco HTTP output no longer logs to stdout by default for performance reasons. You can set stdout logging preferences and restore the previous behavior with the configuration option `http_output.echo` in `falco.yaml`. The `--list-syscall-events` command line option has been replaced by `--list-events` which prints all supported system events (syscall, tracepoints, metaevents, internal plugin events) in addition to extra information about flags. The semantics of `proc.exepath` have changed. Now that field contains the executable path on disk even if the binary was launched from a symbolic link. The `-d` daemonize option has been removed. The `-p` option is now changed: when only `-pc` is set Falco will print `containerid=%container.id containerimage=%container.image.repository containerimagetag=%container.image.tag container_name=%container.name` when `-pk` is set it will print as above, but with `k8sns=%k8s.ns.name k8spod_name=%k8s.pod.name` appended new(falco-driver-loader): --source-only now prints the values as env vars ] - new(docker): allow passing options to falco-driver-loader from the driver loader container ] - new(docker): add experimental falco-distroless image based on Wolfi ] - new: the legacy falco image is available as driver-loader-legacy ] - new: added option to enable/disable echoing of server answer to stdout (disabled by default) when using HTTP output ] - new: support systemctl reload for Falco services ] - new(falco/config): add new configurations for http_output that allow mTLS ] - new: allow falco to match multiple rules on same event ] - update(cmake): bumped bundled falcoctl to 0.6.2 ] - update(rules)!: major rule update to version

] - update(cmake): bumped plugins to latest stable versions ] - update(cmake): bumped libs to 0.13.0-rc2 and driver to 6.0.1+driver ] - update!: default substitution for `%container.info` is now equal `containerid=%container.id containername=%container.name` ] - update!: the --list-syscall-events flag is now called --list-events and lists all events ] - update!: the Falco base image is now based on Debian 12 with gcc 11-12 ] - update(docker): the Falco no-driver image is now based on Debian 12 ] - feat(userspace)!: remove `-d` daemonize option ] - build(deps): Bump submodules/falcosecurity-rules from 3f52480 to 0d0e333 ] - build(deps): Bump submodules/falcosecurity-rules from 3f52480 to b42893a ] - build(deps): Bump submodules/falcosecurity-rules from b42893a to 6ed73fe ] - update(cmake): bumped libs to 0.13.0-rc1 and driver to 6.0.0+driver. ] - feat: support parsing of system environment variables in yaml ] - feat(userspace)!: deprecate stats command args option in favor of metrics configs in falco.yaml ] - update: upgrade `falcoctl` to version 0.6.0 ] - cleanup: deprecate rate limiter mechanism ] - cleanup(config): add more info ] - update(userspace/engine): improve skip-if-unknown-filter YAML field ] - chore: improved HTTP output performance ] - update!: HTTP output will no more echo to stdout by default ] - chore: remove b64 from falco dependencies ] - update(cmake): support building libs and driver from forks ] - update: `-p` presets have been updated to reflect the new rules style guide ] - feat: Allow specifying explicit kernel release and version for falco-driver-loader ] - cleanup(config): assign Stable to `base_syscalls` config ] - update : support build for wasm ] - docs(config.yaml): fix wrong severity levels for sinsp logger ] - update(cmake): bump libs and driver to 0.12.0 ] - update(docker): remove experimental image based on RedHat UBI ] - fix(outputs): expose queuecapacityoutputs config for memory control ] - fix(userspace/falco): cleanup metrics timer upon leaving. ] - fix: restore Falco MINIMAL_BUILD and deprecate `userspace` option ] - fix(userspace/engine): support appending to unknown sources ] - build(deps): Bump submodules/falcosecurity-rules from `69c9be8` to `77ba57a` ] - chore: bump submodule testing to 62edc65 ] - update(gha): add version for rn2md ] - chore: automatically attach release author to release body. ] - new(ci): autogenerate release body. ] - fix(dockerfile): remove useless CMD ] - chore: bump to the latest libs ] - update: add SPDX license identifier ] - chore: bump to latest libs ] - build(deps): Bump submodules/falcosecurity-rules from `ee5fb38` to `bea364e` ] - fix(build): set the right bucket and version for driver legacy ] - build(deps): Bump submodules/falcosecurity-rules from `43580b4` to `ee5fb38` ] - cleanup(userspace): thrown exceptions and avoid multiple logs ] - build(deps): Bump submodules/falcosecurity-rules from `c6e01fa` to `43580b4` ] - build(deps): Bump submodules/falcosecurity-testing from `76d1743` to `30c3643` ] - fix(userspace/falco): clearing full output queue ] - update(docs): add driver-loader-legacy to readme and fix bad c&p ] - build(deps): Bump submodules/falcosecurity-rules from `d31dbc2` to `c6e01fa` ] - docs: add LICENSE file ] - build(deps): Bump submodules/falcosecurity-rules from `b6372d2` to `d31dbc2` ] - fix(stats): always initialize m_output field ] - build(deps): Bump submodules/falcosecurity-rules from `6ed73fe` to `b6372d2` ] - update(cmake/modules): bump rules to falco-rules-2.0.0-rc1 ] - update(OWNERS): add LucaGuerra to owners ] - build(deps): Bump submodules/falcosecurity-rules from `9126bef` to `0328c59` ] - build(deps): Bump submodules/falcosecurity-rules from `0d0e333` to `64ce419` ] - build(deps): Bump submodules/falcosecurity-rules from `3ceea88` to `40a9817` ] - docs(README.md): correct URL ]

#2393 Document why Falco is written in C++ rather than anything else ] - chore: bump Falco to latest libs ] - ci: disable falco-driver-loader tests on ARM64 ] - update(userspace/falco): revised CLI help messages ] - fix(engine): fix reorder warning for mwatchconfigfiles / mrule_matching ] - update: introduce new stats updated to the latest libs version ] - ci: support tests on amazon-linux ] - chore: bump Falco to latest libs master ] - build(deps): Bump submodules/falcosecurity-testing from `b39c807` to `9110022` ] - fix: fix "ebpf_enabled" output stat ] - fix(userspace/engine): support both old and new gcc + std::move ] - cleanup: turn some warnings into errors ] - update(ci): minimize retention days for build-only CI artifacts ] - cleanup: remove unused `--pidfile` option from systemd units ] - build(deps): Bump submodules/falcosecurity-rules from `bf1639a` to `3ceea88` ] - build(deps): Bump submodules/falcosecurity-rules from `64ce419` to `bf1639a` ] - Relocate tools on Flatcar in BPF mode ] - build: update versioning with cmake ] - update(userspace/engine): make rule_matching strategy stateless ] - chore: bump Falco to latest libs version ] - update: enforce bumping engine version whenever appropriate ] - Released on 2023-06-29 update(userspace): change description of snaplen option stating only performance implications ] - update(cmake): bump libs to 0.11.3 ] - cleanup(config): minor config clarifications ] - update(cmake): bump falco rules to v1.0.1 ] - chore(userspace/falco): make source matching error more expressive ] - update(.github): integrate Go regression tests ] - fix(scripts): fixed falco-driver-loader to manage debian kernel rt and cloud flavors. ] - fix(userspace/falco): solve live multi-source issues when loading more than two sources ] - fix(driver-loader): fix ubuntu kernel version parsing ] - fix(userspace): switch to timer_settime API for stats writer. ] - CI: bump ubuntu version for tests-driver-loader-integration job ] - Released on 2023-06-07 BREAKING CHANGE: support for metadata enrichment from Mesos has been removed. ] - new(falco): introduce new metrics w/ Falco internal: metrics snapshot option and new metrics config ] - new(scripts): properly manage talos prebuilt drivers ] - new(release): released container images are now signed with cosign ] - new(ci): ported master and release artifacts publishing CI to gha ] - new(appactions): introduce basesyscalls user option ] - new(falco/config): add new configurations for http_output that allow custom CA certificates and stores. ] - new(userspace): add a new `syscalldropfailed` config option to drop failed syscalls exit events ] - update(cmake): bump Falco rules to 1.0.0 ] - update(cmake): bump libs to 0.11.1 ] - update(cmake): bump plugins to latest versions ] - update(cmake): bump falco rules to 1.0.0-rc1 ] - update(cmake): bump libs to 0.11.0 ] - cleanup(docs): update release.md ] - update(cmake): bump libs to 0.11.0-rc5 and driver to 5.0.1. ] - cleanup(docs): adjust falco readme style and content ] - cleanup(userspace, config): improve metrics UX, add includeemptyvalues option ] - feat: add the curl and jq packages to the falco-no-driver docker image ] - update: add missing exception, requiredengineversion, requiredpluginversion to -L json output ] - feat: add image source OCI label to docker images ] - cleanup(config): improve falco config ] - update(cmake): bump libs and plugins to latest dev versions ] - chore(userspace/falco): always print invalid syscalls from custom set ] - update(build): upgrade falcoctl to 0.5.0 ] - chore(userspace/falco/app): print all supported plugin caps ] - update: get rules details with `-l` or `-L` flags when json output format is specified ] - update!: bump libs version, and support latest plugin features, add --nodriver option ] - cleanup(actions): now modern bpf support `-A` flag ] - update: `falco-driver-loader` now uses now uses $TMPDIR if set ] - update: improve control and UX of ignored events ] - update: bump libs and adapt Falco to new libsinsp event source management ] - new(appactions)!: adjust basesyscalls option, add

] - update(scripts): support al2022 and al2023 in falco-driver-loader. ] - update: sync libs with newest event name APIs ] - update!: remove `--mesos-api`, `-pmesos`, and `-pm` command-line flags ] - cleanup(unittests): try making testconfigureinterestingsets more robust ] - fix: unquote quoted URL's to avoid libcurl errors ] - fix(userspace/engine): store alternatives as array in -L json output ] - fix(userspace/engine): store required engine version as string in -L json output ] - fix(userspace/falco): report plugin deps rules issues in any case ] - fix(userspace): hotreload on wrong metrics ] - fix(userspace): check the supported number of online CPUs with modern bpf ] - fix(userspace/falco): don't hang on terminating error when multi sourcing ] - fix(userspace/falco): properly format numeric values in metrics ] - fix(scripts): properly support debian kernel releases embedded in kernel version ] - docs(README.md): add scope/status badge and simply doc structure ] - build(deps): Bump submodules/falcosecurity-rules from `3471984` to `16fb709` ] - docs(proposals): Falco roadmap management ] - build(deps): Bump submodules/falcosecurity-rules from `b2290ad` to `3471984` ] - update(build): libs 0.11.0-rc2 ] - build(deps): Bump submodules/falcosecurity-rules from `3f52480` to `b2290ad` ] - update(ci): use repo instead of master branch for reusable workflows ] - cleanup(ci): cleaned up circleci workflow. ] - build(deps): Bump requests from 2.26.0 to 2.31.0 in /test ] - fix(ci): simplify and fix multi-arch image publishing process ] - fix(ci): get the manifest for the correct tag ] - build(deps): Bump submodules/falcosecurity-rules from `3f52480` to `6da15ae` ] - fix(ci): properly use `docker save` to store images. ] - fix(ci): docker arg is named `TARGETARCH`. ] - fix(ci): set docker TARGET_ARCH ] - fix(ci): use normal docker to build docker images, instead of buildx. ] - docs: improve documentation and description of base_syscalls option ] - Updating Falco branding guidelines ] - build(deps): Bump submodules/falcosecurity-rules from `f773578` to `6da15ae` ] - fix(cmake): properly exclude prereleases when fetching latest tag from cmake ] - fix(ci): load falco image before building falco-driver-loader ] - fix(ci): correctly tag slim manifest ] - cleanup(config): modern bpf is no more experimental ] - new(ci): add RC/prerelease support ] - fix(ci): configure ECR public region ] - fix(ci): falco images directory, ecr login ] - fix(ci): separate rpm/bin/bin-static/deb packages before publication, rename bin-static ] - fix(ci): add Cloudfront Distribution ID ] - fix(ci): escape heredoc ] - chore(ci): build-musl-package does not need to wait for build-packages anymore ] - fix: ci Falco version ] - fix(ci): fetch version step, download rpms/debs, minor change ] - chore(ci): properly install recent version of git (needed >= 2.18 by checkout action) ] - fix(ci): enable toolset before every make command ] - fix(ci): remove unnecessary mv ] - fix(ci): bucket -> bucket_suffix ] - build(deps): Bump submodules/falcosecurity-rules from `5857874` to `1bd7e4a` ] - build(deps): Bump submodules/falcosecurity-rules from `694adf5` to `5857874` ] - cleanup(ci): properly set a concurrency for CI workflows. ] - build(deps): Bump submodules/falcosecurity-rules from `e0646a0` to `694adf5` ] - build(deps): Bump submodules/falcosecurity-rules from `0b0f50f` to `e0646a0` ] - Released on 2023-02-20 fix(userspace/engine): correctly bump FALCOENGINEVERSION after introduction of new fields ] - fix(dockerfile/no-driver): install ca-certificates ] - Released on 2023-02-07 BREAKING CHANGE: if you relied upon `application_rules.yaml` you can download it from https://github.com/falcosecurity/rules/tree/main/rules and manually install it. ] - new(rules): New rule to detect attempts to inject code into a process using PTRACE ] - new(engine): Also include exact locations for rule condition compile errors (missing macros,

