-
**Description**
I am attempting to include additional rule files including the sandbox and incubating rules. I'm doing this in a Helm chart using the following documentation [here](https://falco.or…
-
**Describe the bug**
Pn 0.34.x releases we do experience mem leak on physical instances, while the same setup on AWS is fine. It could be due node workload, but still its clear mem leak.
Actuall…
epcim updated
2 weeks ago
-
**Motivation**
With the introduction of the new Falco plugin system and the new 2.X Helm charts, it's not always really required to run the Falco pod as root. Nevertheless, Falco still does this wh…
-
**Describe the bug**
On startup, Falco appears to completely hang when using a rule that includes a large list of domains as a condition. Throughout this period, it appears as though Falco is entir…
-
**What would you like to be added**:
Context: Falcoctl can retrieve the rules files from OCI when doing `falcoctl artifact install`. However when the artifacts are all installed, I also have so…
-
This issue keeps track of all deprecated Falco features that will be removed in Falco 1.0.0:
* `append` in Falco rule is deprecated in favor of `override` (see https://github.com/falcosecurity/falc…
-
Hello,
My team and I have recently encountered an issue where alerts triggered by the "Privileged Shell Spawned in Container" rule are missing container-related details.
Example of Alert Output:…
-
**Motivation**
This issue is to track the development progress for a new `anomalydetection` plugin, as outlined in the [Proposal](https://github.com/falcosecurity/falco/blob/master/proposals/202306…
-
**Describe the bug**
The SDK allows code like the following to run:
```go
func init() {
p1 := &SomePlugin{}
p2 := &AnotherPlugin{}
source.Register(p1)
extractor.Register(p2)…
-
**Motivation**
Tracking pending cleanups, refactors or additional features for the Falco internal metrics framework https://falco.org/docs/metrics/
```[tasklist]
### Tasks
```