falco-talon - GitLite

KO | EN

gitlite — search

#python #hacktoberfest #react #typescript #golang #machine-learning #docker #awesome #cli #awesome-list #pytorch #mcp #openai #open-source

falco-talon

(★ 214)

Response Engine for managing threats in your Kubernetes

파일 탐색기

최종 버전 다운로드 (.zip)

- - lint.yml
  - main.yml
  - pr.yaml
  - release.yml
  - test.yml
- dependabot.yml
- PULL_REQUEST_TEMPLATE.md
- actionners.go
- actionners_test.go
- actionners.go
- notifiers.go
- notifiers_test.go
- outputs.go
- root.go
- rule_validation.go
- rule_validation_test.go
- rules.go
- server.go
- version.go
- configuration.go
- configuration_test.go
- version.go
- - docker-compose.yaml
- - context.go
- - events.go
  - events_test.go
- - handler.go
- - models.go
- - nats.go
- - priority.go
  - rules.go
  - rules_test.go
- - elasticsearch.go
  - elasticsearch_test.go
  - mapping.go
- - client.go
- - k8sevents.go
  - k8sevents_test.go
- - loki.go
  - loki_test.go
- - slack.go
- - smtp.go
  - smtp_test.go
  - templates.go
- - webhook.go
- notifiers.go
- - file.go
- - gcs.go
- - helpers.go
  - helpers_test.go
- - minio.go
- outputs.go
- utils.go
- utils_test.go
.air.toml
.gitignore
.golangci.yml
.goreleaser.yml
.ko.yaml
CHANGELOG.md
config_example.yaml
examples.txt
go.mod
go.sum
LICENSE
mageFile.go
main.go
OWNERS
README.md
rules.yaml
rules_override.yaml

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/falcosecurity/falco-talon

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd falco-talon

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

docker compose up -d

정의된 모든 컨테이너(서버, DB 등)를 한 번에 빌드하고 백그라운드에서 실행합니다.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

3. Go

보통

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Go Go 언어 컴파일러 및 도구 모음입니다.

go build ./...

Go 프로그램을 컴파일해 실행 파일을 만듭니다.

go run .

따로 빌드하지 않고 바로 Go 프로그램을 실행합니다.

✅ 빌드가 에러 없이 끝나면 성공입니다. go run . 을 썼다면 터미널 출력을 확인하세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Falco Talon

[![Falco Ecosystem Repository](https://raw.githubusercontent.com/falcosecurity/evolution/refs/heads/main/repos/badges/falco-ecosystem-blue.svg)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#ecosystem-scope) [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating)
[![Last Release](https://img.shields.io/github/v/release/falcosecurity/falco-talon?style=for-the-badge)](https://github.com/falcosecurity/falco-talon/releases/latest)

![last commit](https://img.shields.io/github/last-commit/falcosecurity/falco-talon?style=for-the-badge
)
![licence](https://img.shields.io/github/license/falcosecurity/falco-talon?style=for-the-badge
)
![docker pulls](https://img.shields.io/docker/pulls/falcosecurity/falco-talon?style=for-the-badge
)

`Falco Talon` is a Response Engine for managing threats in your Kubernetes. It enhances the solutions proposed by the Falco community with a no-code tailor made solution. With easy rules, you can react to `events` from [`Falco`](https://falco.org) in milliseconds.

- [Falco Talon](#falco-talon)
  - [Architecture](#architecture)
    - [Glossary](#glossary)
    - [Actionners](#actionners)
    - [Notifiers](#notifiers)
    - [Outputs](#outputs)
    - [Configuration](#configuration)
    - [Rules](#rules)
  - [Documentation](#documentation)
  - [Metrics](#metrics)
    - [Prometheus metrics](#prometheus-metrics)
    - [OTEL metrics](#otel-metrics)
  - [Traces](#traces)
  - [Docker images](#docker-images)
  - [Deployment](#deployment)
    - [Helm](#helm)
      - [Configure Falcosidekick](#configure-falcosidekick)
  - [Development](#development)
  - [License](#license)
  - [Author](#author)