] - new(scripts): Support older RHEL distros in falco-driver-loader script ] - new(scripts): add `falcoctl` config into Falco package ] - new(userspace/falco): ] - new(userspace/falco): add webserver endpoint for retrieving internal version numbers ] - new(falco): add --version-json to print version information in json format ] - new(scripts): support multiple drivers in systemd units ] - new(scripts): add bottlerocket support in falco-driver-loader ] - new(falco): add more version fields to --support and --version ] - new(config): explicitly add the `simulate_drops` config ] - build: upgrade to `falcoctl` v0.4.0 ] - update(userspace): change `modernbpf.cpusforeachsyscall_buffer` default value ] - update(build): update falcoctl to 0.3.0 ] - update(build): update falcoctl to 0.3.0-rc7 ] - update(cmake): bump libs to 0.10.3 ] - build: `/etc/falco/rules.available` has been deprecated ] - build: `application_rules.yaml` is not shipped anymore with Falco ] - build: upgrade k8saudit plugin to v0.5.0 ] - build: upgrade cloudtrail plugin to v0.6.0 ] - new!: ship falcoctl inside Falco ] - refactor: remove rules and add submodule to falcosecurity/rules ] - update(scripts): add option for regenerating signatures of all dev and release packages ] - update: print JSON version output when json_output is enabled ] - update(cmake): updated libs to 0.10.1 tag. ] - Install the certificates of authorities in falco:no-driver docker image ] - update: Mesos support is now deprecated and will be removed in the next version. ] - update(scripts/falco-driver-loader): optimize the resiliency of module download script for air-gapped environments ] - doc(userspace): provide users with a correct message when some syscalls are not defined ] - update(ci): update ci jobs to generate Falco images with the modern BPF probe ] - rules: add Falco container lists ] - rules(macro: privatekeyor_password): now also check for OpenSSH private keys ] - update(cmake): bump libs and driver to latest RC. ] - Ensure that a ruleset object is copied properly in falcoengine::addsource(). ] - update(userspace/falco): enable using zlib with webserver ] - update(falco): add container-gvisor and kubernetes-gvisor print options ] - cleanup: always use bundled libz and libelf in BUNDLED_DEPS mode. ] - update: updated libs and driver to version dd443b67c6b04464cb8ee2771af8ada8777e7fac ] - update(falco.yaml): `open_params` under plugins configuration is now trimmed from surrounding whitespace ] - fix(engine): Avoid crash related to caching syscall source when the falco engine uses multiple sources at the same time. ] - fix(scripts): use falco-driver-loader only into install scripts ] - fix(userspace/falco): fix grpc server shutdown ] - fix(docker/falco): trust latest GPG key ] - fix(userspace/engine): improve rule loading validation results ] - fix: graceful error handling for macros/lists reference loops ] - rules(tagging): enhanced rules tagging for inventory / threat modeling ] - rule(Outbound Connection to C2 Server): Update the "Outbound connection to C2 server" rule to match both FQDN and IP addresses. Prior to this change, the rule only matched IP addresses and not FQDN. ] - rule(Execution from /dev/shm): new rule to detect execution from /dev/shm ] - rule(Find AWS Credentials): new rule to detect executions looking for AWS credentials ] - rule(Linux Kernel Module Injection Detected): improve insmod detection within container using CAPSYSMODULE ] - rule(Read sensitive file untrusted): let salt-call read sensitive files ] - rule(macro: rpm_procs): let salt-call write to rpm database ] - fix(ci): fix rpm sign job dependencies ] - chore(userspace): add `njson` lib as a dependency for `falco_engine` ] - fix(scripts): force rpm postinstall script to always show dialog, even on upgrade ] - fix(scripts): fixed falcoctl config install

] - fix(scripts): make /usr writable ] - fix(scripts): driver loader insmod ] - update(systemd): solve some issues with systemd unit ] - build(cmake): upgrade falcoctl to v0.3.0-rc6 ] - docs(.github): rules are no longer in this repo ] - update(CI): mitigate frequent failure in CircleCI jobs ] - fix(userspace): use the right path for the `cpusforeachsyscallbuffer` config ] - fix(scripts): fixed incorrect bash var expansion ] - update(CI): upgrade toolchain in modern falco builder dockerfile ] - cleanup(ci): move static analysis job from circle CI to GHA ] - update(falco): update cpp-httplib to 0.11.3 ] - update(script): makes user able to pass custom option to driver-loade ] - cleanup(ci): remove some unused jobs and remove some `falco-builder` reference where possible ] - docs(proposal): new artifacts distribution proposal ] - fix(cmake): properly fetch dev version by appending latest Falco tag, delta between master and tag, and hash ] - chore(deps): Bump certifi from 2020.4.5.1 to 2022.12.7 in /test ] - chore: remove string view lite ] - new(CHANGELOG): add entry for 0.33.1 (in master branch this time) ] - update(docs): add overview and versioning sections to falco release.md ] - Add Xenit AB to adopters ] - fix(userspace/falco): verify engine fields only for syscalls ] - fix(output): do not print syscallbuffersize when gvisor is enabled ] - fix(engine): fix warning about redundant std::move ] - fix(scripts): force falco-driver-loader script to try to compile the driver anyway even on unsupported platforms ] - fix(ci): fixed version bucket for release jobs. ] - Released on 2022-11-24 update(falco): fix container-gvisor and kubernetes-gvisor print options ] Update libs to 0.9.2, fixing potential CLBO on gVisor+Kubernetes and crash with eBPF when some CPUs are offline ] - Released on 2022-10-19 new: add a `drop_pct` referred to the global number of events ] - new: print some info about eBPF and enabled sources when Falco starts ] - new(userspace): print architecture information ] - new(CI): add CodeQL security scanning to Falco. ] - new: configure syscall buffer dimension from Falco ] - new(cmdline): add development support for modern BPF probe ] - new(falco-driver-loader): `DRIVERS_REPO` now supports the use of multiple download URLs (comma separated) ] - new(userspace/engine): support alternative plugin version requirements in checks ] - new: support running multiple event sources in parallel ] - new(userspace/falco): automatically create paths for grpc unix socket and gvisor endpoint. ] - new(scripts): allow falco-driver-loader to properly distinguish any ubuntu flavor ] - new: add option to enable event sources selectively ] - docs(falco-driver-loader): add some comments in `falco-driver-loader` ] - update(cmake): use latest libs tag `0.9.0` ] - update(.circleci): re-enabled cppcheck ] - update(userspace/engine): improve falco files loading performance ] - update(cmake): use latest driver tag 3.0.1+driver ] - update(userspace/falco)!: adapt stats writer for multiple parallel event sources ] - refactor(userspace/engine): remove falco engine APIs that returned a requiredengineversion ] - update(userspace/engine): add some small changes to rules matching that reduce cpu usage with high event volumes (> 1M syscalls/sec) ] - rules: added process IDs to default rules ] - update(scripts/debian): falco.service systemd unit is now cleaned-up during (re)install and removal via the DEB and RPM packages ] - update(userspace/falco): move on from deprecated libs API for printing event list ] - chore(userspace/falco): improve cli helper and log options with debug level ] - update(userspace): minor pre-release improvements ] - update: bumped libs to fd46dd139a8e35692a7d40ab2f0ed2016df827cf. ] - update!: gVisor sock default path changed from `/tmp/gvisor.sock` to `/run/falco/gvisor.sock` ] - update!: gRPC server sock default path changed from `/run/falco.sock.sock` to `/run/falco/falco.sock` ] - update(scripts/falco-driver-loader): minikube environment is now correctly detected ] -

`requiredengine_version` changed to 13 ] - refactor(userspace/falco): re-design stats writer and make it thread-safe ] - refactor(userspace/falco): make signal handlers thread safe ] - refactor(userspace/engine): strengthen and document thread-safety guarantees of falcoengine::processevent ] - update(userspace/falco): make webserver threadiness configurable ] - refactor(userspace/falco): reduce app actions dependency on app state and inspector ] - update(userspace/falco): use move semantics in falco logger ] - update: use `FALCO_HOSTNAME` env var to override the hostname value ] - update: bump libs and driver versions to 6599e2efebce30a95f27739d655d53f0d5f686e4 ] - refactor(userspace/falco): make output rate limiter optional and output engine explicitly thread-safe ] - update(falco.yaml)!: notification rate limiter disabled by

] - fix: compute the `drop ratio` in the right way ] - fix(falco_service): falco service needs to write under /sys/module/falco ] - fix(userspace): cleanup output of ruleset validation result ] - fix(userspace): properly print ignored syscalls messages when not in `-A` mode ] - fix(falco): clarify pid/tid and container info in gvisor ] - fix(userspace/engine): avoid reading duplicate exception values ] - fix: hostname was not present when `json_output: true` ] - rule(macro: knowngkemountinprivileged_containers): add new macro ] - rule(Mount Launched in Privileged Container): add GKE default pod into allowlist in Mount Launched of Privileged Container rule ] - rule(list: knownbinariestoreadenvironmentvariablesfromprocfiles): add new list ] - rule(Read environment variable from /proc files): add rule to detect an attempt to read process environment variables from /proc files ] - rule(macro: k8s_containers): add falco no-driver images ] - rule(macro: openfilefailed): add new macro ] - rule(macro: directory_traversal): add new macro ] - rule(Directory traversal monitored file read): add new rule ] - rule(Modify Container Entrypoint): new rule created to detect CVE-2019-5736 ] - rule(Program run with disallowed http proxy env)!: disabled by default ] - rule(Container Drift Detected (chmod))!: disabled by default ] - rule(Container Drift Detected (open+create))!: disabled by default ] - rule(Packet socket created in container)!: removed considerpacketsocket_communication macro ] - rule(macro: considerpacketsocket_communication)!: remove unused macro ] - rule(Interpreted procs outbound network activity)!: disabled by default ] - rule(Interpreted procs inbound network activity)!: disabled by default ] - rule(Contact cloud metadata service from container)!: disabled by default ] - rule(macro: considerinterpretedoutbound)!: remove unused macro ] - rule(macro: considerinterpretedinbound)!: remove unused macro ] - rule(macro: considermetadataaccess)!: remove unused macro ] - rule(Unexpected outbound connection destination)!: disabled by default ] - rule(Unexpected inbound connection source)!: disabled by default ] - rule(Read Shell Configuration File)!: disabled by default ] - rule(Schedule Cron Jobs)!: disabled by default ] - rule(Launch Suspicious Network Tool on Host)!: disabled by default ] - rule(Create Hidden Files or Directories)!: disabled by default ] - rule(Outbound or Inbound Traffic not to Authorized Server Process and Port)!: disabled by default ] - rule(Network Connection outside Local Subnet)!: disabled by default ] - rule(macro: consideralloutbound_conns)!: remove unused macro ] - rule(macro: considerallinbound_conns)!: remove unused macro ] - rule(macro: considershellconfig_reads)!: remove unused macro ] - rule(macro: considerallcron_jobs)!: remove unused macro ] - rule(macro: considerallinbound_conns)!: remove unused macro ] - rule(macro: considerhiddenfile_creation)!: remove unused macro ] - rule(macro: allowed_port)!: remove unused macro ] - rule(macro: enabledrulenetworkonlysubnet)!: remove unused macro ] - rule(macro: consideruserfaultfdactivities)!: remove unused macro ] - rule(macro: considerallchmods)!: remove unused macro ] - rule(Set Setuid or Setgid bit)!: removed considerallchmods macro ] - rule(Container Drift Detected (chmod))!: removed considerallchmods macro ] - rule(Unprivileged Delegation of Page Faults Handling to a Userspace Process)!: removed consideruserfaultfdactivities macro ] - new(userspace): support `SCAPFILTEREDEVENT` return code ] - chore(test/utils): remove unused script ] - Enrich pull request template ] - vote: update(OWNERS): add Andrea Terzolo to owners ] - fix(CI): codespell should ignore `ro` word ] - chore: bump plugin version ] - fix(userspace/falco): avoid using CPU when main thread waits for parallel event sources ] - fix(scripts): inject kmod script fails with some systemd versions ] - chore(userspace/falco): make logging optional when terminating, restarting, and reopening outputs ] - chore: bump libs version ] - update(userspace): solve warnings and performance tips from cppcheck ] - fix(userspace/falco): make signal termination more robust with multi-threading ] - fix(userspace/falco): make termination and signal handlers more stable ] - fix(userspace): safely check string bounded access ] - chore: bump libs/driver to the latest release branch commit ] - fix(userspace/falco): check plugin requirements when validating rule files ] - fix(userspace): add explicit constructors and initializations ] - Add StackRox to adopters ] - fix(processevents): check the return value of `openlive_inspector` ] - fix(userspace/engine): properly include stdexcept header to fix build. ] - refactor(userspace/engine): split rule loader classes for a more testable design ] - chore(OWNERS): cleanup inactive reviewer ] - fix(circleci): falco-driver-loader image build must be done starting from just-pushed falco master image. ] - Support condition parse errors in rule loading results ] - docs: readme update ] - cleanup: rename legacy references ] - refactor(userspace/engine): increase const coherence in falco engine ] - Rules result handle multiple files ] - fix: print full rule load errors/warnings without verbose/-v ] - Released on 2022-08-09 fix: Added ARCH to bpf download URL ] - Released on 2022-07-11 new(falco): add gVisor support ] - new(docker,scripts): add multiarch images and ARM64 packages ] - update(build): Switch from RSA/SHA1 to RSA/SHA256 signature in the RPM package ] - refactor(userspace/engine): drop macro source field in rules and rule loader ] - build: introduce `DRIVER_VERSION` that allows setting a driver version (which may differ from the falcosecurity/libs version) ] - update: add more info to `--version` output ] - build(scripts): publish deb repo has now a InRelease file ] - update(userspace/falco): make plugin init config optional and add --plugin-info CLI option ] - update(userspace/falco): support libs logging ] - update(falco): update libs to 0.7.0 ] - fix(userspace/falco): ensure that only rules files named with `-V` are loaded when validating rules files. ] - fix(rules): use exit event in reverse shell detection rule ] - fix(scripts): falco-driver-loader script will now seek for drivers in driver/${ARCH}/ for x86_64 too. ] - fix(falco-driver-loader): building falco module with DKMS on Flatcar and supporting fetching pre-built module/eBPF probe ] - rule(Redirect STDOUT/STDIN to Network Connection in Container): changed priority to NOTICE ] - rule(Java Process Class Download): detect potential log4shell exploitation ] - remove kaizhe from falco rule owner ] - docs(readme): added arm64 mention + packages + badge. ] - new(circleci): enable integration tests for arm64. ] - chore(cmake): bump plugins versions ] - fix(docker): fixed deb tester sub image. ] - fix(ci): fix sign script - avoid interpreting '{}$argv' too soon ] - fix(tests): make tests run locally (take 2) ] - fix(ci): creates ~/sign instead of ./sign ] - fix(ci): sign arm64 rpm packages. ] - update(falco_scripts): Change Flatcar dynlinker path ] - fix(scripts): fixed path in publish-deb script. ] - fix(build): docker-container buildx engine does not support retagging images. Tag all images together. ] - fix(build): fixed publish-docker-dev job context. ] - Correct linting issue in rules ] - Fix falco compilation issues with new libs ] - fix(scripts): forcefully create packages dir for debian packages. ] - fix(build): removed leftover line in circleci config. ] - fix(build): fixed circleCI artifacts publish for

