Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify selecting more events #1238

Open
cccsss01 opened this issue Jan 12, 2024 · 12 comments
Open

Clarify selecting more events #1238

cccsss01 opened this issue Jan 12, 2024 · 12 comments

Comments

@cccsss01
Copy link
Contributor

/area documentation

What would you like to be added:
https://falco.org/docs/reference/rules/supported-events/#syscall-events

Note that, for performance reasons, by default Falco will only consider a subset of them indicated in the table below with "yes". However, it's possible to make Falco consider all events by using the -A command line switch.

for example: falco --modern-bpf -A

it would be great if there was a way to specifically select additional syscalls in the document.

Why is this needed:
clarity.

@incertum
Copy link
Contributor

Have you explored the base_syscalls option in falco.yaml?

We are also working on adding bunch of new debugging guides and rewrite most of the install guides.

Wanna get more closely involved?

@cccsss01
Copy link
Contributor Author

I'm already time slotted during the community call. I've joined a few when I was free. I was not familiar with base calls, which looks great. Maybe a PR to just link something for additional use case see base calls. I don't mind doing the PR asthetics tho..

@incertum
Copy link
Contributor

Awesome, if you have suggestions where and how to cross-reference this better plz let us know and of course always feel free to open a PR.
Was planning to also work on some help guides around performance and such, see #1229 (comment)

@cccsss01
Copy link
Contributor Author

Any way to add a new link to supported events for "advanced syscalls" then link it to that portion of the helm chart? :O I think that would be nice.

@incertum
Copy link
Contributor

Agreed, for example could link to https://falco.org/blog/adaptive-syscalls-selection/ and also mention to checkout the config desc in the falco.yaml file.

Re helm chart @leogr can be your point of contact.

@poiana
Copy link

poiana commented Apr 12, 2024

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

@leogr
Copy link
Member

leogr commented Apr 16, 2024

Any way to add a new link to supported events for "advanced syscalls" then link it to that portion of the helm chart? :O I think that would be nice.

@alacuku wdyt?

cc @LucaGuerra @Issif

@poiana
Copy link

poiana commented May 16, 2024

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

@leogr
Copy link
Member

leogr commented May 17, 2024

/remove-lifecycle rotten
/assign @LucaGuerra

@poiana
Copy link

poiana commented Aug 15, 2024

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

@poiana
Copy link

poiana commented Sep 14, 2024

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

@leogr
Copy link
Member

leogr commented Sep 16, 2024

/remove-lifecycle rotten

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants