Falco

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/falco"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/7d45211f-0b90-4f8e-929d-3270ab944ddf/social-card.svg?v=3e7ae33eec8b" alt="Falco" width="600" height="315"></a>

Create a falco security source, then in falco.yaml:

json_output: true
http_output:
  enabled: true
  url: "https://<edge>/v1/security/<source_id>"
  custom_headers:
    Authorization: "Bearer <secret>"

Mapping: rule is security.rule; priority (Emergency to Debug, Informational accepted) is security.priority; tags are security.tags; output is the log body; time is the record time. From output_fields: k8s.ns.name becomes k8s.namespace.name, k8s.pod.name, container.id, container.name, proc.name (process.executable.name), user.name; hostname becomes host.name. A trace_id (top level or in output_fields) is kept.

With the default filter (warning), Falco Notice rules are dropped; lower min_priority to keep them.

Updated