] - update(docker): updated falco-builder to fix multiarch support. ] - fix(build): use apt instead of apk when installing deps for aws ecr publish ] - fix(build): try to use root user for cimg/base ] - update(build): avoid double build of docker images when pushing to aws ecr ] - chore(k8sauditplugin): bump k8s audit plugin version ] - fix(tests): make runregressiontests.sh work locally ] - Circle CI build job for ARM64 ] - Released on 2022-06-03 new: added new `watchconfigfiles` config option, to trigger a Falco restart whenever a change is detected in the rules or config files ] - new(rules): add rule to detect excessively capable container ] - new(rules): add rules to detect pods sharing host pid and IPC namespaces ] - new(image): add Falco image based on RedHat UBI ] - new(falco): add --markdown and --list-syscall-events ] - update(build): updated plugins to latest versions. ] - refactor(userspace/falco): split the currently monolithic falco_init into smaller "actions", managed by the falco application's action manager. ] - rules: out of the box ruleset for OKTA Falco Plugin ] - update(build): updated libs to 39ae7d40496793cf3d3e7890c9bbdc202263836b ] - update!: moving out plugins ruleset files ] - update: added `hostname` as a field in JSON output ] - refactor!: remove K8S audit logs from Falco ] - refactor(userspace/engine): use supported_operators helper from libsinsp filter parser ] - refactor!: deprecate PSP regression tests and warn for unsafe usage of <NA> in k8s audit filters ] - build(cmake): upgrade catch2 to 2.13.9 ] - refactor(userspace/engine): reduce memory usage for resolving evttypes ] - refactor(userspace/engine): remove Lua from Falco and re-implement the rule loader ] - refactor(userspace/engine): decoupling ruleset reading, parsing, and compilation steps ] - refactor: update definitions of falco_common ] - update: improved Falco engine event processing performance ] - refactor(userspace/engine): use libsinsp filter parser and compiler inside rule loader ] - fix(userspace/engine): skip rules with unknown sources that also have exceptions, and skip macros with unknown sources. ] - fix(userspace/falco): enable k8s and mesos clients only when syscall source is enabled ] - rule(Launch Excessively Capable Container): fix typo in description ] - rule(macro: knownshellspawn_cmdlines): add `sh -c /usr/share/lighttpd/create-mime.conf.pl` to macro ] - rule(macro netminerpool): additional syscall for detection ] - rule(macro truncateshellhistory): include .ash_history ] - rule(macro modifyshellhistory): include .ash_history ] - rule(Detect releaseagent File Container Escapes): new rule created to detect an attempt to exploit a container escape using releaseagent file ] - rule(k8s: secret): detect `get` attempts for both successful and unsuccessful attempts ] - rule(K8s Serviceaccount Created/Deleted): Fixed output for the rules ] - rule(Disallowed K8s User): exclude allowed EKS users ] - rule(Launch Ingress Remote File Copy Tools in Container): Removed use cases not triggering the rule ] - rule(Mount Launched in Privileged Container): added allowlist macro userknownmountinprivileged_containers. ] - rule(macro userknownshellconfigmodifiers): allow to allowlist shell config modifiers ] - new: update plugins ] - update(build): updated libs version for Falco 0.32.0 release. ] - update(build): updated libs to 1be924900a09cf2e4db4b4ae13d03d838959f350 ] - chore(userspace/falco): do not print error code in process_events.cpp ] - fix(falco-scripts): remove driver versions with

] - chore(userspace/falco): fix punctuation typo in output message when loading plugins ] - refactor(userspace): change falco engine design to properly support multiple sources ] - update(userspace/falco): improve falco termination ] - update(userspace/engine): introduce new `checkpluginrequirements` API ] - fix(userspace/engine): improve rule loader source checks ] - fix: split filterchecks per source-idx ] - new: port CI builds to github actions ] - build(userspace/engine): cleanup unused include dir ] - rule(Anonymous Request Allowed): exclude {/livez, /readyz} ] - chore(falco_scripts): Update `falco-driver-loader` cleaning phase ] - new(userspace/falco): use new plugin caps API ] - build: correct conffiles for DEB packages ] - Fix exception parsing regressions ] - Add codespell GitHub Action ] - build: components opt-in mechanism for packages ] - add gVisor to ADOPTERS.md ] - rules: whitelist GCP's container threat detection image ] - Fix some typos ] - chore(rules): remove leftover ] - docs: readme update and plugins ] - Released on 2022-03-09 new: add a new drop category `ndropsscratch_map` ] - new: allow to specify multiple --cri options ] - refactor(userspace/falco): replace direct getopt_long() cmdline option parsing with third-party cxxopts library. ] - update: driver version is b7eb0dd ] - fix(userspace/falco): correct plugins init config conversion from YAML to JSON ] - fix(userspace/engine): for rules at the informational level being loaded at the notice level ] - chore(userspace/falco): fixes truncated -b option description. ] - update(falco): updates usage description for -o, --option ] - Fix for a TOCTOU issue that could lead to rule bypass (CVE-2022-26316). For more information, see the . rule(Detect outbound connections to common miner pool ports): fix url in rule output ] - rule(macro somebodybecomingthemself): renaming macro to somebodybecomingthemselves ] - rule(list packagemgmtbinaries): `npm` added ] - rule(Launch Package Management Process in Container): support for detecting `npm` usage ] - rule(Polkit Local Privilege Escalation Vulnerability): new rule created to detect CVE-2021-4034 ] - rule(macro: modifyshellhistory): avoid false-positive alerts triggered by modifications to .zshhistory.new and .zshhistory.LOCK files ] - rule(macro: truncateshellhistory): avoid false-positive alerts triggered by modifications to .zshhistory.new and .zshhistory.LOCK files ] - rule(macro sssdwritingkrb): fixed a false-positive alert that was being generated when SSSD updates /etc/krb5.keytab ] - rule(macro writeetccommon): fixed a false-positive alert that was being generated when SSSD updates /etc/krb5.keytab ] - upgrade macro(keepalivedwritingconf) ] - rule_output(Delete Bucket Public Access Block) typo ] - fix(build): fix civetweb linking in cmake module ] - chore(userspace/engine): remove unused lua functions and state vars ] - fix(userspace/falco): applies FALCOINSTALLCONF_FILE as the default ] - fix(scripts): correct typo in `falco-driver-loader` help message ] - update(build)!: replaced various `PROBE` with `DRIVER` where necessary. ] - Add to the adopters list ] - build(cmake): several cmake changes to speed up/simplify builds for external projects and copying files from source-to-build directories ] - Released on 2022-01-31 new: add support for plugins to extend Falco functionality to new event sources and custom fields ] - new: add ability to set User-Agent http header when sending http output. Provide default value of 'falcosecurity/falco'. ] - new(configuration): support defining plugin init config as a YAML ] - rules: add the official Falco ECR repository to rules ] - build: update CircleCI machine image for eBPF tests to a newer version of ubuntu ] - update(engine): refactor Falco engine to be agnostic to specific event sources ] - build: upgrade civetweb to v1.15 ] - update: driver version is 319368f1ad778691164d33d59945e00c5752cd27 now ] - build: allow using local libs source dir by setting `FALCOSECURITYLIBSSOURCE_DIR` in cmake ] - build: the statically linked binary package is now published with the `-static` suffix ] - update!: removed "--alternate-lua-dir" cmdline option as lua scripts are now embedded in Falco executable. ] - build: switch to dynamic build for the binary package

] - update: simpleconsumer filtering is now being done at kernel level ] - update(scripts/falco-driver-loader): first try to load the latest kmod version, then fallback to an already installed if any ] - refactor: clean up --list output with better formatting and no duplicate sections across event sources. ] - update: embed .lua files used to load/compile rules into the main falco executable, for simplicity and to avoid tampering. ] - update: support non-enumerable event sources in gRPC outputs service ] - docs: add jasondellaluce to OWNERS ] - chore: --list option can be used to selectively list fields related to new sources that are introduced by plugins ] - update(userspace/falco): support arbitrary-depth nested values in YAML configuration ] - build: bump FakeIt version to 2.0.9 ] - update: allow append of new exceptions to rules ] - update: Linux packages are now signed with SHA256 ] - fix(scripts/falco-driver-loader): fix for SELinux insmod denials ] - fix(scripts/falco-driver-loader): correctly clean loaded drivers when using `--clean` ] - fix(userspace/falco): in case output_file cannot be opened, throw a falco exception ] - fix(userspace/engine): support jsonpointer escaping in rule parser ] - fix(scripts/falco-driver-loader): support kernel object files in `.zst` and `.gz` compression formats ] - fix(engine): correctly format json output in json_event ] - fix: set http output content type to text/plain when json output is disabled ] - fix(userspace/falco): accept 'Content-Type' header that contains "application/json", but it is not strictly equal to it ] - fix(userspace/engine): supporting enabled-only overwritten rules ] - rule(Create Symlink Over Sensitive File): corrected typo in rule output ] - rule(macro open_write): add support to openat2 ] - rule(macro open_read): add support to openat2 ] - rule(macro open_directory): add support to openat2 ] - rule(Create files below dev): add support to openat2 ] - rule(Container Drift Detected (open+create)): add support to openat2 ] - rule(macro sensitive_mount): add containerd socket ] - rule(macro spawned_process): monitor also processes spawned by `execveat` ] - rule(Create Hardlink Over Sensitive Files): new rule to detect hard links created over sensitive files ] - rule(Detect crypto miners using the Stratum protocol): add `stratum2+tcp` and `stratum+ssl` protocols detection ] - rule(Sudo Potential Privilege Escalation): correct special case for the CVE-2021-3156 exploit ] - rule(list falcohostnetworkimages): moved to k8sauditrules.yaml to avoid a warning when using falco_rules.yaml only ] - rule(list deb_binaries): remove `apt-config` ] - rule(Launch Remote File Copy Tools in Container): add additional binaries: curl and wget. ] - rule(list knownsalist): add coredns, coredns-autoscaler, endpointslicemirroring-controller, horizontal-pod-autoscaler, job-controller, node-controller (nodelifecycle), persistent-volume-binder, pv-protection-controller, pvc-protection-controller, root-ca-cert-publisher and service-account-controller as allowed service accounts in the kube-system namespace ] - fix: force-set evt.type for plugin source events ] - fix: updated some warning strings; properly refresh lua files embedded in falco ] - style(userspace/engine): avoid creating multiple versions of methods only to assume default ruleset. Use a default argument instead. ] - add raft in the adopters list ] - build: always populate partial version variables ] - build: updated cloudtrail plugin to latest version ] - replace ".." concatenation with table.concat ] - fix(userspace/engine): actually make mfilteralleventtypes useful by properly using it as fallback when no filter event types is provided ] - fix(build): do not show plugin options in musl optimized builds ] -

