{"id":13787800,"url":"https://github.com/falcosecurity/falcosidekick","last_synced_at":"2026-03-09T17:29:36.526Z","repository":{"id":37093256,"uuid":"148756498","full_name":"falcosecurity/falcosidekick","owner":"falcosecurity","description":"Connect Falco to your ecosystem","archived":false,"fork":false,"pushed_at":"2025-05-09T14:59:33.000Z","size":7523,"stargazers_count":596,"open_issues_count":13,"forks_count":188,"subscribers_count":15,"default_branch":"master","last_synced_at":"2025-05-09T15:50:02.640Z","etag":null,"topics":["docker","falco","falco-event","hacktoberfest","kubernetes","response-engine","security"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/falcosecurity.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2018-09-14T08:05:51.000Z","updated_at":"2025-05-09T14:58:08.000Z","dependencies_parsed_at":"2024-01-07T03:51:55.844Z","dependency_job_id":"d71eb5e9-7a47-40e2-8cb8-a5297520f54d","html_url":"https://github.com/falcosecurity/falcosidekick","commit_stats":{"total_commits":1161,"total_committers":102,"mean_commits":"11.382352941176471","dds":0.632213608957795,"last_synced_commit":"b792daf0853357dab6e1b032dabcd5452e50a07f"},"previous_names":[],"tags_count":60,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/falcosecurity%2Ffalcosidekick","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/falcosecurity%2Ffalcosidekick/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/falcosecurity%2Ffalcosidekick/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/falcosecurity%2Ffalcosidekick/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/falcosecurity","download_url":"https://codeload.github.com/falcosecurity/falcosidekick/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254059521,"owners_count":22007771,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","falco","falco-event","hacktoberfest","kubernetes","response-engine","security"],"created_at":"2024-08-03T21:00:31.442Z","updated_at":"2026-03-09T17:29:36.503Z","avatar_url":"https://github.com/falcosecurity.png","language":"Go","funding_links":[],"categories":["Official projects","Go"],"sub_categories":["Repositories"],"readme":"# Falcosidekick\n\n[![Falco Ecosystem Repository](https://github.com/falcosecurity/evolution/blob/main/repos/badges/falco-ecosystem-blue.svg)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#ecosystem-scope) [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable)\n\n![falcosidekick](https://github.com/falcosecurity/falcosidekick/raw/master/imgs/falcosidekick_color.png)\n\n![release](https://flat.badgen.net/github/release/falcosecurity/falcosidekick/latest?color=green)\n![last commit](https://flat.badgen.net/github/last-commit/falcosecurity/falcosidekick)\n![licence](https://flat.badgen.net/badge/license/MIT/blue)\n![docker pulls](https://flat.badgen.net/docker/pulls/falcosecurity/falcosidekick?icon=docker)\n\n## Description\n\nA simple daemon for connecting [`Falco`](https://github.com/falcosecurity/falco) to your ecosystem. It takes a `Falco` events and\nforward them to different outputs in a fan-out way.\n\nIt works as a single endpoint for as many as you want `Falco` instances :\n\n![falco_with_falcosidekick](https://github.com/falcosecurity/falcosidekick/raw/master/imgs/falco_with_falcosidekick.png)\n\n## Table of contents\n\n- [Falcosidekick](#falcosidekick)\n  - [Description](#description)\n  - [Table of contents](#table-of-contents)\n  - [Outputs](#outputs)\n    - [Chat](#chat)\n    - [Metrics / Observability](#metrics--observability)\n    - [Alerting](#alerting)\n    - [Logs](#logs)\n    - [Object Storage](#object-storage)\n    - [FaaS / Serverless](#faas--serverless)\n    - [Message queue / Streaming](#message-queue--streaming)\n    - [Email](#email)\n    - [Database](#database)\n    - [Web](#web)\n    - [SIEM](#siem)\n    - [Workflow](#workflow)\n    - [Traces](#traces)\n    - [Other](#other)\n    - [Response engine](#response-engine)\n  - [Installation](#installation)\n    - [Localhost](#localhost)\n      - [With docker](#with-docker)\n      - [With systemd](#with-systemd)\n    - [In Kubernetes](#in-kubernetes)\n      - [With Helm](#with-helm)\n    - [Connect Falco](#connect-falco)\n      - [with falco.yaml](#with-falcoyaml)\n      - [with Helm](#with-helm-1)\n    - [Configuration](#configuration)\n      - [YAML File](#yaml-file)\n  - [Usage](#usage)\n  - [Endpoints](#endpoints)\n  - [Logs](#logs-1)\n  - [Mutual TLS](#mutual-tls)\n  - [Metrics](#metrics)\n    - [Golang ExpVar](#golang-expvar)\n    - [Prometheus](#prometheus)\n    - [StatsD / DogStatsD](#statsd--dogstatsd)\n  - [Try](#try)\n  - [Development](#development)\n    - [Build](#build)\n    - [Quicktest](#quicktest)\n    - [Test \\\u0026 Coverage](#test--coverage)\n  - [Author](#author)\n\n## Outputs\n\n`Falcosidekick` manages a large variety of outputs with different purposes.\n\n\u003e [!NOTE]\nFollow the links to get the configuration of each output.\n\n### Chat\n\n- [**Slack**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/slack.md)\n- [**Rocketchat**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/rocketchat.md)\n- [**Mattermost**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/mattermost.md)\n- [**Teams**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/teams.md)\n- [**Webex**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/webex.md)\n- [**Discord**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/discord.md)\n- [**Google Chat**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/googlechat.md)\n- [**Zoho Cliq**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/cliq.md)\n- [**Telegram**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/telegram.md)\n\n### Metrics / Observability\n\n- [**Datadog**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/datadog.md)\n- [**Influxdb**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/influxdb.md)\n- [**StatsD**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/statsd.md) (for monitoring of `falcosidekick`)\n- [**DogStatsD**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/dogstatsd.md) (for monitoring of `falcosidekick`)\n- [**Prometheus**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/prometheus.md) (for both events and monitoring of `falcosidekick`)\n- [**Wavefront**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/wavefront.md)\n- [**Spyderbat**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/spyderbat.md)\n- [**TimescaleDB**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/timescaledb.md)\n- [**Dynatrace**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/dynatrace.md)\n- [**OTEL Metrics**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/otlp_metrics.md) (for both events and monitoring of `falcosidekick`)\n\n### Alerting\n\n- [**AlertManager**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/alertmanager.md)\n- [**Opsgenie**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/opsgenie.md)\n- [**PagerDuty**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/pagerduty.md)\n- [**Grafana OnCall**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/grafana_oncall.md)\n\n### Logs\n\n- [**Elasticsearch**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/elasticsearch.md)\n- [**Loki**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/loki.md)\n- [**AWS CloudWatchLogs**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/aws_cloudwatch_logs.md)\n- [**Grafana**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/grafana.md)\n- [**Syslog**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/syslog.md)\n- [**Zincsearch**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs//zincsearch.md)\n- [**OpenObserve**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/openobserve.md)\n- [**SumoLogic**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/sumologic.md)\n- [**Quickwit**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/quickwit.md)\n- [**Datadog Logs**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/datadog_logs.md)\n- [**Logstash**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/logstash.md)\n\n### Object Storage\n\n- [**AWS S3**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/aws_s3.md)\n- [**GCP Storage**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/gcp_storage.md)\n- [**Yandex S3 Storage**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/yandex_s3.md)\n\n### FaaS / Serverless\n\n- [**AWS Lambda**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/aws_lambda.md)\n- [**GCP Cloud Run**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/gcp_cloud_run.md)\n- [**GCP Cloud Functions**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/gcp_cloud_functions.md)\n- [**Fission**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/fission.md)\n- [**KNative (CloudEvents)**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/cloudevents.md)\n- [**Kubeless**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/kubeless.md)\n- [**OpenFaaS**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/openfaas.md)\n- [**Tekton**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/tekton.md)\n\n### Message queue / Streaming\n\n- [**NATS**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/nats.md)\n- [**STAN (NATS Streaming)**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/stan.md)\n- [**AWS SQS**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/aws_sqs.md)\n- [**AWS SNS**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/aws_sns.md)\n- [**AWS Kinesis**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/aws_kinesis.md)\n- [**GCP PubSub**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/gcp_pub_sub.md)\n- [**Apache Kafka**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/kafka.md)\n- [**Kafka Rest Proxy**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/kafkarest.md)\n- [**RabbitMQ**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/rabbitmq.md)\n- [**Azure Event Hubs**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/azure_event_hub.md)\n- [**Yandex Data Streams**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/yandex_datastreams.md)\n- [**MQTT**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/mqtt.md)\n- [**Gotify**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/gotify.md)\n\n### Email\n\n- [**SMTP**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/smtp.md)\n\n### Database\n\n- [**Redis**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/redis.md)\n\n### Web\n\n- [**Webhook**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/webhook.md)\n- [**Node-RED**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/nodered.md)\n- [**WebUI**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/falcosidekick-ui.md)\n\n### SIEM\n\n- [**AWS Security Lake**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/aws_security_lake.md)\n\n### Workflow\n\n- [**n8n**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/n8n.md)\n\n### Traces\n\n- [**OTEL Traces**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/otlp_traces.md)\n\n### Other\n- [**Policy Report**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/policy_report.md)\n\n### Response engine\n- [**Falco Talon**](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/talon.md)\n\n## Installation\n\nRun the daemon as any other daemon in your architecture (systemd, k8s deployment, swarm service, ...).\n\n### Localhost\n\n#### With docker\n\nUse the environment variables to set up the outputs:\n```bash\ndocker run -d -p 2801:2801 -e SLACK_WEBHOOKURL=XXXX -e DATADOG_APIKEY=XXXX falcosecurity/falcosidekick\n```\n\n#### With systemd\n\n* Download the latest release:\n  ```shell\n  VER=$(curl --silent -qI https://github.com/falcosecurity/falcosidekick/releases/latest | awk -F '/' '/^location/ {print  substr($NF, 1, length($NF)-1)}')\n  wget -c https://github.com/falcosecurity/falcosidekick/releases/download/${VER}/falcosidekick_${VER}_linux_arm64.tar.gz -O - | tar -xz\n  or\n  wget -c https://github.com/falcosecurity/falcosidekick/releases/download/${VER}/falcosidekick_${VER}_linux_amd64.tar.gz -O - | tar -xz\n  chmod +x falcosidekick\n  sudo mv falcosidekick /usr/local/bin/\n  ```\n\n* Create the `/etc/falcosidekick/config.yaml` file, see [Configuration](#configuration).\n\n* Create the systemd unit files `/etc/systemd/system/falcosidekick.service`:\n  ```shell\n  sudo touch /etc/systemd/system/falcosidekick.service\n  sudo chmod 664 /etc/systemd/system/falcosidekick.service\n  ```\n  ```toml\n  [Unit]\n  Description=Falcosidekick\n  After=network.target\n  StartLimitIntervalSec=0\n\n  [Service]\n  Type=simple\n  Restart=always\n  RestartSec=1\n  ExecStart=/usr/local/bin/falcosidekick -c /etc/falcosidekick/config.yaml\n\n  [Install]\n  WantedBy=default.target\n  ```\n\n* Reload `systemd` and start `Falcosidekick`:\n  ```shell\n  sudo systemctl daemon-reload\n  sudo systemctl enable falcosidekick\n  sudo systemctl start falcosidekick\n  ```\n\n* Check if `Falcosidekick` runs:\n  ```shell\n  curl localhost:2801/healthz\n  ```  \n\n### In Kubernetes\n\n#### With Helm\n\nSee\n[https://github.com/falcosecurity/charts/blob/master/charts/falcosidekick/README.md](https://github.com/falcosecurity/charts/blob/master/charts/falcosidekick/README.md)\n\n```bash\nhelm repo add falcosecurity https://falcosecurity.github.io/charts\nhelm repo update\n\nhelm install falcosidekick --set config.debug=true falcosecurity/falcosidekick\n```\n\n\u003e [!NOTE]\nYou can also deploy `falcosidekick` as a dependency of the `falco` chart, the settings for the communication between falco and `falcosidekick` are automatically set. Just prefix all `falcosidekick` settings with `falcosidekick.