falcosecurity/falco issues and pull requests

#3295 - Add demo environment instructions and docker-config files

Pull Request - State: closed - Opened by bbl232 6 months ago - 4 comments
Labels: dco-signoff: yes, lgtm, release-note-none, size/M, approved

#3287 - [Feature request] Able to extract all available fields into output_fields

Issue - State: open - Opened by AmberSecurity 6 months ago - 4 comments
Labels: kind/feature

#3287 - [Feature request] Able to extract all available fields into output_fields

Issue - State: open - Opened by AmberSecurity 6 months ago - 1 comment
Labels: kind/feature, lifecycle/stale

#3285 - Falco doesn't update/sync with system time after start

Issue - State: open - Opened by illethrias 7 months ago - 3 comments
Labels: kind/bug

#3284 - Falco Installtion on k8s cluster runing on vagrant vms

Issue - State: open - Opened by brahgithubsal 7 months ago - 3 comments
Labels: kind/bug, lifecycle/rotten

#3281 - Falco hogs all memory and crashes server upon invalid yaml

Issue - State: closed - Opened by MprBol 7 months ago - 13 comments
Labels: kind/bug

#3279 - Support multiple container runtime in one node

Issue - State: closed - Opened by hitsub2 7 months ago - 6 comments
Labels: kind/feature

#3278 - Falco crash after few minutes on GKE 1.27 on COS

Issue - State: closed - Opened by judikag03 7 months ago - 26 comments
Labels: kind/bug

#3277 - [Proposal] Allow for custom outputs wrapper fields

Issue - State: open - Opened by incertum 7 months ago - 16 comments
Labels: kind/feature

#3275 - Falco 0.37.1 crashes with "could not parse param 13 (comm) for event of type 223 (clone): expected length 10, found 14"

Issue - State: open - Opened by kanishk7bantu 7 months ago - 4 comments
Labels: kind/bug, lifecycle/stale

#3275 - Falco 0.37.1 crashes with "could not parse param 13 (comm) for event of type 223 (clone): expected length 10, found 14"

Issue - State: closed - Opened by kanishk7bantu 7 months ago - 7 comments
Labels: kind/bug, lifecycle/rotten

#3273 - new(docker): streamline docker images

Pull Request - State: closed - Opened by FedeDP 7 months ago - 8 comments
Labels: kind/feature, release-note, dco-signoff: yes, lgtm, approved, size/XXL, area/build

#3270 - CI pipeline uses CentOS 7 which is EOL

Issue - State: closed - Opened by johananl 7 months ago - 7 comments
Labels: kind/release

#3269 - Memory usage keeps increasing until OOM

Issue - State: closed - Opened by ciprian2k 7 months ago - 15 comments
Labels: kind/bug

#3259 - support raw log output and capturing the full command line

Issue - State: closed - Opened by Jumbo-WJB 8 months ago - 5 comments
Labels: kind/feature, lifecycle/stale

#3258 - Create `container_engines` configs in `falco.yaml`

Issue - State: closed - Opened by incertum 8 months ago - 2 comments
Labels: kind/feature

#3257 - Undetected container/k8s information leads to alert fatigue caused by k8s_containers macro

Issue - State: closed - Opened by aberezovski 8 months ago - 8 comments
Labels: kind/bug, lifecycle/rotten

#3256 - Missing container and k8s details except container.id in case of least privileged falco

Issue - State: open - Opened by aberezovski 8 months ago - 7 comments
Labels: kind/bug, lifecycle/stale

#3255 - [TRACKING] Rules syntax enhancements (backward-compatible)

Issue - State: open - Opened by leogr 8 months ago - 2 comments
Labels: kind/feature

#3254 - [UMBRELLA] Streamlining `falco.yaml` structure

Issue - State: open - Opened by leogr 8 months ago - 2 comments
Labels: kind/feature

#3246 - Missing event metadata

Issue - State: closed - Opened by imreczegledi-form3 8 months ago - 6 comments
Labels: kind/bug, lifecycle/rotten

