Assets 2

Released 2018-11-09

Major Changes

  • Support for K8s Audit Events : Falco now supports K8s Audit Events as a second stream of events in addition to syscalls. For full details on the feature, see the wiki.

  • Transparent Config/Rule Reloading: On SIGHUP, Falco will now reload all config files/rules files and start processing new events. Allows rules changes without having to restart falco [#457] [#432]

Minor Changes

  • The reference integration of falco into a action engine now supports aws actions like lambda, etc. [#460]

  • Add netcat to falco docker images, which allows easier integration of program outputs to external servers [#456] [#433]

Bug Fixes

  • Links cleanup related to the draios/falco -> falcosecurity/falco move [#447]

  • Properly load/unload kernel module when the falco service is started/stopped [#459] [#418]

Rule Changes

  • Better coverage (e.g. reduced FPs) for critical stack, hids systems, ufw, cloud-init, etc. [#445]

  • New rules Launch Package Management Process in Container, Netcat Remote Code Execution in Container, and Lauch Suspicious Network Tool in Container look for running various suspicious programs in a container. [#461]

  • Misc changes to address false positives in GKE, Istio, etc. [#455] [#439]

Oct 1, 2018
Merge remote-tracking branch 'origin/dev' into agent-master

@mstemm mstemm released this Sep 11, 2018 · 44 commits to dev since this release

Assets 2

Released 2018-09-11

Bug Fixes

  • Fig regression in libcurl configure script [#416]

@mstemm mstemm released this Sep 11, 2018 · 40 commits to master since this release

Assets 2

v0.12.0

Released 2018-09-11

Major Changes

  • Improved IPv6 Support to fully support use of IPv6 addresses in events, connections and filters [#sysdig/1204]

  • Ability to associate connections with dns names: new filterchecks fd.*ip.name allow looking up the DNS name for a connection's IP address. This can be used to identify or restrict connections by dns names e.g. evt.type=connect and fd.sip.name=github.com. [#412] [#sysdig/1213]

  • New filterchecks user.loginuid and user.loginname can be used to match the login uid, which stays consistent across sudo/su. This can be used to find the actual user running a given process [#sysdig/1189]

Minor Changes

  • Upgrade zlib to 1.2.11, openssl to 1.0.2n, and libcurl to 7.60.0 to address software vulnerabilities [#402]
  • New endswith operator can be used for suffix matching on strings [#sysdig/1209]

Bug Fixes

  • Better control of specifying location of lua source code [#406]

Rule Changes

  • None for this release.

@mstemm mstemm released this Jul 31, 2018 · 45 commits to master since this release

Assets 2

Released 2018-07-31

Bug Fixes

  • Fix a problem that caused the kernel module to not load on certain kernel versions [#397] [#394]