{"id":19556575,"url":"https://github.com/falcosecurity/falco-talon","last_synced_at":"2025-04-04T20:08:42.549Z","repository":{"id":37024471,"uuid":"430750214","full_name":"falcosecurity/falco-talon","owner":"falcosecurity","description":"Response Engine for managing threats in your Kubernetes","archived":false,"fork":false,"pushed_at":"2025-03-27T23:43:48.000Z","size":2320,"stargazers_count":152,"open_issues_count":1,"forks_count":14,"subscribers_count":12,"default_branch":"main","last_synced_at":"2025-03-28T06:53:14.672Z","etag":null,"topics":["falco","kubernetes","response-engine","security"],"latest_commit_sha":null,"homepage":"https://docs.falco-talon.org","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/falcosecurity.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-11-22T14:56:38.000Z","updated_at":"2025-03-27T08:03:37.000Z","dependencies_parsed_at":"2023-02-02T05:15:51.551Z","dependency_job_id":"a8b14485-773f-4da4-9783-ef6d7cf5c22f","html_url":"https://github.com/falcosecurity/falco-talon","commit_stats":null,"previous_names":["issif/falco-reactionner","falco-talon/falco-talon","issif/falco-talon","falcosecurity/falco-talon"],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/falcosecurity%2Ffalco-talon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/falcosecurity%2Ffalco-talon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/falcosecurity%2Ffalco-talon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/falcosecurity%2Ffalco-talon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/falcosecurity","download_url":"https://codeload.github.com/falcosecurity/falco-talon/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247242678,"owners_count":20907134,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["falco","kubernetes","response-engine","security"],"created_at":"2024-11-11T04:38:21.967Z","updated_at":"2025-04-04T20:08:42.497Z","avatar_url":"https://github.com/falcosecurity.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":" # Falco Talon\n\n[![Falco Ecosystem Repository](https://raw.githubusercontent.com/falcosecurity/evolution/refs/heads/main/repos/badges/falco-ecosystem-blue.svg)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#ecosystem-scope) [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating)\n[![Last Release](https://img.shields.io/github/v/release/falcosecurity/falco-talon?style=for-the-badge)](https://github.com/falcosecurity/falco-talon/releases/latest)\n\n![last commit](https://img.shields.io/github/last-commit/falcosecurity/falco-talon?style=for-the-badge\n)\n![licence](https://img.shields.io/github/license/falcosecurity/falco-talon?style=for-the-badge\n)\n![docker pulls](https://img.shields.io/docker/pulls/falcosecurity/falco-talon?style=for-the-badge\n)\n\n`Falco Talon` is a Response Engine for managing threats in your Kubernetes. It enhances the solutions proposed by the Falco community with a no-code tailor made solution. With easy rules, you can react to `events` from [`Falco`](https://falco.org) in milliseconds.\n\n- [Falco Talon](#falco-talon)\n  - [Architecture](#architecture)\n    - [Glossary](#glossary)\n    - [Actionners](#actionners)\n    - [Notifiers](#notifiers)\n    - [Outputs](#outputs)\n    - [Configuration](#configuration)\n    - [Rules](#rules)\n  - [Documentation](#documentation)\n  - [Metrics](#metrics)\n    - [Prometheus metrics](#prometheus-metrics)\n    - [OTEL metrics](#otel-metrics)\n  - [Traces](#traces)\n  - [Docker images](#docker-images)\n  - [Deployment](#deployment)\n    - [Helm](#helm)\n      - [Configure Falcosidekick](#configure-falcosidekick)\n  - [Development](#development)\n  - [License](#license)\n  - [Author](#author)\n\n## Architecture\n\n`Falco Talon` can receive the `events` from [`Falco`](https://falco.org) or [`Falcosidekick`](https://github.com/falcosecurity/falcosidekick):\n\n```mermaid\nflowchart LR\n    falco\n    falcosidekick\n    falco-talon\n    falco -- event --\u003e falcosidekick\n    falco -- event --\u003e falco-talon\n    falcosidekick -- event --\u003e falco-talon\n    kubernetes -- context --\u003e falco-talon\n    falco-talon -- action --\u003e aws\n    falco-talon -- output --\u003e minio\n    falco-talon -- action --\u003e kubernetes\n    falco-talon -- notification --\u003e slack\n```\n\n### Glossary\n\n* `event`: an event detected by `Falco` and sent to its outputs\n* `rule`: defines criterias for linking the events with the actions to apply\n* `action`: each rule can sequentially run actions, each action refers to an actionner\n* `actionner`: defines what the action will do\n* `notifier`: defines what outputs to notify with the result of the action\n* `context`: composed of elements from the original Falco event, from Falco Talon and other sources, these elements can be used to dynamically configure the actions to perform.