correct required plugin versions ] - docs: fix priority level "info" to "informational" ] - Field properties changes ] - update(build): updated libs to latest master version; updated plugins versions ] - Add Giant Swarm to Adopters list ] - update(tests): remove `token_bucket` unit tests ] - fix(build): use consistent 7-character build abbrev sha ] - add Phoenix to adopters list ] - remove unused files in test directory ] - drop Falco luajit module, use the one provided by libs ] - chore(build): update libs version to 7906f7e ] - Add SysFlow to list of libs adopters ] - build: dropped centos8 circleci build because it is useless ] - Released on 2021-10-01 new: add `--k8s-node` command-line options, which allows filtering by a node when requesting metadata of pods to the K8s API server ] - new(outputs): expose rule tags and event source in gRPC and json outputs ] - new(userspace/falco): add customizable metadata fetching params ] - update: bump driver version to 3aa7a83bf7b9e6229a3824e3fd1f4452d1e95cb4 ] - docs: clarify that previous Falco drivers will remain available at https://download.falco.org and no automated cleanup is run anymore ] - update(outputs): add configuration option for tags in json outputs ] - fix(scripts): correct standard output redirection in systemd config (DEB and RPM packages) ] - fix(scripts): correct lookup order when trying multiple `gcc` versions in the `falco-driver-loader` script ] - rule(list miner_domains): add new miner domains ] - rule(list httpsminerdomains): add new miner domains ] - add Qonto as adopter ] - docs(proposals): proposal for a libs plugin system ] - build: remove unused `ncurses` dependency ] - build(.circleci): use new Debian 11 package names for python-pip ] - build(docker): adding libssl-dev, upstream image reference pinned to `debian:buster` ] - fix(test): avoid outputstrictlycontains failures ] - Remove duplicate allowed ecr registry rule ] - docs(RELEASE.md): switch to 3 releases per year ] - Released on 2021-06-29 update: bump the Falco engine version to version 9 ] - rule(list userknownuserfaultfd_processes): list to exclude processes known to use userfaultfd syscall ] - rule(macro consideruserfaultfdactivities): macro to gate the "Unprivileged Delegation of Page Faults Handling to a Userspace Process" rule ] - rule(Unprivileged Delegation of Page Faults Handling to a Userspace Process): new rule to detect successful unprivileged userfaultfd syscalls ] - rule(Linux Kernel Module Injection Detected): adding container info to the output of the rule ] - docs(release.md): update steps ] - Released on 2021-06-21 update: driver version is 17f5df52a7d9ed6bb12d3b1768460def8439936d now ] - rule(list miner_domains): add rx.unmineable.com for anti-miner detection ] - rule(Change thread namespace and Set Setuid or Setgid bit): disable by default ] - rule(list knownsalist): add namespace-controller, statefulset-controller, disruption-controller, job-controller, horizontal-pod-autoscaler and persistent-volume-binder as allowed service accounts in the kube-system namespace ] - rule(Non sudo setuid): check user id as well in case user name info is not available ] - rule(Debugfs Launched in Privileged Container): fix typo in description ] - Fix link to CONTRIBUTING.md in the Pull Request Template ] - fetch libs and drivers from the new repo ] - build(test): upgrade urllib3 to 1.26.5 ] - revert: add notes for 0.28.2 release ] - changelog: add notes for 0.28.2 release ] - docs(release.md): add blog announcement to post-release tasks ] - add Yahoo!Japan as an adopter ] - Add Replicated to adopters ] - docs(proposals): fix libs contribution name ] - Released on 2021-05-07 new: `--support` output now includes info about the Falco engine version ] - new: Falco outputs an alert in the unlikely situation it's receiving too many consecutive timeouts without an event ] - new: configuration field

to configure after how many consecutive timeouts without an event Falco must alert ] - build: enforcing hardening flags by default ] - fix: do not stop the webserver for k8s audit logs when invalid data is coming in the event to be processed ] - rule(macro: allowedawsecrregistryrootforeks): new macro for AWS EKS images hosted on ECR to use in rule: Launch Privileged Container ] - rule(macro: awsekscore_images): new macro for AWS EKS images hosted on ECR to use in rule: Launch Privileged Container ] - rule(macro: awseksimagesensitivemount): new macro for AWS EKS images hosted on ECR to use in rule: Launch Privileged Container ] - rule(list `falcoprivilegedimages`): remove deprecated Falco's OCI image repositories ] - rule(list `falcosensitivemount_images`): remove deprecated Falco's OCI image repositories ] - rule(macro `k8s_containers`): remove deprecated Falco's OCI image repositories ] - rule(macro: pythonrunningsdchecks): macro removed ] - rule(Change thread namespace): remove pythonrunningsdchecks exception ] - urelease/docs: fix link and small refactor in the text ] - Add Secureworks to adopters ] - regression test for malformed k8s audit input (FAL-01-003) ] - Add mathworks to adopterlist ] - adding known users ] - docs: update link for HackMD community call notes ] - Released on 2021-04-12 BREAKING CHANGE: Bintray is deprecated, no new packages will be published at https://dl.bintray.com/falcosecurity/ ] - BREAKING CHANGE: SKIPMODULELOAD env variable no more disables the driver loading (use SKIPDRIVERLOADER env variable introduced in Falco 0.24) ] - BREAKING CHANGE: the init.d service unit is not shipped anymore in deb/rpm packages in favor of a systemd service file ] - new: add support for exceptions as rule attributes to provide a compact way to add exceptions to Falco rules ] - new: falco-no-driver container images on AWS ECR gallery (https://gallery.ecr.aws/falcosecurity/falco-no-driver) ] - new: falco-driver-loader container images on AWS ECR gallery (https://gallery.ecr.aws/falcosecurity/falco-driver-loader) ] - new: add healthz endpoint to the webserver ] - new: introduce a new configuration field `syscalleventdrops.threshold` to tune the drop noisiness ] - new: falco-driver-loader script can get a custom driver name from DRIVER_NAME env variable ] - new: falco-driver-loader know the Falco version ] - docs(proposals): libraries and drivers donation ] - docs(docker): update links to the new Falco website URLs ] - docs(test): update links to new Falco website URLs ] - build: now Falco packages are published at https://download.falco.org ] - update: lower the `syscalleventdrops.max_burst` default value to 1 ] - update: falco-driver-loader tries to download a Falco driver before then compiling it on the fly for the host ] - docs(test): document the prerequisites for running the integration test suite locally ] - update: Debian/RPM package migrated from init to systemd ] - fix(userspace/engine): properly handle field extraction over lists of containers when not all containers match the specified sub-properties ] - fix(docker/falco): add flex and bison dependency to container image ] - fix: ignore action can not be used with log and alert ones (`syscalleventdrops` config) ] - fix(userspace/engine): allows fields starting with numbers to be parsed properly ] - rule(Write below monitored dir): improve rule description ] - rule(macro allowedawseksregistryroot): macro to match the official eks registry ] - rule(macro awseksimage): match aws image repository for eks ] - rule(macro awseksimagesensitivemount): match aws cni images ] - rule(macro k8s_containers): include fluent/fluentd-kubernetes-daemonset and prom/prometheus ] - rule(Launch Privileged Container): exclude awseksimage ] - rule(Launch Sensitive Mount Container): exclude awseksimagesensitivemount ] - rule(Debugfs Launched in Privileged Container): new rule ] - rule(Mount Launched in Privileged Container): new rule ] - rule(Set Setuid or Setgid bit): add k3s-agent in the whitelist ] - rule(macro usersshdirectory): using glob operator ] - rule(list falcosensitivemount_containers): added image exceptions for IBM cloud ] - rule(list rpm_binaries): add rhsmcertd ] - rule(list deb_binaries): add

] - rule(Sudo Potential Privilege Escalation): new rule created to detect CVE-2021-3156 ] - rule(list allowedk8susers): add `eks:node-manager` ] - rule(list mysqlmgmtbinaries): removed ] - rule(list dbmgmtbinaries): removed ] - rule(macro parentansiblerunning_python): removed ] - rule(macro parentbrorunning_python): removed ] - rule(macro parentpythonrunning_denyhosts): removed ] - rule(macro parentlinuximageupgradescript): removed ] - rule(macro parentjavarunning_echo): removed ] - rule(macro parentscriptingrunning_builds): removed ] - rule(macro parentXvfbrunning_xkbcomp): removed ] - rule(macro parentnginxrunning_serf): removed ] - rule(macro parentnoderunning_npm): removed ] - rule(macro parentjavarunning_sbt): removed ] - rule(list knowncontainershellspawncmdlines): removed ] - rule(list knownshellspawn_binaries): removed ] - rule(macro runbypuppet): removed ] - rule(macro userprivilegedcontainers): removed ] - rule(list rancher_images): removed ] - rule(list imagesallownetworkoutsidesubnet): removed ] - rule(macro parentpythonrunning_sdchecks): removed ] - rule(macro trusted_containers): removed ] - rule(list authorizedserverbinaries): removed ] - chore(test): replace bucket url with official distribution url ] - adding asapp as an adopter ] - update: fixtures URLs ] - cleanup publishing jobs ] - fix(falco/test): bump pyyaml from 5.3.1 to 5.4 ] - fix(.circleci): tar must be present in the image ] - fix: publishing jobs ] - Pocteo as an adopter ] - build: fetch build deps from download.falco.org ] - adding shapesecurity to adopters ] - Use default pip version to get avocado version ] - Added Swissblock to list of adopters ] - Fix various typos in markdown files. ] - docs: move governance to falcosecurity/.github ] - ci: fix missing infra context to publish stable Falco packages ] - Released on 2021-01-18 new: Added falco engine version to grpc version service ] - BREAKING CHANGE: Users who run Falco without a config file will be unable to do that any more, Falco now expects a configuration file to be passed all the times. Developers may need to adjust their processes. ] - new: asynchronous outputs implementation, outputs channels will not block event processing anymore ] - new: slow outputs detection ] - new: `output_timeout` config option for slow outputs detection ] - build: bump b64 to v2.0.0.1 ] - rules(macro containerstarted): reuse `spawnedprocess` macro inside `container_started` macro ] - docs: reach out documentation ] - docs: Broken outputs.proto link ] - docs(README.md): correct broken links ] - docs(proposals): Exceptions handling proposal ] - docs: fix a broken link of README ] - docs: adding the kubernetes privileged use case to use cases ] - rules(Mkdir binary dirs): Adds exerunningdocker_save as an exception as this rules can be triggered when a container is created. ] - rules(Create Hidden Files): Adds exerunningdocker_save as an exception as this rules can be triggered when a container is created. ] - docs(.circleci): welcome Jonah (Amazon) as a new Falco CI maintainer ] - build: falcosecurity/falco:master also available on the AWS ECR Public registry ] - build: falcosecurity/falco:latest also available on the AWS ECR Public registry ] - update: gRPC clients can now subscribe to drop alerts via gRCP API ] - macro(allowedk8susers): exclude cloud-controller-manage to avoid false positives on k3s ] - fix(userspace/falco): use given priority in falcooutputs::handlemsg() ] - fix(userspace/engine): free formatters, if any ] - fix(scripts/falco-driver-loader): lsmod usage ] - fix: a bug that prevents Falco driver to be consumed by many Falco instances in some circumstances ] - fix: set `HOST_ROOT=/host` environment variable for the `falcosecurity/falco-no-driver` container image by default ] - rule(list userknownchangethreadnamespace_binaries): add crio and multus to the list ] - rule(Container Run as Root User): new rule created ] - rule(Linux Kernel Module injection detected): adds a new rule that detects when an LKM module is injected using `insmod` from a container (typically used by rootkits looking to obfuscate their behavior via kernel

