Melissa Kilby comments

Results 478 comments of


                                            Melissa Kilby

[New Features]: Extend Falco's rules expression language to additional "SQL" like filtering options common in Big Data frameworks

Include all eligible operators for the new lists feature, especially `glob` , see https://github.com/falcosecurity/libs/issues/947. Thanks @mikescholl-sysdig!

[New Features]: Extend Falco's rules expression language to additional "SQL" like filtering options common in Big Data frameworks

/remove-lifecycle stale

[New Features]: Extend Falco's rules expression language to additional "SQL" like filtering options common in Big Data frameworks

Amazing thanks!

[New Features]: Extend Falco's rules expression language to additional "SQL" like filtering options common in Big Data frameworks

> See also [falcosecurity/libs#1627](https://github.com/falcosecurity/libs/issues/1627) @lclin56 please be aware that full SQL language support (e.g. groupBy aggregations etc) is not planned at the moment, because Falco currently only supports stream processing...

[New Features]: Extend Falco's rules expression language to additional "SQL" like filtering options common in Big Data frameworks

Once we have the dedicated issues, we can probably close this one?

How to obtain the raw syscall sequence for analysis

@zhang-xh95 any data lake and big data framework could work for you, for example: Apache Spark, Apache Storm, Snowflake, Google BigQuery, Elasticsearch, Splunk, Presto, Apache Flink ... just to name...

How to obtain the raw syscall sequence for analysis

Plus for the plumbing you could look into Apache Kafka or alternatives or managed services in third-party cloud if that is where your data lake and compute platform would live....

Feature request: apply priority to specific syscalls and guarantee them for processing (i.e. will never be dropped)

@FedeDP is taking the lead on all these efforts. A really clever new feature 🎉 is a new option to opt-out from sending events to userspace that have an error...

Falco is blocked when a large list of domain names is used in a rule

@loresuso can summarize some of his exploration re a possible refactor of DNS lookups. In addition, would love to separate DNS parsing issues from matching a super long list of...

Falco is blocked when a large list of domain names is used in a rule

Thank you for confirming so quickly. The current implementation is inefficient and as mentioned above @loresuso has done amazing research to come up with better ways. I hope we can...