Falco 0.8.1 Released

We just released Falco 0.8.1. This has a great list of new features and rule improvements.

\r\r

Rule Improvements

\r\r

The ruleset has undergone a major set of updates to reduce false positives and improve coverage. Nearly every rule has been modified. These improvements were based on beta testing with existing Sysdig customers and represent thousands of hours of real-world usage with the ruleset. Thanks so much to all of the beta customers for the valuable feedback and testing!

\r\r

Local vs Default Rules

\r\r

Starting with Falco 0.8.1, falco officially supports the notion of a default rules file and a local rules file. This has previously been supported by running falco with multiple -r arguments, but in 0.8.1 we're formalizing this notion to make it easier to customize falco's behavior but still retain access to rule changes as a part of software upgrades.

\r\r

The intent is that the default rules file remains unmodified and is replaced with every new release, while the local rules file contains extensions and modifications to the default rules file. The default rules file has been moved from /etc/falco_rules.yaml to /etc/falco/falco_rules.yaml. The local rules file is now at /etc/falco/falco_rules.local.yaml. We also moved the falco config file from /etc/falco.yaml to /etc/falco/falco.yaml for consistency.

\r\r

The RPM/Debian Falco packages now flag all 3 config files as config files, so they are not overwritten/removed on upgrade if they have been locally modified.

\r\r

Extendable Rules, Macros, and Lists

\r\r

To further support the notion of extensibility, we made it easier to extend lists/macros/rules in a local rules file by adding an append attribute. If true, the contents of the later list/macro/rule are added to an existing list/macro/rule with the same name. Here's an example:

\r\r

/etc/falco/falco_rules.yaml

\r\r- list: my_programs\r
items: [ls, cat, pwd]\r
\r
- macro: access_file\r
condition: evt.type=open\r
\r
- rule: program_accesses_file\r
desc: track whenever a set of programs opens a file\r
condition: proc.name in (cat, ls) and evt.type=open\r
output: a tracked program opened a file (user=%user.name command=%proc.cmdline file=%fd.name)\r
priority: INFO\r
\r\r

/etc/falco/falco_rules.local.yaml

\r\r- list: my_programs\r
append: true\r
items: [cp]\r
\r
- macro: access_file\r
append: true\r
condition: or evt.type=openat\r
\r
- rule: program_accesses_file\r
append: true\r
condition: and not user.name=root\r
\r\r

The list my_programs would contain the programs [ls, cat, pwd, cp]. The condition for the access_file macro would be evt.type=open or evt.type=openat. The condition for the program_accesses_file rule would be proc.name in (cat, ls) and evt.type=open and not user.name=root.

\r\r

These changes should make it easier to customize a list/macro/rule without having to copy the entire item and override it.

\r\r

Making it Easier to Send Alerts

\r\r

We've also made it easier to send alerts to external programs. When using the program output channel, if you set the attribute keep_alive to true the program is spawned once rather than once for every alert. This allows use of long-lived programs (e.g. netcat) to stream alerts over a network connection. Here's an example:

\r\r# Whether to output events in json or text\r
json_output: true\r
…\r
program_output:\r
enabled: true\r
keep_alive: true\r
program: "nc host.example.com 1234"\r
\r\r

Additionally, when using json output the individual templated fields of the output message are sent in the object along with the time, full output string, etc. This makes it easier for downstream programs to parse individual fields of an alert. Here's an example:

\r\r{\r
"output" : "16:31:56.746609046: Error File below a known binary directory opened for writing (user=root command=touch /bin/hack file=/bin/hack)"\r
"priority" : "Error",\r
"rule" : "Write below binary dir",\r
"time" : "2017-10-09T23:31:56.746609046Z",\r
"output_fields" : {\r
"user.name" : "root",\r
"evt.time" : 1507591916746609046,\r
"fd.name" : "/bin/hack",\r
"proc.cmdline" : "touch /bin/hack"\r
}\r
}\r
\r\r

Other Changes

\r\r

Some other improvements include:

\r\r

\r
• The ability to send unbuffered data to output channels via the --unbuffered option.
\r
• The ability to validate a single rules file and exit, via the -V option. Limiting the rules that run by severity. For example using -o priority=info would skip all debug priority rules.
\r
• Improve parsing of strings that contain trailing whitespace or dot characters.
\r

\r\r

Learn More

\r\r

For the full set of changes in this release, you can always look at the changelog at github.

\r\r

The release is available via the usual channels–rpm/debian packages, docker hub and github.

\r\r

Let us know if you have any issues, and enjoy!