## Architecture

`Falco Talon` can receive the `events` from [`Falco`](https://falco.org) or [`Falcosidekick`](https://github.com/falcosecurity/falcosidekick):

```mermaid
flowchart LR
    falco
    falcosidekick
    falco-talon
    falco -- event --> falcosidekick
    falco -- event --> falco-talon
    falcosidekick -- event --> falco-talon
    kubernetes -- context --> falco-talon
    falco-talon -- action --> aws
    falco-talon -- output --> minio
    falco-talon -- action --> kubernetes
    falco-talon -- notification --> slack
```

### Glossary

* `event`: an event detected by `Falco` and sent to its outputs
* `rule`: defines criterias for linking the events with the actions to apply
* `action`: each rule can sequentially run actions, each action refers to an actionner
* `actionner`: defines what the action will do
* `notifier`: defines what outputs to notify with the result of the action
* `context`: composed of elements from the original Falco event, from Falco Talon and other sources, these elements can be used to dynamically configure the actions to perform.
* `output`: defines the target where to store the resulting artifact that might has been created by an actionner

### Actionners

The list of the available actionners can be found [HERE](https://falco-talon.github.io/docs/actionners/list/).

### Notifiers

The list of the available actionners can be found [HERE](https://falco-talon.github.io/docs/notifiers/list/).

### Outputs

The list of the available outputs can be found [HERE](https://falco-talon.github.io/docs/outputs/list/).

### Configuration

The static configuration of `Falco Talon` is set with a `.yaml` file (default: `./config.yaml`) or with environment variables.

The list of the available settings can be found [HERE](https://falco-talon.github.io/docs/configuration/).

### Rules

You can find how to write your own rules [HERE](https://falco-talon.github.io/docs/rules/).

## Documentation

The full documentation is available on its own website: [https://falco-talon.github.io/docs](https://falco-talon.github.io/docs).

## Metrics

### Prometheus metrics

The `/metrics` endpoint exposes some metrics in the Prometheus format. See [here](https://falco-talon.github.io/docs/installation_usage/metrics#prometheus-metrics).

### OTEL metrics

`Falco Talon` can export its metrics in the OTEL Metrics format. See [here](https://falco-talon.github.io/docs/installation_usage/metrics#otel-metrics).

## Traces

`Falco Talon` can export traces in the OTEL Traces format. See [here](https://falco-talon.github.io/docs/installation_usage/traces).

## Docker images

The docker images for `falco-talon` are built using [ko](https://github.com/google/ko)

To generate the images to test locally you can run `mage buildImagesLocal`

## Deployment

### Helm

The helm chart is available in the repo [`charts`](https://github.com/falcosecurity/charts/tree/master/charts/falco-talon).

Two config files are provided:
* `values.yaml` allows you to configure `Falco Talon` and the deployment, the list of available values is [here](https://github.com/falcosecurity/charts/tree/master/charts/falco-talon#configuration)
* `rules.yaml` contains rules to set

```shell
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
helm install falco-talon falcosecurity/falco-talon -n falco --create-namespace
```

#### Configure Falcosidekick

Once you have installed `Falco Talon` with Helm, you need to connect `Falcosidekick` by adding the flag `--set falcosidekick.config.talon.address=http://falco-talon:2803`

```shell
helm install falco falcosecurity/falco --namespace falco \
  --create-namespace \
  --set tty=true \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.talon.address=http://falco-talon:2803
```

## Development

A [Docker Compose stack](./deployment/compose) is provided for local developments and tests.

This stack starts these services:
- **Grafana**: accessible at http://localhost:3000
- **OTEL Collector**
- **Prometheus**: accessible at http://localhost:9090
- **Grafana Tempo**
- **Minio**: accessible at http://localhost:9001 (root/changeme123)

To start the stack:
```shell
cd deployment/compose
docker compose up -d
```

## License

Falco Talon is licensed to you under the [Apache 2.0](./LICENSE) open source license.

## Author

Thomas Labarussias (https://github.com/Issif)