{"id":16931129,"url":"https://github.com/issif/bitcoin-plugin","last_synced_at":"2026-05-20T10:34:47.056Z","repository":{"id":223503077,"uuid":"760382880","full_name":"Issif/bitcoin-plugin","owner":"Issif","description":"A Falco plugin to track Bitcoin transactions in real time","archived":false,"fork":false,"pushed_at":"2024-03-06T14:41:57.000Z","size":21,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-21T03:29:24.206Z","etag":null,"topics":["bitcoin","falco","plugin"],"latest_commit_sha":null,"homepage":"https://falco.org/blog/track-the-bitcoin-transactions-with-falco/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Issif.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-02-20T10:12:47.000Z","updated_at":"2025-02-26T21:09:14.000Z","dependencies_parsed_at":"2024-03-06T14:45:18.836Z","dependency_job_id":null,"html_url":"https://github.com/Issif/bitcoin-plugin","commit_stats":null,"previous_names":["issif/bitcoin-plugin"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/Issif/bitcoin-plugin","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Fbitcoin-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Fbitcoin-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Fbitcoin-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Fbitcoin-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Issif","download_url":"https://codeload.github.com/Issif/bitcoin-plugin/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Fbitcoin-plugin/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33255744,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-20T04:48:54.280Z","status":"ssl_error","status_checked_at":"2026-05-20T04:48:10.851Z","response_time":356,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bitcoin","falco","plugin"],"created_at":"2024-10-13T20:43:16.972Z","updated_at":"2026-05-20T10:34:47.031Z","avatar_url":"https://github.com/Issif.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bitcoin Events Plugin\n\nThis repository contains the `bitcoin` plugin for `Falco`, it subscribes to the websocket feed `wss://ws.blockchain.info/inv` to receive the latest transactions.\n\n\u003e [!WARNING]  \n\u003e This plugin has been created to demonstrate the power of `Falco` and its plugins to ingest any kind of streamed events and apply rules over them.\n\n- [Bitcoin Events Plugin](#bitcoin-events-plugin)\n- [Event Source](#event-source)\n- [Supported Fields](#supported-fields)\n- [Development](#development)\n  - [Requirements](#requirements)\n  - [Build](#build)\n- [Installation](#installation)\n  - [Requirements](#requirements-1)\n  - [Local](#local)\n  - [With falcoctl](#with-falcoctl)\n  - [With Helm](#with-helm)\n- [Settings](#settings)\n- [Rules](#rules)\n  - [Results](#results)\n\n# Event Source\n\nThe event source for `bitcoin` events is `bitcoin`.\n\n# Supported Fields\n\n|        Name        |  Type  |                       Description                       |\n| ------------------ | ------ | ------------------------------------------------------- |\n| `btc.time`         | uint64 | Time                                                    |\n| `btc.wallet`       | string | Wallet                                                  |\n| `btc.hash`         | string | Hash                                                    |\n| `btc.amount`       | string | Amount (in BTC)                                         |\n| `btc.amount_sats`  | string | Amount (in SATS), can be used with `\u003e`, `\u003c` comparators |\n| `btc.relayedby`    | string | Relayed y                                               |\n| `btc.transaction`  | string | Type of the transaction (`sent` or `received`)          |\n| `btc.destinations` | list   | List of targets for the `sent` transactions             |\n| `btc.sources`      | list   | List of sources for the `received` transactions         |\n\n# Development\n## Requirements\n\nYou need:\n* `Go` \u003e= 1.19\n\n## Build\n\n```shell\nmake build\n```\n\n# Installation\n\n## Requirements\n\n* `Falco` \u003e= 0.36\n\n## Local\n\n* Build and install the plugin:\n  ```shell\n  git clone https://github.com/Issif/bitcoin-plugin.git\n  cd bitcoin-plugin\n  make install\n  ```\n* Configure `Falco` with the `/etc/falco/falco.yaml` file:\n  ```yaml\n  plugins:\n    - name: bitcoin\n      library_path: /usr/share/falco/plugins/libbitcoin.so\n      init_config: ''\n      open_params: ''\n\n  load_plugins: [bitcoin]\n\n  stdout_output:\n    enabled: true\n  ```\n* Run `Falco`:\n  ```shell\n  falco -c /etc/falco/falco.yaml -r rules/bitcoin_rules.yaml --disable-source syscall\n  ```\n\n## With falcoctl\n\n* Add the index:\n  ```shell\n  sudo falcoctl index add bitcoin https://raw.githubusercontent.com/Issif/bitcoin-plugin/main/index.yaml\n  ```\n* Search for the artifacts:\n  ```shell\n  sudo falcoctl artifact search bitcoin\n  ```\n  ```shell\n  INDEX   ARTIFACT        TYPE            REGISTRY        REPOSITORY                              \n  bitcoin  bitcoin-rules    rulesfile       ghcr.io         issif/bitcoin-plugin/ruleset/bitcoin-rules\n  bitcoin  bitcoin          plugin          ghcr.io         issif/bitcoin-plugin/plugin/bitcoin \n  ```\n* Install the plugin and the rules:\n  ```shell\n  sudo falcoctl artifact install bitcoin-rules:latest\n  ```\n  ```shell\n  INFO  Reading all configured index files from \"/root/.config/falcoctl/indexes.yaml\"\n  INFO  Resolving dependencies ...\n  INFO  Installing the following artifacts: [ghcr.io/issif/bitcoin-plugin/ruleset/bitcoin:latest]\n  INFO  Preparing to pull \"ghcr.io/issif/bitcoin-plugin/ruleset/bitcoin:latest\"\n  INFO  Pulling c09e07b53699: ############################################# 100% \n  INFO  Pulling 1be5f42ebc40: ############################################# 100% \n  INFO  Pulling 751af53627f8: ############################################# 100% \n  INFO  Artifact successfully installed in \"/etc/falco\"  \n  ```\n* Run `Falco`:\n  ```shell\n  falco -c /etc/falco/falco.yaml -r /etc/falco/bitcoin_rules.yaml --disable-source syscall\n  ```\n\n## With Helm\n\n* Edit the `values.yam`:\n  ```yaml\n  tty: true\n  kubernetes: false\n\n  falco:\n    rules_file:\n      - /etc/falco/bitcoin_rules.yaml\n    plugins:\n    - name: bitcoin\n      library_path: libbitcoin.so\n    load_plugins: [bitcoin]\n\n  driver:\n    enabled: false\n  collectors:\n    enabled: false\n\n  controller:\n    kind: deployment\n    deployment:\n      replicas: 1\n\n  falcoctl:\n    config:\n      indexes:\n        - name: bitcoin\n          url: https://raw.githubusercontent.com/Issif/bitcoin-plugin/main/index.yaml\n      artifact:\n        install:\n          refs: [\"bitcoin:0\"]\n        follow:\n          refs: [\"bitcoin-rules:0\"]\n  ```\n  * Deploy `Falco`:\n  ```shell\n  helm install falco-bitcoin -n falco falcosecurity/falco -f values.yaml\n  ```\n\n# Settings\n\nn/a\n\n# Rules\n\nA default `rules.yaml` file is provided.\n\nThe `source` for rules must be `bitcoin`.\n\nSee example:\n```yaml\n- rule: New Sent transaction\n  desc: Denug\n  condition: btc.transaction=\"sent\"\n  output: The wallet %btc.wallet sent %btc.amount BTC to %btc.destinations in the transaction %btc.hash \n  priority: INFORMATIONAL\n  source: bitcoin\n  tags: [bitcoin]\n\n- rule: New Received transaction\n  desc: Denug\n  condition: btc.transaction=\"received\"\n  output: The wallet %btc.wallet received %btc.amount BTC from %btc.sources in the transaction %btc.hash \n  priority: INFORMATIONAL\n  source: bitcoin\n  tags: [bitcoin]\n\n```\n\n## Results\n\n```shell\n2024-02-20T13:24:45.686652000+0000: Informational The wallet bc1q28gqnp6fdxdsfjr0ddpmp9ah05awadq7tcrsre received 0.000094024 BTC from (bc1q80cdne2eqw0y778fh4g5p7s7v4jk23l94q38rd) in the transaction f6cc0969fd63479b1926fabe7691544ed69fa7f77dea7e0cc001cb1815579720\n2024-02-20T13:24:45.686698000+0000: Informational The wallet bc1qn2galc22rz29nsme9tfmjec9vaq6sqa3lmmfwe sent 0.009396256 BTC to (14Ad6DYi7Kb3yDNyhfwb9Cb47bcV56ESQH,bc1qn2galc22rz29nsme9tfmjec9vaq6sqa3lmmfwe) in the transaction ab20978445c0b0a23d8c163701d3a7128d1dd978385bb0a6e5ffe56a8140d532\n2024-02-20T13:24:45.686739000+0000: Informational The wallet 14Ad6DYi7Kb3yDNyhfwb9Cb47bcV56ESQH received 0.001900000 BTC from (bc1qn2galc22rz29nsme9tfmjec9vaq6sqa3lmmfwe) in the transaction ab20978445c0b0a23d8c163701d3a7128d1dd978385bb0a6e5ffe56a8140d532\n2024-02-20T13:24:45.686786000+0000: Informational The wallet bc1qn2galc22rz29nsme9tfmjec9vaq6sqa3lmmfwe received 0.007492656 BTC from (bc1qn2galc22rz29nsme9tfmjec9vaq6sqa3lmmfwe) in the transaction ab20978445c0b0a23d8c163701d3a7128d1dd978385bb0a6e5ffe56a8140d532\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fissif%2Fbitcoin-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fissif%2Fbitcoin-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fissif%2Fbitcoin-plugin/lists"}