Falco supported events

[leogr]

What to document

After discussing with @Andreagit97 about recent changes and minor breaking changes (eg,e.g.-Awill not be applied anymore when reading from.scap` files), we decided to create a table, so it was clear what will be the expected outcome for Falco 0.33.0.

Ref falcosecurity/falco#2201

The documentation (and maybe other places like the help usage of the command line) may need to be updated accordingly.

/milestone 0.33.0

cc @falcosecurity/falco-maintainers @falcosecurity/libs-maintainers

Falco supported events

Category	evt.type	Default (without -A)	With -A	.scap file
EC_PLUGIN	plugin	Yes	Yes	Yes
EC_SYSCALL	various	Only syscalls in simple_set	All	All, including EF_OLD_VERSION
EC_TRACEPOINT	procexit, switch, signaldeliver, page_fault	procexit	All	All, including EF_OLD_VERSION
EC_INTERNAL	container, useradded, userdeleted, groupadded, groupdeleted and other internal events	Only container, useradded, userdeleted, groupadded, groupdeleted	All	All, including EF_OLD_VERSION

Notes:

• EF_OLD_VERSION are never generated when live mode, but they may be present in .scap files
• Since the new Falco version won't apply any userspace pre-filtering, -A is implicit when reading from .scap
• EC_PLUGIN is not yet present in libs, but our plan is to insert it soon

[Andreagit97]

EC_PLUGIN is not yet present in libs, but our plan is to insert it soon

Added here falcosecurity/libs#622

[jasondellaluce]

@Andreagit97 @leogr I think this is solved for the scope of Falco 0.33.0, but it may be worth adding it on the Falco website (or the some libs internal document) instead of closing this. What do you think?

[leogr]

it may be worth adding it on the Falco website

Definitively yes 👍

[Andreagit97]

makes sense but before doing that we have to update it, since the actual logic is not exactly as described here, but for sure we can update this issue until the design is ended and after that, we can move it to the documentation :)

[jasondellaluce]

For clarity, I'm gonna move this issue to falcosecurity/falco-website.

[leogr]

Hey @Andreagit97 @jasondellaluce

I've lost track of this. Any progress?

[jasondellaluce]

This still has to be documented

[leogr]

Hey @vjjmiras could you help with this?

[vjjmiras]

Is it possible to obtain this information automatically from the falco binary or any other single source of truth (like a file in the falco repo)?

Instead of updating the website whenever this changes, we should import the information automatically.

[leogr]

Is it possible to obtain this information automatically from the falco binary or any other single source of truth (like a file in the falco repo)?

I don't think it's possible now, but perhaps we can do something using our libs? cc @FedeDP @Andreagit97

Instead of updating the website whenever this changes, we should import the information automatically.
👍

[Andreagit97]

let's say we still need to work on the code side (we have to add a new flag about internal events and discuss which events Falco should receive) so let's say I will keep the issue opened just to remember us to document it but before doing that we need to complete the feature with all the details in this way we can avoid to change the doc the next month 😆

And yes @vjjmiras the unique source of truth will be in libs repo, in the source code, not exposed by a binary, but we can talk about that when the feature will be complete, so probably next Falco release :)

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[leogr]

cc @therealbobo

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[therealbobo]

/remove-lifecycle stale