`:\n```bash\nhelm repo add falcosecurity https://falcosecurity.github.io/charts\nhelm repo update\n\nhelm install falco --set falcosidekick.enabled=true falcosecurity/falco\n```\n\n### Connect Falco\n\nTo connect Falco with Falcosidekick, you need to change it configuration as following:\n\n#### with falco.yaml\n\nIf managing _falco.yaml_ manually, set this:\n\n```yaml\njson_output: true\njson_include_output_property: true\nhttp_output:\n  enabled: true\n  url: \"http://localhost:2801/\"\n```\n\n#### with Helm\n\nIf installing `falco` with `Helm`, set this (adapted to your environment) in\nyour _values.yaml_ :\n\n```yaml\nfalcosidekick:\n  enabled: true\n```\n\nor\n\n```yaml\njsonOutput: true\njsonIncludeOutputProperty: true\nhttpOutput:\n  enabled: true\n  url: \"http://falcosidekick:2801/\"\n```\n\nor\n\n```yaml\njsonOutput: true\njsonIncludeOutputProperty: true\nprogramOutput:\n  enabled: true\n  keepAlive: false\n  program: \"curl -d @- falcosidekick:2801/\"\n```\n\n### Configuration\n\nConfiguration is made by _file (yaml)_ and _env vars_, both can be used but _env\nvars_ override values from _file_.\n\n#### YAML File\n\nSee **config_example.yaml** :\n\n```yaml\n#listenaddress: \"\" # ip address to bind falcosidekick to (default: \"\" meaning all addresses)\n#listenport: 2801 # port to listen for daemon (default: 2801)\ndebug: false # if true all outputs will print in stdout the payload they send (default: false)\ncustomfields: # custom fields are added to falco events, if the value starts with % the relative env var is used\n  # Akey: \"AValue\"\n  # Bkey: \"BValue\"\n  # Ckey: \"CValue\"\ntemplatedfields: # templated fields are added to falco events and metrics, it uses Go template + output_fields values\n  # Dkey: '{{ or (index . \"k8s.ns.labels.foo\") \"bar\" }}'\ncustomtags: # custom tags are added to the falco events, if the value starts with % the relative env var is used\n  # - tagA\n  # - tagB\n# bracketreplacer: \"_\" # if not empty, replace the brackets in keys of Output Fields\noutputFieldFormat: \"\u003ctimestamp\u003e: \u003cpriority\u003e \u003coutput\u003e \u003ccustom_fields\u003e \u003ctemplated_fields\u003e\" # if not empty, allow to change the format of the output field. (default: \"\u003ctimestamp\u003e: \u003cpriority\u003e \u003coutput\u003e\")\nmutualtlsfilespath: \"/etc/certs\" # folder which will used to store client.crt, client.key and ca.crt files for mutual tls for outputs, will be deprecated in the future (default: \"/etc/certs\")\nmutualtlsclient: # takes priority over mutualtlsfilespath if not empty\n  certfile: \"/etc/certs/client/client.crt\" # client certification file\n  keyfile: \"/etc/certs/client/client.key\" # client key\n  cacertfile: \"/etc/certs/client/ca.crt\" # for server certification\ntlsclient:\n  cacertfile: \"/etc/certs/client/ca.crt\" # CA certificate file for server certification on TLS connections, appended to the system CA pool if not empty\ntlsserver:\n  deploy: false # if true, TLS server will be deployed instead of HTTP\n  certfile: \"/etc/certs/server/server.crt\" # server certification file\n  keyfile: \"/etc/certs/server/server.key\" # server key\n  mutualtls: false # if true, mTLS server will be deployed instead of TLS, deploy also has to be true\n  cacertfile: \"/etc/certs/server/ca.crt\" # for client certification if mutualtls is true\n  notlsport: 2810 # port to serve http server serving selected endpoints (default: 2810)\n  notlspaths: # if not empty, and tlsserver.deploy is true, a separate http server will be deployed for the specified endpoints\n    - \"/ping\"\n    # - \"/metrics\"\n    # - \"/healthz\"\n```\n\n\u003e [!NOTE]\nFor the confiuration of the outputs, see the [docs](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/).\n\n## Usage\n\nUsage :\n\n```bash\nusage: falcosidekick [\u003cflags\u003e]\n\nFlags:\n      --help                     Show context-sensitive help (also try --help-long and --help-man).\n  -c, --config-file=CONFIG-FILE  config file\n```\n\n## Endpoints\n\nDifferent endpoints (handlers) are available :\n\n- `/` : main and default handler, your falco config must be configured to use it\n- `/ping` : you will get a `pong` as answer, useful to test if falcosidekick is running and its port is opened (for healthcheck purpose for example). This endpoint is deprecated and it will be removed in `3.0.0`.