#3244 - Unable to find the rebuild driver for kernel `5.10.217-205.860.amzn2.x86_64` on AWS EKS version 1.26

Issue - State: closed - Opened by kg-ops 8 months ago - 5 comments
Labels: kind/bug, lifecycle/rotten

#3243 - Falco 0.38.0 - k8s specific fields are not populated any more

Issue - State: open - Opened by networkhell 8 months ago - 34 comments
Labels: kind/bug, lifecycle/stale

#3235 - [proposal/discussion] specify Falco additional outputs in the configuration file

Issue - State: closed - Opened by LucaGuerra 8 months ago - 14 comments
Labels: kind/feature

#3234 - name=<NA> pid=-1 Unable to collect proc.name and proc.pid, etc.

Issue - State: closed - Opened by ox01024 8 months ago - 7 comments
Labels: kind/support

#3226 - [TRACKING] Breaking changes in Falco 0.40.0

Issue - State: closed - Opened by LucaGuerra 8 months ago - 8 comments
Labels: kind/documentation

#3223 - Falco running on windows clusters, like windows nano

Issue - State: closed - Opened by ajinkya1986 8 months ago - 5 comments
Labels: kind/feature, lifecycle/rotten

#3216 - add attestation for falco

Pull Request - State: closed - Opened by cpanato 9 months ago - 18 comments
Labels: kind/feature, release-note, dco-signoff: yes, lgtm, size/M, approved, area/build, kind/release

#3202 - grpc: Handshake failed with fatal error SSL_ERROR_SSL:

Issue - State: closed - Opened by jmvizcainoio 9 months ago - 4 comments
Labels: kind/bug, lifecycle/rotten

#3195 - How to add a condition with "not contains"

Issue - State: closed - Opened by jobinmat 9 months ago - 5 comments
Labels: kind/documentation, lifecycle/rotten

#3194 - [TRACKING] `metrics` framework future refactors / cleanups

Issue - State: open - Opened by incertum 9 months ago - 19 comments
Labels: kind/feature

#3176 - feat(docker/no-driver/Dockerfile.no-falcoctl-distroless): Provide distroless falco image without falcoctl

Pull Request - State: closed - Opened by killerkenobi 10 months ago - 8 comments
Labels: kind/feature, release-note, dco-signoff: yes, size/M, area/build

#3176 - feat(docker/no-driver/Dockerfile.no-falcoctl-distroless): Provide distroless falco image without falcoctl

Pull Request - State: closed - Opened by killerkenobi 10 months ago - 8 comments
Labels: kind/feature, release-note, dco-signoff: yes, size/M, area/build

#3175 - cleanup(docs): fix typo in license blocks

Pull Request - State: closed - Opened by LucaGuerra 10 months ago - 2 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, size/S, approved, area/tests

#3174 - Proposal/discussion: More flexible ways to enable/disable rules from configuration

Issue - State: open - Opened by LucaGuerra 10 months ago - 4 comments
Labels: kind/feature

#3173 - chore(docker,scripts): set old eBPF probe as lowest priority driver.

Pull Request - State: closed - Opened by FedeDP 10 months ago - 3 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, size/S, approved

#3172 - unable to find a prebuilt driver

Issue - State: closed - Opened by YAYAXZM 10 months ago - 11 comments
Labels: kind/documentation, lifecycle/rotten

#3170 - build(deps): Bump submodules/falcosecurity-rules from `869c9a7` to `ec255e6`

Pull Request - State: closed - Opened by dependabot[bot] 10 months ago - 3 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#3169 - update(app): close inspectors at teardown time

Pull Request - State: closed - Opened by LucaGuerra 10 months ago - 4 comments
Labels: kind/cleanup, area/engine, dco-signoff: yes, lgtm, release-note-none, size/M, approved

#3168 - fix(docker): fixed docker entrypoints for driver loading.