] - rule(macro multipathwritingconf): create and use the macro ] - rule(list falcoprivilegedimages): add calico/node without registry prefix to prevent false positive alerts ] - rule(Full K8s Administrative Access): use the right list of admin users (fix) ] - chore(cmake): remove unnecessary whitespace patch ] - remove stale bot in favor of the new lifecycle bot ] - chore(cmake): mark some variables as advanced ] - chore(cmake/modules): avoid useless rebuild ] - build: BUILD_BYPRODUCTS for civetweb ] - build: remove duplicate item from FALCO_SOURCES ] - build: make our integration tests report clear steps for CircleCI UI ] - further improvements outputs impl. ] - fix(test): make integration tests properly fail ] - Falco outputs refactoring ] - Released on 2020-11-10 update: DRIVERS_REPO now defaults to https://download.falco.org/driver ] - Released on 2020-10-01 new: CLI flag `--alternate-lua-dir` to load Lua files from arbitrary paths ] - rule(Delete or rename shell history): fix warnings/FPs + container teardown ] - rule(Write below root): ensure procnameexists too ] - Released on 2020-24-09 new: address several sources of FPs, primarily from GKE environments. ] - new: driver updated to 2aa88dcf6243982697811df4c1b484bcbe9488a2 ] - new(scripts/falco-driver-loader): detect and try to build the Falco kernel module driver using different GCC versions available in the current environment. ] - new: tgz (tarball) containing the statically-linked (musl) binary of Falco is now automatically built and published on bintray ] - update: bump Falco engine version to 7 ] - update: the requiredengineversion is now on by default ] - update: falcosecurity/falco-no-driver image now uses the statically-linked Falco ] - docs(proposals): artifacts storage ] - docs(proposals): artifacts cleanup ] - rule(macro inbound_outbound): add brackets to disambiguate operator precedence ] - rule(macro rediswritingconf): add brackets to disambiguate operator precedence ] - rule(macro runbyforeman): add brackets to disambiguate operator precedence ] - rule(macro considerpacketsocket_communication): enable "Packet socket created in container" rule by default. ] - rule(Delete or rename shell history): skip docker overlay filesystems when considering bash history ] - rule(Disallowed K8s User): quote colons in user names ] - rule(macro falcosensitivemount_containers): Adds a trailing slash to avoid repo naming issues ] - rule: adds user.loginuid to the default Falco rules that also contain user.name ] - Released on 2020-08-25 new(userspace/falco): print the Falco and driver versions at the very beginning of the output. ] - new: libyaml is now bundled in the release process. Users can now avoid installing libyaml directly when getting Falco from the official release. ] - docs(test): step-by-step instructions to run integration tests locally ] - update: renameat2 syscall support ] - update: support for 5.8.x kernels ] - fix(userspace/falco): correct the fallback mechanism for loading the kernel module ] - fix(falco-driver-loader): script crashing when using arguments ] - rule(macro usertrustedcontainers): add `sysdig/node-image-analyzer` and `sysdig/agent-slim` ] - rule(macro falcoprivilegedimages): add `docker.io/falcosecurity/falco` ] - rule(EphemeralContainers Created): add new rule to detect ephemeral container created ] - rule(macro userreadsensitivefilecontainers): replace endswiths with exact image repo name ] - rule(macro usertrustedcontainers): replace endswiths with exact image repo name ] - rule(macro userprivilegedcontainers): replace endswiths with exact image repo name ] - rule(macro trustedimagesqueryminerdomain_dns): replace endswiths with exact image repo name ] - rule(macro falcoprivilegedcontainers): append "/" to quay.io/sysdig ] - rule(list falcoprivilegedimages): add images docker.io/sysdig/agent-slim and docker.io/sysdig/node-image-analyzer ] - rule(list falcosensitivemount_images): add image docker.io/sysdig/agent-slim ] - rule(list k8s_containers): prepend

to images ] - rule(macro exerunningdocker_save): add better support for centos ] - rule(macro rename): add `renameat2` syscall ] - rule(Read sensitive file untrusted): add trusted images into whitelist ] - rule(Pod Created in Kube Namespace): add new list k8simagelist as white list ] - rule(list allowedk8susers): add "kubernetes-admin" user ] - Released on 2020-07-16 new: Falco now supports userspace instrumentation with the -u flag ] BREAKING CHANGE: --stats_interval is now --stats-interval ] new: auto threadiness for gRPC server ] BREAKING CHANGE: server streaming gRPC outputs method is now `falco.outputs.service/get` ] new: new bi-directional async streaming gRPC outputs (`falco.outputs.service/sub`) ] new: unix socket for the gRPC server ] update: driver version is 85c88952b018fdbce2464222c3303229f5bfcfad now ] update: `SKIPMODULELOAD` renamed to `SKIPDRIVERLOADER` ] docs: add leogr to OWNERS ] update: default threadiness to 0 ("auto" behavior) ] update: k8s audit endpoint now defaults to /k8s-audit everywhere ] update(falco.yaml): `webserver.k8sauditendpoint` default value changed from `/k8s_audit` to `/k8s-audit` ] docs(test): instructions to run regression test suites locally ] fix: --stats-interval correctly accepts values >= 999 (ms) ] fix: make the eBPF driver build work on CentOS 8 ] fix(userspace/falco): correct options handling for `buffered_output: false` which was not honored for the `stdout` output ] fix(userspace/falco): honor -M also when using a trace file ] fix: high CPU usage when using server streaming gRPC outputs ] fix: missing newline from some log messages (eg., token bucket depleted) ] rule(Container Drift Detected (chmod)): disabled by default ] rule(Container Drift Detected (open+create)): disabled by default ] rule(Write below etc): allow snapd to write its unit files ] rule(macro remotefilecopyprocs): fix reference to remotefilecopybinaries ] rule(list allowedk8susers): whitelisted kube-apiserver-healthcheck user created by kops >= 1.17.0 for the kube-apiserver-healthcheck sidecar ] rule(Change thread namespace): Allow `protokube`, `dockerd`, `tini` and `aws` binaries to change thread namespace. ] rule(macro exerunningdocker_save): to filter out cmdlines containing

] rule(macro userknowncron_jobs): new macro to be overridden to list known cron jobs ] rule(Schedule Cron Jobs): exclude known cron jobs ] rule(macro userknownupdatepackageregistry): new macro to be overridden to list known package registry update ] rule(Update Package Registry): exclude known package registry update ] rule(macro userknownreadsshinformation_activities): new macro to be overridden to list known activities that read SSH info ] rule(Read ssh information): do not throw for activities known to read SSH info ] rule(macro userknownreadsensitivefiles_activities): new macro to be overridden to list activities known to read sensitive files ] rule(Read sensitive file trusted after startup): do not throw for activities known to read sensitive files ] rule(Read sensitive file untrusted): do not throw for activities known to read sensitive files ] rule(macro userknownwriterpmdatabase_activities): new macro to be overridden to list activities known to write RPM database ] rule(Write below rpm database): do not throw for activities known to write RPM database ] rule(macro userknowndbspawnedprocesses): new macro to be overridden to list processes known to spawn DB ] rule(DB program spawned process): do not throw for processes known to spawn DB ] rule(macro userknownmodifybindir_activities): new macro to be overridden to list activities known to modify bin directories ] rule(Modify binary dirs): do not throw for activities known to modify bin directories ] rule(macro userknownmkdirbindir_activities): new macro to be overridden to list activities known to create directories below bin directories ] rule(Mkdir binary dirs): do not throw for activities known to create directories below bin directories ] rule(macro userknownsystemuserlogin): new macro to exclude known system user logins ] rule(System user interactive): do not throw for known system user logins ] rule(macro userknownusermanagementactivities): new macro to be overridden to list activities known to do user managements activities ] rule(User mgmt binaries): do not throw for activities known to do user managements activities ] rule(macro userknowncreatefilesbelowdevactivities): new macro to be overridden to list activities known to create files below dev ] rule(Create files below dev): do not throw for activities known to create files below dev ] rule(macro userknowncontactk8sapiserveractivities): new macro to be overridden to list activities known to contact Kubernetes API server ] rule(Contact K8S API Server From Container): do not throw for activities known to contact Kubernetes API server ] rule(macro userknownnetworktoolactivities): new macro to be overridden to list activities known to spawn/use network tools ] rule(Launch Suspicious Network Tool in Container): do not throw for activities known to spawn/use network tools ] rule(macro userknownremovedataactivities): new macro to be overridden to list activities known to perform data remove commands ] rule(Remove Bulk Data from Disk): do not throw for activities known to perform data remove commands ] rule(macro userknowncreatehiddenfile_activities): new macro to be overridden to list activities known to create hidden files ] rule(Create Hidden Files or Directories): do not throw for activities known to create hidden files ] rule(macro userknownstandstreamsredirect_activities): new macro to be overridden to list activities known to redirect stream to network connection (in containers) ] rule(Redirect STDOUT/STDIN to Network Connection in Container): do not throw for activities known to redirect stream to network connection (in containers) ] rule(macro userknowncontainerdriftactivities): new macro to be overridden to list activities known to create executables in containers ] rule(Container Drift Detected (chmod)): do not throw for activities known to give execution permissions to files in containers ] rule(Container Drift Detected (open+create)): do not throw for activities known to create executables in containers ] rule(macro userknownnodeportservice): do not throw for services known to start with a NopePort service type (k8s) ] rule(Create NodePort Service): do not throw for services known to start with a NopePort service type (k8s) ] rule(macro userknownexecpodactivities): do not throw for activities known to attach/exec to a pod (k8s) ] rule(Attach/Exec Pod): do not throw for activities known to attach/exec to a pod (k8s) ] rule(macro trusted_pod): defines trusted pods by an image list ] rule(Pod Created in Kube Namespace): do not throw for trusted pods ] rule(macro trusted_sa): define trusted ServiceAccount ] rule(Service Account Created in Kube Namespace): do not throw for trusted ServiceAccount ] rule(list networktoolbinaries): add zmap to the list ] rule(macro root_dir): correct macro to exactly match the `/root` dir and not other with just `/root` as a prefix ] rule(macro userexpectedterminalshellincontainerconditions): allow whitelisting terminals in containers under specific conditions ] rule(macro userknownwritebelowbinarydiractivities): allow writing to a binary dir in some conditions ] rule(macro trustedloggingimages): Add addl fluentd image ] rule(macro trustedloggingimages): Let azure-npm image write to /var/log ] rule(macro lvprogswritingconf): Add lvs as a lvm program ] rule(macro userknownk8sclientcontainer): Allow hcp-tunnelfront to run kubectl in containers ] rule(list allowedk8susers): Add vertical pod autoscaler as known k8s users ] rule(Anonymous Request Allowed): update to checking auth decision equals to allow ] rule(Container Drift Detected (chmod)): new rule to detect if an existing file get exec permissions in a container ] rule(Container Drift Detected (open+create)): new rule to detect if a new file with execution permission is created in a container ] rule(Mkdir binary dirs): correct condition in macro `bindirmkdir` to catch `mkdirat` syscall ] rule(Modify binary dirs): correct condition in macro `bindirrename` to catch `rename`, `renameat`, and `unlinkat` syscalls ] rule(Create files below dev): correct condition to catch `openat` syscall ] rule(macro userknownsetsetuidorsetgidbit_conditions): create macro ] Released on 2020-05-18 BREAKING CHANGE: the falco-driver-loader script now references `falco-probe.o` and `falco-probe.ko` as `falco.o` and `falco.ko` ] BREAKING CHANGE: the `falco-driver-loader` script environment variable to use a custom repository to download drivers now uses the `DRIVERSREPO` environment variable instead of

