Falco Talon
is a Response Engine for managing threats in your Kubernetes. It enhances the solutions proposed by the Falco community with a no-code tailor made solution. With easy rules, you can react to events
from Falco
in milliseconds.
Falco Talon
can receive the events
from Falco
or Falcosidekick
:
┌──────────┐ ┌───────────────┐ ┌─────────────┐
│ Falco ├──────► Falcosidekick ├──────► Falco Talon │
└──────────┘ └───────────────┘ └─────────────┘
or
┌──────────┐ ┌─────────────┐
│ Falco ├──────► Falco Talon │
└──────────┘ └─────────────┘
event
: an event detected byFalco
and sent to its outputsrule
: defines criterias for linking the events with the actions to applyaction
: each rule can sequentially run actions, each action refers to an actionneractionner
: defines what the action will donotifier
: defines what outputs to notify with the result of the action
The list of the available actionners can be found HERE.
The list of the available actionners can be found HERE.
The static configuration of Falco Talon
is set with a .yaml
file (default: ./config.yaml
) or with environment variables.
The list of the available settings can be found HERE.
You can find how to write your own rules HERE.
The documentation is available on its own website: https://docs.falco-talon.org/docs.
The /metrics
endpoint exposes some metrics in the Prometheus format. See here.
The docker images for falco-talon
are built using ko
To generate the images to test locally you can run mage buildImagesLocal
The helm chart is available in the folder deployment/helm
.
Two config files are provided:
values.yaml
allows you to configureFalcon Talon
and the deploymentrules.yaml
contains rules to set
cd deployment/helm/
helm install falco-talon . -n falco --create-namespace
Once you have installed Falco Talon
with Helm, you need to connect Falcosidekick
by adding the flag --set falcosidekick.config.webhook.address=http://falco-talon:2803
helm install falco falcosecurity/falco --namespace falco \
--create-namespace \
--set tty=true \
--set falcosidekick.enabled=true \
--set falcosidekick.config.webhook.address=http://falco-talon:2803
Falco Talon is licensed to you under the Apache 2.0 open source license.
Thomas Labarussias (https://github.com/Issif)