\n* `output`: defines the target where to store the resulting artifact that might has been created by an actionner\n\n### Actionners\n\nThe list of the available actionners can be found [HERE](https://docs.falco-talon.org/docs/actionners/list/).\n\n### Notifiers\n\nThe list of the available actionners can be found [HERE](https://docs.falco-talon.org/docs/notifiers/list/).\n\n### Outputs\n\nThe list of the available outputs can be found [HERE](https://docs.falco-talon.org/docs/outputs/list/).\n\n### Configuration\n\nThe static configuration of `Falco Talon` is set with a `.yaml` file (default: `./config.yaml`) or with environment variables.\n\nThe list of the available settings can be found [HERE](https://docs.falco-talon.org/docs/configuration/).\n\n### Rules\n\nYou can find how to write your own rules [HERE](https://docs.falco-talon.org/docs/rules/).\n\n## Documentation\n\nThe full documentation is available on its own website: [https://docs.falco-talon.org/docs](https://docs.falco-talon.org/docs).\n\n## Metrics\n\n### Prometheus metrics\n\nThe `/metrics` endpoint exposes some metrics in the Prometheus format. See [here](https://docs.falco-talon.org/docs/installation_usage/metrics#prometheus-metrics).\n\n### OTEL metrics\n\n`Falco Talon` can export its metrics in the OTEL Metrics format. See [here](https://docs.falco-talon.org/docs/installation_usage/metrics#otel-metrics).\n\n## Traces\n\n`Falco Talon` can export traces in the OTEL Traces format. See [here](https://docs.falco-talon.org/docs/installation_usage/traces).\n\n## Docker images\n\nThe docker images for `falco-talon` are built using [ko](https://github.com/google/ko)\n\nTo generate the images to test locally you can run `mage buildImagesLocal`\n\n## Deployment\n\n### Helm\n\nThe helm chart is available in the repo [`charts`](https://github.com/falcosecurity/charts/tree/master/charts/falco-talon).\n\nTwo config files are provided:\n* `values.yaml` allows you to configure `Falcon Talon` and the deployment, the list of available values is [here](https://github.com/falcosecurity/charts/tree/master/charts/falco-talon#configuration)\n* `rules.yaml` contains rules to set\n\n```shell\nhelm repo add falcosecurity https://falcosecurity.github.io/charts\nhelm repo update\nhelm install falco-talon falcosecurity/falco -n falco --create-namespace\n```\n\n#### Configure Falcosidekick\n\nOnce you have installed `Falco Talon` with Helm, you need to connect `Falcosidekick` by adding the flag `--set falcosidekick.config.talon.address=http://falco-talon:2803`\n\n```shell\nhelm install falco falcosecurity/falco --namespace falco \\\n  --create-namespace \\\n  --set tty=true \\\n  --set falcosidekick.enabled=true \\\n  --set falcosidekick.config.talon.address=http://falco-talon:2803\n```\n\n## Development\n\nA [Docker Compose stack](./deployment/compose) is provided for local developments and tests. \n\nThis stack starts these services:\n- **Grafana**: accessible at http://localhost:3000\n- **OTEL Collector**\n- **Prometheus**: accessible at http://localhost:9090\n- **Grafana Tempo**\n- **Minio**: accessible at http://localhost:9001 (root/changeme123)\n\nTo start the stack:\n```shell\ncd deployment/compose\ndocker compose up -d\n```\n\n## License\n\nFalco Talon is licensed to you under the [Apache 2.0](./LICENSE) open source license.\n\n## Author\n\nThomas Labarussias (https://github.com/Issif)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffalcosecurity%2Ffalco-talon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffalcosecurity%2Ffalco-talon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffalcosecurity%2Ffalco-talon/lists"}