This variable must contain the parent URI containing the following directory structure `/$driverversion$/falco$target$$kernelrelease$_$kernelversion$.] new(scripts): options and command-line usage for `falco-driver-loader` ] new: ability to specify exact matches when adding rules to Falco engine (only API) ] new(docker): add an image that wraps the `falco-driver-loader` with the toolchain ] new(docker): add `falcosecurity/falco-no-driver` image ] update(scripts): improve `falco-driver-loader` output messages ] update: containers look for prebuilt drivers on the Drivers Build Grid ] update: driver version bump to 96bd9bc560f67742738eb7255aeb4d03046b8045 ] update(docker): now `falcosecurity/falco:slim-` alias to `falcosecurity/falco-no-driver:*` ] docs: instructions to run unit tests ] docs(examples): move `/examples` to `contrib` repo ] update(docker): remove `minimal` image ] update(integration): move `/integrations` to `contrib` repo ] https://dl.bintray.com/driver/$driverversion$/falco$target$$kernelrelease$$kernelversion$.] update(docker/event-generator): remove the event-generator from Falco repository ] docs(examples): set audit level to metadata for object secrets ] fix(scripts): upstream files (prebuilt drivers) for the generic Ubuntu kernel contains "ubuntu-generic" ] fix: support Falco driver on Linux kernels 5.6.y ] rule(Redirect STDOUT/STDIN to Network Connection in Container): correct rule name as per rules naming convention ] rule(Redirect STDOUT/STDIN to Network Connection in Container): new rule to detect Redirect stdout/stdin to network connection in container ] rule(K8s Secret Created): new rule to track the creation of Kubernetes secrets (excluding kube-system and service account secrets) ] rule(K8s Secret Deleted): new rule to track the deletion of Kubernetes secrets (excluding kube-system and service account secrets) ] Released on 2020-04-17 Same as v0.22.0 Same as v0.22.0 fix: correct driver path (/usr/src/falco-%driver_version%) for RPM package ] Same as v0.22.0 Released on 2020-04-16 new: falco version and driver version are distinct and not coupled anymore ] new: flag to disable asynchronous container metadata (CRI) fetch `--disable-cri-async` ] docs(integrations): update API resource versions to Kubernetes 1.16 ] docs: add new release archive to the `README.md` ] update: driver version a259b4bf49c3 ] docs(integrations/k8s-using-daemonset): --cri flag correct socket path ] update: bump driver version to cd3d10123e ] update(docker): remove RHEL, kernel/linuxkit, and kernel/probeloader images ] update: falco-probe-loader script is falco-driver-loader now ] update: using only sha256 hashes when pulling build dependencies ] fix(integrations/k8s-using-daemonset): added missing privileges for the apps Kubernetes API group in the falco-cluster-role when using RBAC ] fix: connect to docker works also with libcurl >=

] fix: HOST_ROOT environment variable detection ] fix(driver/bpf): stricter conditionals while dealing with strings ] fix: `/usr/bin/falco-${DRIVER_VERSION}` driver directory ] fix: FALCO_VERSION env variable inside Falco containers contains the Falco version now (not the docker image tag) ] rule(macro userexpectedsystemprocsnetworkactivityconditions): allow whitelisting system binaries using the network under specific conditions ] rule(Full K8s Administrative Access): detect any k8s operation by an administrator with full access ] rule(Ingress Object without TLS Certificate Created): detect any attempt to create an ingress without TLS certification (rule enabled by default) ] rule(Untrusted Node Successfully Joined the Cluster): detect a node successfully joined the cluster outside of the list of allowed nodes ] rule(Untrusted Node Unsuccessfully Tried to Join the Cluster): detect an unsuccessful attempt to join the cluster for a node not in the list of allowed nodes ] rule(Network Connection outside Local Subnet): detect traffic to image outside local subnet ] rule(Outbound or Inbound Traffic not to Authorized Server Process and Port): detect traffic that is not to authorized server process and port ] rule(Delete or rename shell history): "mitredefenseevation" tag corrected to "mitredefenseevasion" ] rule(Delete Bash History): "mitredefenseevation" tag corrected to "mitredefenseevasion" ] rule(Write below root): use pmatch to check against known root directories ] rule(Detect outbound connections to common miner pool ports): whitelist sysdig/agent and falcosecurity/falco for query miner domain dns ] rule(Service Account Created in Kube Namespace): only detect sa created in kube namespace with success ] Released on 2020-03-17 BREAKING CHANGE: the SYSDIGBPFPROBE environment variable is now just FALCOBPFPROBE (please update your systemd scripts or kubernetes deployments. ] new: automatically publish deb packages (from git master branch) to public dev repository ] new: automatically publish rpm packages (from git master branch) to public dev repository ] new: automatically release deb packages (from git tags) to public repository ] new: automatically release rpm packages (from git tags) to public repository ] new: automatically publish docker images from master (master, master-slim, master-minimal) ] new: automatically publish docker images from git tag (tag, tag-slim, tag-master, latest, latest-slim, latest-minimal) ] new: sign packages with falcosecurity gpg key ] new: falcoversionprerelease contains the number of commits since last tag on the master ] docs: update branding ] new(docker/event-generator): add example k8s resource files that allow running the event generator in a k8s cluster. ] update: creating -dev docker images using build arguments at build time ] update: docker images use packages from the new repositories ] update: docker image downloads old deb dependencies (gcc-6, gcc-5, binutils-2.30) from a new open repository ] fix(docker): updating `stable` and `local` images to run from `debian:stable` ] fix(event-generator): the image used by the event generator deployment to `latest`. ] fix: -t (to disable rules by certain tag) or -t (to only run rules with a certain tag) work now ] fix: the falco driver now compiles on >= 5.4 kernels ] fix: download falco packages which url contains character to encode - eg, `+` ] fix(docker): use base name in docker-entrypoint.sh ] rule(detect outbound connections to common miner pool ports): disabled by default ] rule(macro netminerpool): add localhost and rfc1918 addresses as exception in the rule. ] rule(change thread namespace): modify condition to detect suspicious container activity ] Released on 2020-02-24 fix: memory leak introduced in 0.18.0 happening while using json events and the kubernetes audit endpoint ] new: grpc version api ] fix: the base64 output format (-b) now works with both json and normal output. ] fix: version follows semver 2 bnf ] rule(write below etc): add "dsc_host" as a ms oms program ] rule(write below etc): let mcafee write to /etc/cma.d ] rule(write below etc): let avinetworks supervisor write some ssh cfg ] rule(write below etc): allow writes to /etc/pki from openshift secrets dir ] rule(write below root): let runc write to /exec.fifo ] rule(change thread namespace): let cilium-cni change namespaces ] rule(run shell untrusted): let puma reactor spawn shells ] Released on 2020-01-23 new: security audit ] instead of crashing, now falco will report the error when an internal error occurs while handling an event to be inspected. the log line will be of type error and will contain the string `error handling inspector event` ] build: bump grpc to 1.25.0 ] build: (most of) dependencies are bundled dynamically (by default) ] test: integration tests now can run on different distributions via docker containers, for now CentOS 7 and Ubuntu 18.04 with respective rpm and deb packages ] proposal: rules naming convention ] update: also allow posting json arrays containing k8s audit events to the k8s_audit endpoint. ] update: add support for k8s audit events to the falco-event-generator

] update: falco-tester base image is fedora:31 now ] build: switch to circleci ] build: bundle openssl into falco-builder docker image ] build: falco-builder docker image revamp (centos:7 base image) ] update: puppet module had been renamed from "sysdig-falco" to "falco" ] update: adds a hostname field to grpc output ] build: download grpc from their github repo ] update: efdropfalco is now efdropsimple_cons ] update(docker): use hostroot environment variable rather than sysdighost_root ] update: efdropfalco is now efdropsimple_cons ] fix: providing clang into docker-builder ] fix: prevent throwing json type error c++ exceptions outside of the falco engine when processing k8s audit events. ] fix(docker/kernel/linuxkit): correct from for falco minimal image ] rules(list networktoolbinaries): add some network tools to detect suspicious network activity. ] rules(write below etc): allow automount to write to /etc/mtab ] rules(macro userknownk8sclientcontainer): when executing the docker client, exclude fluentd-gcp-scaler container running in the `kube-system` namespace to avoid false positives ] rules(the docker client is executed in a container): detect the execution of the docker client in a container and logs it with warning priority. ] rules(list k8sclientbinaries): create and add docker, kubectl, crictl ] rules(macro container_entrypoint): add docker-runc-cur ] rules(list userknownchmod_applications): add hyperkube ] rules(list networktoolbinaries): add some network tools to detect suspicious network activity. ] rules(macro userknownk8sclientcontainer): macro to match kube-system namespace ] rules(contact k8s api server from container): now it can automatically resolve the cluster ip address ] rules(macro k8sapiserver): new macro to match the default k8s api server ] rules(macro sensitivevolmount): add more sensitive host paths ] rules(macro sensitive_mount): add more sensitive paths ] rules(macro considermetadataaccess): macro to decide whether to consider metadata or not (off by default) ] rules(contact cloud metadata service from container): add rules to detect access to gce instance metadata ] rules(macro sensitivevolmount): align sensitive mounts macro between k8s audit rules and syscall rules ] rules(macro considerpacketsocket_communication): macro to consider or not packet socket communication (off by default) ] rules(packet socket created in container): rule to detect raw packets creation ] rules(macro exerunningdocker_save): fixed false positives in multiple rules that were caused by the use of docker in docker ] rules(modify shell configuration file): fixed a false positive by excluding "exerunningdocker_save" ] rules(update package repository): fixed a false positive by excluding "exerunningdocker_save". ] rules(the docker client is executed in a container): when executing the docker client, exclude containers running in the `kube-system` namespace to avoid false positives ] rules(list userknownchmod_applications): add kubelet ] rules(set setuid or setgid bit): fixed a false positive by excluding "exerunningdocker_save" ] rules(macro userknownpackagemanagerin_container): allow users to specify conditions that match a legitimate use case for using a package management process in a container. ] Released 2019-10-28 falco grpc api server implementation, contains a subscribe method to subscribe to outputs from any grpc capable language ] add support for converting k8s pod security policies (psps) into set of falco rules that can be used to evaluate the conditions specified in the psp. ] initial redesign container images to remove build tools and leverage init containers for kernel module delivery. ] add flags to disable `syscall` event source or `k8s_audit` event source ] allow for unique names for psp converted rules/macros/lists/rule names as generated by falcoctl 0.0.3 ] make it easier to run regression tests without necessarily using the falco-tester docker image. ] fix falco engine compatibility with older k8s audit rules files. ] add tests for psp conversions with names containing spaces/dashes. ] handle multi-document yaml files when reading rules files. ] improvements to how the webserver handles incoming invalid inputs ] fix: make lua state access thread-safe ] fix compilation on gcc 5.4 by working around gcc bug https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56480 ] add explicit dependency between tests and catch2 header

] fix: stable dockerfile libgcc-6-dev dependencies ] fix: build dependencies for the local dockerfile ] fix: a crash bug that could result from reading more than ~6 rules files ] ] rules: add calico/node to trusted privileged container list ] rules: add macro `caliconodewrite_envvars` to exception list of write below etc ] rules: add exception for rule write below rpm, this is a fp caused by amazon linux 2 yum. ] rules: ignore sensitive mounts from the ecs-agent ] rules: add rules to detect crypto mining activities ] rules: add back rule delete bash history for backport compatibility ] rule: syscalls are used to detect suid and sgid ] rules: delete bash history is renamed to delete or rename shell history ] rules: add image fluent/fluentd-kubernetes-daemonset to clear log trusted images ] rules: include default users created by `kops`. ] rules: delete or rename shell history: when deleting a shell history file now the syscalls are taken into account rather than just the commands deleting the files ] rules: delete or rename shell history: history deletion now supports fish and zsh in addition to bash ] rules: "create hidden files or directories" and "update package repository" now trigger also if the files are moved and not just if modified or created. ] Released 2019-09-26 Same as v0.17.0 Same as v0.17.0 All in v0.17.0 Fix a build problem for pre-built kernel probes. ] Same as v0.17.0 Released 2019-07-31 The set of supported platforms has changed*. Switch to a reorganized builder image that uses Centos 7 as a base. As a result, falco is no longer supported on Centos 6. The other supported platforms should remain the same ] When enabling rules within the falco engine, use rule substrings instead of regexes. ] Additional improvements to the handling and display of rules validation errors ] ] Fix a problem that would cause prevent container metadata lookups when falco was daemonized ] Allow rule priorities to be expressed as lowercase and a mix of lower/uppercase ] Fix a parentheses bug with the `shell_procs` macro ] Allow additional containers to mount sensitive host paths ] ] Allow additional containers to truncate log files ] Fix false positives with the `Write below root` rule on GKE ] Released 2019-07-12 Clean up error reporting to provide more meaningful error messages along with context when loading rules files. When run with -V, the results of the validation ("OK" or error message) are sent to standard output. ] Improve rule loading performance by optimizing lua parsing paths to avoid expensive pattern matches. ] Bump falco engine version to 4 to reflect new fields `ka.useragent`, others. ] ] Add Catch2 as a unit testing framework. This will add additional coverage on top of the regression tests using Avocado. ] Add SYSDIG_DIR Cmake option to specify location for sysdig source code when building falco. ] ] ] New field `ka.useragent` reports the useragent from k8s audit events. ] Add clang formatter for C++ syntax formatting. ] ] Partial changes towards lua syntax formatting. No particular formatting enforced yet, though. ] Partial changes towards yaml syntax formatting. No particular formatting enforced yet, though. ] Add cmake syntax formatting. ] Token bucket unit tests and redesign. ] Update github PR template. ] Fix PR template for kind/rule-. ] Remove an unused cmake file. ] Misc Cmake cleanups. ] Misc k8s install docs improvements. ] Allow k8s.gcr.io/kube-proxy image to run privileged. ] Add runc to the list of possible container entrypoint