Pull Request - State: closed - Opened by FedeDP 10 months ago - 5 comments
Labels: kind/bug, dco-signoff: yes, lgtm, release-note-none, approved, size/L, area/build

#3167 - new(engine): raise warning instead of error on invalid macro/list name

Pull Request - State: closed - Opened by mrgian 10 months ago - 4 comments
Labels: release-note, dco-signoff: yes, lgtm, size/M, approved

#3166 - fix(docker,scripts): do not load falcoctl driver loader when installing Falco deb package in docker images

Pull Request - State: closed - Opened by FedeDP 10 months ago - 3 comments
Labels: kind/bug, dco-signoff: yes, lgtm, release-note-none, approved, size/XS, area/build

#3165 - [Proposal] Streamlining docker images

Issue - State: closed - Opened by leogr 10 months ago - 16 comments
Labels: kind/feature

#3164 - kmod gets compiled for the wrong kernel version

Issue - State: closed - Opened by johananl 10 months ago - 20 comments
Labels: kind/bug, lifecycle/rotten

#3163 - Pr Test Eco-CI

Pull Request - State: closed - Opened by ArneTR 10 months ago - 4 comments
Labels: do-not-merge/release-note-label-needed, dco-signoff: no, size/M

#3162 - chore(userspace/falco): deprecate old 'rules_file' config key.

Pull Request - State: closed - Opened by FedeDP 10 months ago - 9 comments
Labels: kind/cleanup, area/engine, release-note, dco-signoff: yes, lgtm, size/M, approved

#3161 - update(ci): build both release and debug versions

Pull Request - State: closed - Opened by LucaGuerra 10 months ago - 2 comments
Labels: kind/cleanup, dco-signoff: yes, lgtm, release-note-none, size/S, approved, area/ci

#3160 - chore(userspace/falco): watch all configs files.

Pull Request - State: closed - Opened by FedeDP 10 months ago - 3 comments
Labels: kind/cleanup, area/engine, dco-signoff: yes, lgtm, release-note-none, size/S, approved

#3159 - new(engine): raise warning instead of error on not-unique exceptions names

Pull Request - State: closed - Opened by mrgian 10 months ago - 5 comments
Labels: area/engine, release-note, dco-signoff: yes, lgtm, size/S, approved

#3158 - chore(falco): update falco libs to latest master

Pull Request - State: closed - Opened by LucaGuerra 10 months ago - 3 comments
Labels: kind/feature, release-note, dco-signoff: yes, lgtm, approved, size/XS, area/build

#3157 - Standardisation capability of Falco rule output

Issue - State: closed - Opened by samsson 10 months ago - 8 comments
Labels: kind/feature, lifecycle/rotten

#3156 - build(deps): Bump submodules/falcosecurity-rules from `88a40c8` to `869c9a7`

Pull Request - State: closed - Opened by dependabot[bot] 10 months ago - 2 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#3155 - Falco pods CrashLoopBackOff in Minikube Cluster

Issue - State: closed - Opened by m-muzammil786 10 months ago - 7 comments
Labels: needs-kind, lifecycle/rotten

#3154 - update(cmake,scripts): bumped falcoctl to v0.8.0-rc1 and set modern eBPF as default driver + enable automatic driver selection logic

Pull Request - State: closed - Opened by FedeDP 10 months ago - 3 comments
Labels: release-note, dco-signoff: yes, lgtm, approved, size/L, area/build, kind/release

#3153 - fix(ci): update scorecard-action to v2.3.1

Pull Request - State: closed - Opened by LucaGuerra 10 months ago - 3 comments
Labels: kind/bug, dco-signoff: yes, lgtm, release-note-none, approved, size/XS, area/ci

#3152 - Events sometimes missing values for certain keys?