\n- `/healthz`: you will get a HTTP status code `200` response as answer, useful to test if falcosidekick is running and its port is opened (for healthcheck or purpose for example)\n- `/test` : (for debug only) send a test event to all enabled outputs.\n- `/debug/vars` : get statistics from daemon (in JSON format), it uses classic `expvar` package and some custom values are added\n- `/metrics` : prometheus endpoint, for scraping metrics about events and `falcosidekick`\n\n## Logs\n\nAll logs are sent to `stdout`.\n\n```bash\n2019/05/10 14:32:06 [INFO] : Enabled Outputs : Slack Datadog\n```\n\n## Mutual TLS ##\n\nOutputs with `mutualtls` enabled in their configuration require the *client.crt*, *client.key* and *ca.crt* filepaths to be configured in the **mutualtlsclient_certfile**, **mutualtlsclient_keyfile** and  **mutualtlsclient_cacertfile** global parameter.\n\n```bash\ndocker run -d -p 2801:2801 -e MUTUALTLSCLIENT_CERTFILE=/etc/certs/client/client.crt -e MUTUALTLSCLIENT_KEYFILE=/etc/certs/client/client.key -e MUTUALTLSCLIENT_CACERTFILE=/etc/certs/client/ca.crt -e ALERTMANAGER_HOSTPORT=https://XXXX -e ALERTMANAGER_MUTUALTLS=true -e INFLUXDB_HOSTPORT=https://XXXX -e INFLUXDB_MUTUALTLS=true -e WEBHOOK_ADDRESS=XXXX -v /localpath/myclientcert.crt:/etc/certs/client/client.crt -v /localpath/myclientkey.key:/etc/certs/client/client.key -v /localpath/ca.crt:/etc/certs/client/ca.crt falcosecurity/falcosidekick\n```\n\nAlternately the path where the *client.crt*, *client.key* and *ca.crt* files are stored can be configured in **mutualtlsfilespath** global parameter. (**Important**: file names must be preserved)\n\n```bash\ndocker run -d -p 2801:2801 -e MUTUALTLSFILESPATH=/etc/certs -e ALERTMANAGER_HOSTPORT=https://XXXX -e ALERTMANAGER_MUTUALTLS=true -e INFLUXDB_HOSTPORT=https://XXXX -e INFLUXDB_MUTUALTLS=true -e WEBHOOK_ADDRESS=XXXX -v /localpath/myclientcert.crt:/etc/certs/client.crt -v /localpath/myclientkey.key:/etc/certs/client.key -v /localpath/ca.crt:/etc/certs/ca.crt falcosecurity/falcosidekick\n```\n\nIn above example, the same client certificate will be used for both Alertmanager \u0026 InfluxDB outputs which have mutualtls flag set to true.\n\n## Metrics\n\n### Golang ExpVar\n\nThe daemon exposes the common _Golang_ metrics and some custom values in JSON\nformat. It's useful for monitoring purpose.\n\n![expvar json](https://github.com/falcosecurity/falcosidekick/raw/master/imgs/expvar_json.png)\n![expvarmon](https://github.com/falcosecurity/falcosidekick/raw/master/imgs/expvarmon.png)\n\n### Prometheus\n\nThe daemon exposes a `prometheus` endpoint on URI `/metrics`.\n\nSee the [docs](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/prometheus.md) for more info.\n\n### StatsD / DogStatsD\n\nThe daemon is able to push its metrics to a StatsD/DogstatsD server. See\n[Configuration](https://github.com/falcosecurity/falcosidekick#configuration)\nsection for how-to.\n\nSee the [statsd docs](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/statsd.md) and [dogstastd docs](https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/dogstatsd.md)  for more info.\n\n## Try\n\nRun you daemon and try (from Falco's documentation):\n\n```bash\ncurl -XPOST \"http://localhost:2801/\" -d'{\"output\":\"16:31:56.746609046: Error File below a known binary directory opened for writing (user=root command=touch /bin/hack file=/bin/hack)\",\"hostname\": \"localhost\", \"priority\":\"Error\",\"rule\":\"Write below binary dir\",\"time\":\"2019-05-17T15:31:56.746609046Z\", \"output_fields\": {\"evt.time\":1507591916746609046,\"fd.name\":\"/bin/hack\",\"proc.cmdline\":\"touch /bin/hack\",\"user.name\":\"root\"}}'\n```\n\n## Development\n\n### Build\n\n```bash\nmake falcosidekick\n```\n\n### Quicktest\n\nCreate a debug event\n\n```bash\ncurl -X POST -H \"Content-Type: application/json\" -H \"Accept: application/json\" localhost:2801/test\n```\n\n### Test \u0026 Coverage\n\n```bash\nmake test\n```\n\nWith Coverage\n\n```bash\nmake test-coverage\n```\n\n## Author\n\nThomas Labarussias (https://github.com/Issif)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffalcosecurity%2Ffalcosidekick","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffalcosecurity%2Ffalcosidekick","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffalcosecurity%2Ffalcosidekick/lists"}