] Skip Source RFC 1918 addresses when considering outbound connections. ] Add additional `user_XXX` placeholder macros to allow for easy customization of rule exceptions. ] Let weaveworks programs change namespaces. ] Add additional openshift images. ] Add openshift as a k8s binary. ] Add dzdo as a binary that can change users. ] Allow azure/calico binaries to change namespaces. ] Add back trusted_containers list for backport compatibility ] Add mkdirat as a syscall for mkdir operations. ] Add container id/repository to rules that can work with containers. ] Released 2019-06-12 None. None. Fix kernel module compilation for kernels < 3.11 ] None. Released 2019-06-12 New documentation and process handling around issues and pull requests. ] ] ] ] None. Fix compilation of eBPF programs on COS (used by GKE) ] Rework exceptions lists for `Create Privileged Pod`, `Create Sensitive Mount Pod`, `Launch Sensitive Mount Container`, `Launch Privileged Container` rules to use separate specific lists rather than a single "Trusted Containers" list. ] Released 2019-06-07 Drop unnecessary events at the kernel level instead of userspace, which should improve performance ] Add instructions for k8s audit support in >= 1.13 ] Fix security issues reported by GitHub on Anchore integration ] Several docs/readme improvements ] ] ] ] ] Better tracking of rule counts per ruleset ] Handle rule patterns that are invalid regexes ] Fix kernel module builds on newer kernels ] ] New rule `Launch Remote File Copy Tools in Container` could be used to identify exfiltration attacks ] New rule `Create Symlink Over Sensitive Files` can help detect attacks like ] ] ] Let etcd-manager write to /etc/hosts. ] Let additional processes spawned by google-accounts-daemon access sensitive files ] Add Sematext Monitoring & Logging agents to trusted k8s containers ] Add additional coverage for `Netcat Remote Code Execution in Container` rule. ] Fix `egrep` typo. ] Allow Ansible to run using Python 3 ] Additional `Write below etc` exceptions for nginx, rancher ] ] ] Add rules for running with IBM Cloud Kubernetes Service ] Released 2019-05-13 Actions and alerts for dropped events*: Falco can now take actions, including sending alerts/logging messages, and/or even exiting Falco, when it detects dropped system call events. Fixes CVE 2019-8339. ] ] Support for Containerd/CRI-O*: Falco now supports containerd/cri-o containers. ] ] ] ] ] ] Perform docker metadata fetches asynchronously*: When new containers are discovered, fetch metadata about the container asynchronously, which should significantly reduce the likelihood of dropped system call events. ] ] ] Better syscall event performance: improve algorithm for reading system call events from kernel module to handle busy event streams ] HTTP Output: Falco can now send alerts to http endpoints directly without having to use curl. ] Move Kubernetes Response Engine to own repo: The Kubernetes Response Engine is now in its . ] Updated Puppet Module: An all-new puppet module compatible with puppet 4 with a smoother installation process and updated package links. ] ] ] RHEL-based falco image: Provide dockerfiles that use RHEL 7 as the base image instead of debian:unstable. ] ISO-8601 Timestamps: Add the ability to write timestamps in ISO-8601 w/ UTC, and use this format by default when running falco in a container ] Docker-based builder/tester: You can now build Falco using the docker image, and run regression tests using the docker

] ] Several small docs changes to improve clarity and readability ] ] ] ] Add instructions on how to enable K8s Audit Logging for kops ] Add a "stale issue" bot that marks and eventually closes old issues with no activity ] Improvements to sample K8s daemonset/service/etc files ] Fix regression that broke json output ] Fix errors when building via docker from MacOS ] Tag rules using Mitre Attack Framework*: Add tags for all relevant rules linking them to the . We have an associated . ] ] New rules for additional use cases: New rules `Schedule Cron Jobs`, `Update Package Repository`, `Remove Bulk Data from Disk`, `Set Setuid or Setgid bit`, `Detect bash history deletion`, `Create Hidden Files or Directories` look for additional common follow-on activity you might see from an attacker. ] ] Allow docker's "exe" (usually part of docker save/load) to write to many filesystem locations ] Let puppet write below /etc Add new `userknownwriterootconditions`, `userknownnonsudosetuidconditions`, and `userknownwritemonitoreddirconditions` macros to allow those rules to be easily customized in user rules files ] ] Better coverage and exceptions for rancher ] Allow prometheus to write to its conf directory under etc ] Better coverage and exceptions for openshift/related tools ] ] Better coverage for cassandra/kubelet/kops to reduce FPs ] Better coverage for docker, openscap to reduce FPs ] Better coverage for fluentd/jboss to reduce FPs ] Add `ash` (Alpine Linux-related shell) as a shell binary ] Released 2019-02-06 Rules versioning support: The falco engine and executable now have an engine version that represents the fields they support. Similarly, rules files have an optional requiredengineversion: NNN* object that names the minimum engine version required to read that rules file. Any time the engine adds new fields, event sources, etc, the engine version will be incremented, and any time a rules file starts using new fields, event sources, etc, the required engine version will be incremented. ] Allow SSL for K8s audit endpoint/embedded webserver ] Add stale issues bot that automatically flags old github issues as stale after 60 days of inactivity and closes issues after 67 days of inactivity. ] Support bundle: When run with `--support`, falco will print a json object containing necessary information like falco version, command line, operating system information, and falco rules files contents. This could be useful when reporting issues. ] Support new third-party library dependencies from open source sysdig. ] Add CII best practices badge. ] Fix kernel module builds when running on centos as a container by installing gcc 5 by hand instead of directly from debian/unstable. ] Mount `/etc` when running as a container, which allows container to build kernel module/ebpf program on COS/Minikube. ] Improved way to specify the source of generic event objects ] Readability/clarity improvements to K8s Audit/K8s Daemonset READMEs. ] Add additional RBAC permissions to track deployments/daemonsets/replicasets. ] Fix formatting of nodejs examples README ] Remove FPs for `Launch Sensitive Mount Container` rule ] Update Container rules/macros to use the more reliable `container.image.{repository,tag}` that always return the repository/tag of an image instead of `container.image`, which may not for some docker daemon versions. ] Released 2019-01-16 Unbuffer outputs by default. This helps make output readable when used in environments like K8s. ] Improved documentation for running Falco within K8s and getting K8s Audit Logging to work with Minikube and Falco as a Daemonset within K8s. ] Fix AWS Permissions for Kubernetes Response Engine ] Tighten compilation flags to include `-Wextra` and `-Werror` ] Add

to outputs when `-pk` argument is used ] Remove kubernetes-response-engine from system:masters ] Ensure `-pc`/`-pk` only apply to syscall rules and not k8s_audit rules ] Fix a potential crash that could occur when using the falco engine and rulesets ] Fix a regression where format output options were mistakenly removed ] Fix FPs related to calico and writing files below etc ] Fix FPs related to `apt-config`/`apt-cache`, `apk` ] New rules `Launch Package Management Process in Container`, `Netcat Remote Code Execution in Container`, `Launch Suspicious Network Tool in Container` look for host-level network tools like `netcat`, package management tools like `apt-get`, or network tool binaries being run in a container. ] Fix the `inbound` and `outbound` macros so they work with sendto/recvfrom/sendmsg/recvmsg. ] Fix FPs related to prometheus/openshift writing config below /etc. ] Released 2018-11-09 Support for K8s Audit Events* : Falco now supports as a second stream of events in addition to syscalls. For full details on the feature, see the . Transparent Config/Rule Reloading: On SIGHUP, Falco will now reload all config files/rules files and start processing new events. Allows rules changes without having to restart falco ] ] The reference integration of falco into a action engine now supports aws actions like lambda, etc. ] Add netcat to falco docker images, which allows easier integration of program outputs to external servers ] ] Links cleanup related to the draios/falco -> falcosecurity/falco move ] Properly load/unload kernel module when the falco service is started/stopped ] ] Better coverage (e.g. reduced FPs) for critical stack, hids systems, ufw, cloud-init, etc. ] New rules `Launch Package Management Process in Container`, `Netcat Remote Code Execution in Container`, and `Launch Suspicious Network Tool in Container` look for running various suspicious programs in a container. ] Misc changes to address false positives in GKE, Istio, etc. ] ] Released 2018-09-11 Fig regression in libcurl configure script ] Released 2018-09-11 Improved IPv6 Support to fully support use of IPv6 addresses in events, connections and filters ] Ability to associate connections with dns names: new filterchecks `fd.ip.name` allow looking up the DNS name for a connection's IP address. This can be used to identify or restrict connections by dns names e.g. `evt.type=connect and fd.sip.name=github.com`. ] ] New filterchecks `user.loginuid` and `user.loginname` can be used to match the login uid, which stays consistent across sudo/su. This can be used to find the actual user running a given process ] Upgrade zlib to 1.2.11, openssl to 1.0.2n, and libcurl to 7.60.0 to address software vulnerabilities ] New `endswith` operator can be used for suffix matching on strings ] Better control of specifying location of lua source code ] None for this release. Released 2018-07-31 Fix a problem that caused the kernel module to not load on certain kernel versions ] ] Released 2018-07-24 EBPF Support* (Beta): Falco can now read events via an ebpf program loaded into the kernel instead of the `falco-probe` kernel module. Full docs ). ] Rules may now have an `skip-if-unknown-filter` property. If set to true, a rule will be skipped if its condition/output property refers to a filtercheck (e.g. `fd.some-new-attribute`) that is not present in the current falco

] ] Small changes to Falco `COPYING` file so github automatically recognizes license ] New example integration showing how to connect Falco with Anchore to dynamically create falco rules based on negative scan results ] New example integration showing how to connect Falco, , and K8s to run flexible "playbooks" based on Falco events ] Ensure all rules are enabled by default ] Fix libcurl compilation problems ] Add gcc-6 to docker container, which improves compatibility when building kernel module ] ] Ensure the /lib/modules symlink to /host/lib/modules is set correctly ] Add additional binary writing programs ] Add additional package management programs ] ] Expand writebelowetc handling for additional programs ] ] Expand set of programs allowed to write to `/etc/pki` ] Expand set of root written directories/files ] ] Let pam-config read sensitive files ] Add additional trusted containers: openshift, datadog, docker ucp agent, gliderlabs logspout ] Let coreos update-ssh-keys write to /home/core/.ssh ] Expand coverage for MS OMS ] ] Expand the set of shell spawning programs ] Add additional mysql programs/directories ] Let program `id` open network connections ] Opt-in rule for protecting tomcat shell spawns ] New rule `Write below monitored directory` ] Released 2018-04-24 Rules Directory Support*: Falco will read rules files from `/etc/falco/rules.d` in addition to `/etc/falco/falcorules.yaml` and `/etc/falco/falcorules.local.yaml`. Also, when the argument to `-r`/falco.yaml `rules_file` is a directory, falco will read rules files from that directory. ] ] Properly support all syscalls (e.g. those without parameter extraction by the kernel module) in falco conditions, so they can be included in `evt.type=<name>` conditions. ] When packaged as a container, start building kernel module with gcc 5.0 instead of gcc 4.9. ] New example puppet module for falco. ] ] When signaled with `USR1`, falco will close/reopen log files. Include a example that shows how to use this feature for log rotation. ] ] To improve resource usage, further restrict the set of system calls available to falco ] ] Add gdb to the development Docker image (sysdig/falco:dev) to aid in debugging. ] You can now specify -V multiple times on the command line to validate multiple rules files at once. ] When run with `-v`, falco will print dangling* macros/lists that are not used by any rules. ] Add an example demonstrating cryptomining attack that exploits an open docker daemon using host mounts. ] New falco.yaml option `jsonincludeoutput_property` controls whether the formatted string "output" is included in the json object when json output is enabled. ] Centralize testing event types for consideration by falco into a single function ) ] If a rule has an attribute `warn_evttypes`, falco will not complain about `evt.type` restrictions on that rule ] When run with `-i`, print all ignored events/syscalls and exit. ] Minor bug fixes to k8s daemonset configuration. ] ] ] Ensure `--validate` can be used interchangeably with `-V`. ] ] Rule conditions like `fd.net` can now be used with the `in` operator e.g. `evt.type=connect and fd.net in ("127.0.0.1/24")`. ] ] Ensure that `keep_alive` can be used both with file and program output at the same time. ] Make it possible to append to a skipped macro/rule without falco complaining ] ] Ensure rule order is preserved even when rules do not contain any `evt.type` restriction. ] ] Make it easier to extend the `Change thread namespace` rule via a `userknownchangethreadnamespace_binaries` list. ] Various FP fixes from users. ] ] ] ] New rule `Disallowed SSH Connection` detects attempts ssh connection attempts to hosts outside of an expected set. In order to be effective, you need to override the macro `allowedsshhosts` in a user rules file. ] New rule `Unexpected K8s NodePort Connection` detects attempts to contact the K8s NodePort range from a program running inside a container. In order to be effective, you need to override the macro `nodeport_containers` in a user rules file. ] Improve `Modify binary dirs` rule to work with new syscalls ] New rule `Unexpected UDP Traffic` checks for udp traffic not on a list of expected