Issue - State: closed - Opened by zestysoft 10 months ago - 1 comment
Labels: kind/bug

#3151 - update(build): bump libs to latest master

Pull Request - State: closed - Opened by LucaGuerra 11 months ago - 3 comments
Labels: kind/feature, release-note, dco-signoff: yes, lgtm, size/S, approved, area/build

#3150 - cleanup(falco): consolidate falco::grpc::server in one class

Pull Request - State: closed - Opened by LucaGuerra 11 months ago - 3 comments
Labels: kind/cleanup, area/engine, dco-signoff: yes, lgtm, release-note-none, approved, size/L

#3149 - falcoSchema.json should be generated by Falco itself

Issue - State: closed - Opened by leogr about 1 year ago - 9 comments
Labels: help wanted, kind/feature

#3148 - WIP: [TRACKING] Falco 1.0 items

Issue - State: open - Opened by leogr 11 months ago - 5 comments
Labels: kind/feature

#3147 - new(build): enable ASan and UBSan builds with options and in CI

Pull Request - State: closed - Opened by LucaGuerra 11 months ago - 6 comments
Labels: kind/feature, dco-signoff: yes, lgtm, release-note-none, size/M, approved, area/ci

#3146 - fix(cmake): fix USE_BUNDLED_DEPS=ON and BUILD_FALCO_UNIT_TESTS=ON

Pull Request - State: closed - Opened by LucaGuerra 11 months ago - 4 comments
Labels: kind/bug, dco-signoff: yes, lgtm, release-note-none, approved, size/XS, area/build

#3145 - build(deps): Bump submodules/falcosecurity-rules from `fbf0a4e` to `88a40c8`

Pull Request - State: closed - Opened by dependabot[bot] 11 months ago - 2 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#3144 - Event rule "Terminal shell in container" produces multiple duplicates

Issue - State: open - Opened by lyubomirk 11 months ago - 1 comment
Labels: kind/bug

#3143 - Add --kernelversion and --kernelrelease options to falco driver loader entrypoint

Pull Request - State: closed - Opened by Sryther 11 months ago - 5 comments
Labels: kind/feature, dco-signoff: yes, lgtm, release-note-none, size/M, approved, area/proposals

#3142 - libcurl failed to perform call: Couldn't resolve host name

Issue - State: closed - Opened by didlawowo 11 months ago - 2 comments
Labels: kind/bug

#3140 - feat(webserver): implement metrics endpoint

Pull Request - State: open - Opened by sgaist 11 months ago - 14 comments
Labels: kind/feature, area/engine, size/XL, release-note, dco-signoff: yes

#3139 - build(deps): Bump submodules/falcosecurity-rules from `44addef` to `fbf0a4e`

Pull Request - State: closed - Opened by dependabot[bot] 11 months ago - 3 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#3138 - [tracking] Improve code documentation

Issue - State: closed - Opened by sgaist 11 months ago - 8 comments
Labels: kind/documentation, lifecycle/rotten

#3137 - chore: bump to latest libs commit

Pull Request - State: closed - Opened by Andreagit97 11 months ago - 4 comments
Labels: kind/feature, dco-signoff: yes, lgtm, release-note-none, size/S, approved, area/build

#3136 - build(deps): Bump submodules/falcosecurity-rules from `dc7970d` to `44addef`

Pull Request - State: closed - Opened by dependabot[bot] 11 months ago - 3 comments
Labels: dco-signoff: yes, lgtm, release-note-none, approved, size/XS, dependencies, submodules

#3135 - fix(engine): apply output substitutions for all sources

Pull Request - State: closed - Opened by mrgian 11 months ago - 4 comments
Labels: kind/bug, area/engine, release-note, dco-signoff: yes, lgtm, approved, size/XS

#3134 - new(engine): enforce unique exceptions names

Pull Request - State: closed - Opened by mrgian 11 months ago - 7 comments
Labels: kind/bug, kind/feature, area/engine, release-note, dco-signoff: yes, lgtm, size/M, approved, area/tests

#3133 - new(engine): add warning when appending an exception with no values

Pull Request - State: closed - Opened by mrgian 11 months ago - 6 comments
Labels: kind/bug, kind/feature, area/engine, release-note, dco-signoff: yes, lgtm, approved, size/L, area/tests

#3132 - [TRACKING] Expand Falco metrics w/ rules counters -> deprecate falco-exporter + new Grafana dashboard for Falco metrics

Issue - State: open - Opened by incertum 11 months ago - 1 comment
Labels: kind/feature

GitHub / falcosecurity/falco issues and pull requests