Falco Talon v0.2.0

Today we announce the release of Falco Talon 0.2.0 🦅!

Falco Talon 0.2.0 is a minor release that includes new actionners and outputs, add parameters to existing actionners, along one small fix on the check and print commands.

Features

• Add gcp:function actionner:
  • Now users can call GCP function to automate GCP tasks, with authentication and authorization out of the box.

- action: Invoke GCP function
  actionner: gcp:function
  additional_contexts:
    - aws
  parameters:
    gcp_function_name: simple-http-function
    gcp_function_location: us-central1

• Add gcp:gcs output
  • Now users can send output directly to GCP Google Cloud Storage, same way as s3 and minio existing outputs.
• Add ignore_standalone_pods parameter for kubernetes:terminate actionner
• Allow to wait until the completion of kubernetes:drain by configuring max_wait_period and wait_period_excluded_namespaces
• Use smaller image for the kubernetes:tcpdump actionner

Fixes

• An existing config.yaml file is not required anymore to check the syntax of your rules files.

Try it! 🏎️

In case you just want to try out the Falco Talon 0.2.0, you can install the helm chart following the instructions on the documentation

Let's meet 🤝

We meet every Wednesday in our community calls, if you want to know the latest and the greatest, you should join us there!

If you have any questions

• Join the #falco channel on the Kubernetes Slack
• Join the Falco mailing list

Thanks to all the amazing contributors!

Enjoy 😎,

Igor