Somewhat FP-prone, so it must be explicitly enabled by overriding the macro `dounexpectedudp_check` in a user rules file. ] ] Released 2018-01-18 Fix driver incompatibility problems with some linux kernel versions that can disable pagefault tracepoints ] Fix OSX Build incompatibility with latest version of libcurl ] Updated the Kubernetes example to provide an additional example: Daemon Set using RBAC and a ConfigMap for configuration. Also expanded the documentation for both the RBAC and non-RBAC examples. ] Refactor the shell-related rules to reduce false positives. These changes significantly decrease the scope of the rules so they trigger only for shells spawned below specific processes instead of anywhere. ] ] Lots of rule changes based on feedback from Sysdig Secure community ] ] ] ] ] Released 2017-10-10 Fix packaging to specify correct built-in config file ] Released 2017-10-10 Important: the location for falco's configuration file has moved from `/etc/falco.yaml` to `/etc/falco/falco.yaml`. The default rules file has moved from `/etc/falcorules.yaml` to `/etc/falco/falcorules.yaml`. In addition, 0.8.0 has added a local rules file to `/etc/falco/falco_rules.local.yaml`. See for more details. Add the ability to append one list to another list by setting an `append: true` attribute. ] Add the ability to append one macro/rule to another list by setting an `append: true` attribute. ] Ensure that falco rules/config files are preserved across package upgrades/removes if modified. ] Add the notion of a "local" rules file that should contain modifications to the default falco rules file. ] When using json output, separately include the individual templated fields in the json object. ] Add the ability to keep a file/program pipe handle open across rule notifications. ] New argument `-V` validates rules file and immediately exits. ] Minor updates to falco example programs ] ] Also validate macros at rule parse time. ] Minor README typo fixes ] Add a government CLA (contributor license agreement). ] Add ability to only run rules with a priority >= some threshold ] Add ability to make output channels unbuffered ] Fix installation of falco on OSX ] Fix a bug that caused the trailing whitespace of a quoted string to be accidentally removed ] When multiple sets of kernel headers are installed, find the one for the running kernel ] Allow pathnames in rule/macro conditions to contain '.' characters ] Fix a bug where a list named "foo" would be substituted even if it were a substring of a longer word like "my_foo" ] Remove extra trailing newlines from rule output strings ] Improve build pathnames to avoid relative paths when possible ] Significant changes to default ruleset to address FPs. These changes resulted from hundreds of hours of use in actual customer environments. ] ] Add official gitlab EE docker image to list of known shell spawning images. Thanks @dkerwin! ] Add keepalived to list of shell spawning binaries. Thanks @dkerwin! ] Released 2017-05-30 Update the priorities of falco rules to use a wider range of priorities rather than just ERROR/WARNING. More info on the use of priorities in the ruleset can be found . ] None. Fix typos in various markdown files. Thanks @sublimino! ] Add gitlab-mon as a gitlab binary, which allows it to run shells, etc. Thanks @dkerwin! ] A new rule Terminal shell in container" that looks for shells spawned in a container with an attached terminal. ] Fix some FPs related to the sysdig monitor

] Fix some FPs related to stating containers combined with missed events ] Released 2017-05-15 None Small changes to token bucket used to throttle falco events ] ] ] ] Update the falco driver to work with kernel 4.11 ] Don't allow apache2 to spawn shells in containers ] ] Released 2017-03-29 Add the notion of tagged falco rules. Full documentation for this feature is available on the . ] ] ] ] Falco now has its own dedicated kernel module. Previously, it would depend on sysdig being installed and would use sysdig's `sysdig-probe` kernel module. This ensures you can upgrade sysdig and falco without kernel driver compatibility problems. More details on the kernel module and its installation are on the . ] ] ] When providing multiple rules files by specifying `-r' multiple times, make sure that you can override rules/lists/macros. Previously, a list/macro/rule specified in an earlier file could not be overridden in a later file. ] ] Add example k8s yaml files that show how to run falco as a k8s DaemonSet, and how to run falco-event-generator as a deployment running on one node. ] ] ] Update third party libraries to address security vulnerabilities. ] Falco can now be built on OSX. Like sysdig, on OSX it is limited to reading existing trace files. ] Several changes to to improve usability. ] Switch to a formatter cache provided by sysdig code instead of using our own. ] Add automated tests that use locally-built docker images. ] Make sure output strings are not truncated when a given %field expression has a NULL value. ] ] Allow ASSERTs when running travisci tests. ] Fix make dependencies for lyaml. ] ] (This was a change in sysdig, but affected falco). Prevent hangs when traversing malformed parent thread state. ] Add confd as a program that can write files below /etc and fleetctl as a program that can spawn shells. ] Add , a k8s liveness checking utility, to the list of shell spawners. ] Eliminate FPs related to weekly ubuntu cron jobs. ] Allow shells spawned by ansible, and eliminate FPs when managing machines via ansible. ] ] ] Eliminate FPs related to use of other security products. Thanks to @juju4 for the useful rule updates. ] Add additional possible locations for denyhosts, add as a shell spawner. ] Add flanneld as a privileged container, improve grouping for the "x running y" macros, allow denyhosts to spawn shells. ] Handle systemd changing its name to "(systemd)", add sv (part of ) as a program that can write below /etc, allow writing to all `/dev/tty` files. ] Add erlchildsetup as a shell spawner. Thanks to @dkerwin for the useful rule updates. ] ] Add support for gitlab omnibus containers/pods. Thanks to @dkerwin for the useful rule updates. ] Released 2016-12-22 Starting with this release, we're adding a new section "Rule Changes" devoted to changes to the default ruleset `falco_rules.yaml`. Cache event formatting objects so they are not re-created for every falco notification. This can result in significant speedups when the ruleset results in lots of notifications. ] Falco notifications are now throttled by a token bucket, preventing a flood of notifications when many events match a rule. Controlled by the `outputs, rate` and `outputs, max_burst` options. ] When run from a container, you can provide the environment variable `SYSDIGSKIPLOAD` to skip the process of building/loading the kernel module. Thanks @carlsverre for the fix. ] Fully implement `USEBUNDLEDDEPS` within CMakeFiles so you can build with external third-party

] Improve error messages that result when trying to load a rule with a malformed `output:` attribute ] ] Add the ability to write event capture statistics to a file via the `-s <statsfile>` option. ] New configuration option `log_level` controls the verbosity of falco's logging. ] Improve compatibility with Sysdig Cloud Agent build ] Add DNF as non-alerting for RPM and package management. Thanks @djcross for the fix. ] Make `google_containers/kube-proxy` a trusted image, affecting the File Open by Privileged Container/Sensitive Mount by Container rules. ] Add fail2ban-server as a program that can spawn shells. Thanks @jcoetzee for the fix. ] Add systemd as a program that can access sensitive files. Thanks @jcoetzee for the fix. ] Add apt/apt-get as programs that can spawn shells. Thanks @jcoetzee for the fix. ] Released 2016-10-25 As falco depends heavily on sysdig, many changes here were actually made to sysdig and pulled in as a part of the build process. Issues/PRs starting with `sysdig/#XXX` are sysdig changes. Improved visibility into containers: New filter `container.privileged` to match containers running in privileged mode ] ] New rules utilizing privileged state ] New filters `container.mount*` to match container mount points ] New rules utilizing container mount points ] New filter `container.image.id` to match container image id ] Improved visibility into orchestration environments: New k8s.deployment. and k8s.rs. filters to support latest kubernetes features ] Rule changes to avoid FPs when monitoring k8s environments ] Add new options `-pc`/`-pk`/`-pm`/`-k`/`-m` analogous to sysdig command line options. These options pull metadata information from k8s/mesos servers and adjust default falco notification outputs to contain container/orchestration information when applicable. ] ] Improved ability to work with file pathnames: Added `glob` operator for strings, works as classic shell glob path matcher ] Added `pmatch` operator to efficiently test a subject pathname against a set of target pathnames, to see if the subject is a prefix of any target ] ] Add an event generator program that simulates suspicious activity that can be detected by falco. This is also available as a docker image ]. ] ] Changed rule names to be human readable ] Add Copyright notice to all source files ] Changes to docker images to make it easier to massage JSON output for webhooks ] When run with `-v`, print statistics on the number of events processed and dropped ] Add ability to write trace files with `-w`. This can be useful to write a trace file in parallel with live event monitoring so you can reproduce it later. ] All rules can now take an optional `enabled` flag. With `enabled: false`, a rule will not be loaded or run against events. By default all rules are enabled ] Fixed rule FPs related to docker's `docker`/`dockerd` split in 1.12 ] Fixed rule FPs related to sysdigcloud agent software ] Minor changes to node.js example to avoid falco false positives ] Fixed regression that broke configurable outputs ]. This was not broken in 0.3.0, just between 0.3.0 and 0.4.0. Fixed a lua stack leak that could cause problems when matching millions of events against a large set of rules ] Update docker files to reflect changes to `debian:unstable` docker image ] Fixed logic for detecting config files to ensure config files in `/etc/falco.yaml` are properly detected ] ] Don't alert on falco spawning a shell for program output notifications ] Released 2016-08-05 Significantly improved performance, involving changes in the falco and sysdig repositories: Reordering a rule condition's operators to put likely-to-fail operators at the beginning and expensive operators at the

] ] Adding the ability to perform x in (a, b, c, ...) as a single set membership test instead of individual comparisons between x=a, x=b, etc. ] ] Avoid unnecessary string manipulations. ] Using `startswith` as a string comparison operator when possible. ] Use `isopenread`/`isopenwrite` when possible instead of searching through open flags. ] Group rules by event type, which allows for an initial filter using event type before going through each rule's condition. ] ] All of these changes result in dramatically reduced CPU usage. Here are some comparisons between 0.2.0 and 0.3.0 for the following workloads: 's `pts/apache` and `pts/dbench` tests. Sysdig Cloud Kubernetes Demo: Starts a kubernetes environment using docker with apache and wordpress instances + synthetic workloads. : Several elasticsearch, node.js, logstash, mysql, postgres, influxdb instances run under docker-compose. | Workload | 0.2.0 CPU Usage | 0.3.0 CPU Usage | | | | | | pts/apache | 24% | 7% | | pts/dbench | 70% | 5% | | Kubernetes-Demo (Running) | 6% | 2% | | Kubernetes-Demo (During Teardown) | 15% | 3% | | Juttle-examples | 3% | 1% | As a part of these changes, falco now prefers rule conditions that have at least one `evt.type=` operator, at the beginning of the condition, before any negative operators (i.e. `not` or `!=`). If a condition does not have any `evt.type=` operator, falco will log a warning like: ``` Rule no_evttype: warning (no-evttype): proc.name=foo did not contain any evt.type restriction, meaning it will run for all event types. This has a significant performance penalty. Consider adding an evt.type restriction if possible. ``` If a rule has a `evt.type` operator in the later portion of the condition, falco will log a warning like: ``` Rule evttypenotequals: warning (trailing-evttype): evt.type!=execve does not have all evt.type restrictions at the beginning of the condition, or uses a negative match (i.e. "not"/"!=") for some evt.type restriction. This has a performance penalty, as the rule can not be limited to specific event types. Consider moving all evt.type restrictions to the beginning of the rule and/or replacing negative matches with positive matches if possible. ``` Several sets of rule cleanups to reduce false positives. ] Add example of how falco can detect abuse of a badly designed REST API. ] Add a new output type "program" that writes a formatted event to a configurable program. Each notification results in one invocation of the program. A common use of this output type would be to send an email for every falco notification. ] ] Add the ability to run falco on all events, including events that are flagged with `EFDROPFALCO`. (These events are high-volume, low-value events that are ignored by default to improve performance). ] ] Add third-party jq library now that sysdig requires it. ] Released 2016-06-09 For full handling of setsid system calls and session id tracking using `proc.sname`, falco requires a sysdig version >= 0.10.0. Add TravisCI regression tests. Testing involves a variety of positive, negative, and informational trace files with both plain and json output. ] ] Fairly big rework of ruleset to improve coverage, reduce false positives, and handle installation environments effectively ] ] Not directly a code change, but mentioning it here--the Wiki has now been populated with an initial set of articles, migrating content from the README and adding detail when necessary. ] Improve JSON output to include the rule name, full output string, time, and severity ] Improve CMake quote handling ] Remove unnecessary NULL check of a delete ] Released 2016-05-17 Initial release. Subsequent releases will have "Major Changes", "Minor Changes", and "Bug