/
falcosidekick.example.yaml
433 lines (385 loc) · 31.8 KB
/
falcosidekick.example.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
#listenaddress: "" # ip address to bind falcosidekick to (default: "" meaning all addresses)
#listenport: 2801 # port to listen for daemon (default: 2801)
debug: false # if true all outputs will print in stdout the payload they send (default: false)
customfields: # custom fields are added to falco events and metrics, if the value starts with % the relative env var is used
# Akey: "AValue"
# Bkey: "BValue"
# Ckey: "CValue"
templatedfields: # templated fields are added to falco events and metrics, it uses Go template + output_fields values
# Dkey: '{{ or (index . "k8s.ns.labels.foo") "bar" }}'
# bracketreplacer: "_" # if not empty, the brackets in keys of Output Fields are replaced
mutualtlsfilespath: "/etc/certs" # folder which will used to store client.crt, client.key and ca.crt files for mutual tls (default: "/etc/certs")
slack:
webhookurl: "" # Slack WebhookURL (ex: https://hooks.slack.com/services/XXXX/YYYY/ZZZZ), if not empty, Slack output is enabled
#channel: "" # Slack channel (optionnal)
#footer: "" # Slack footer
#icon: "" # Slack icon (avatar)
#username: "" # Slack username (default: Falcosidekick)
outputformat: "all" # all (default), text, fields
minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# messageformat: 'Alert: rule *{{ .Rule }}* ({{ index .OutputFields "teler.threat"}}) triggered on *{{ index .OutputFields "teler.caller" }}*' # a Go template to format Slack Text above Attachment, displayed in addition to the output from `SLACK_OUTPUTFORMAT`, see [Slack Message Formatting](#slack-message-formatting) in the README for details. If empty, no Text is displayed before Attachment.
rocketchat:
webhookurl: "" # Rocketchat WebhookURL (ex: http://XXXX/hooks/YYYY), if not empty, Rocketchat output is enabled
#icon: "" # Rocketchat icon (avatar)
#username: "" # Rocketchat username (default: Falcosidekick)
outputformat: "all" # all (default), text, fields
minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# messageformat: "Alert : rule *{{ .Rule }}* ({{ index .OutputFields "teler.threat"}}) triggered by user *{{ index .OutputFields \"user.name\" }}*" # a Go template to format Rocketchat Text above Attachment, displayed in addition to the output from `ROCKETCHAT_OUTPUTFORMAT`, see [Slack Message Formatting](#slack-message-formatting) in the README for details. If empty, no Text is displayed before Attachment.
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
mattermost:
webhookurl: "" # Mattermost WebhookURL (ex: http://XXXX/hooks/YYYY), if not empty, Mattermosst output is enabled
#footer: "" # Mattermost footer
#icon: "" # Mattermost icon (avatar)
#username: "" # Mattermost username (default: Falcosidekick)
outputformat: "all" # all (default), text, fields
minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# messageformat: "Alert : rule **{{ .Rule }}* ({{ index .OutputFields "teler.threat"}})* triggered by user **{{ index .OutputFields \"user.name\" }}**" # a Go template to format Mattermost Text above Attachment, displayed in addition to the output from `MATTERMOST_OUTPUTFORMAT`, see [Slack Message Formatting](#slack-message-formatting) in the README for details. If empty, no Text is displayed before Attachment.
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
teams:
webhookurl: "" # Teams WebhookURL (ex: https://hooks.slack.com/services/XXXX/YYYY/ZZZZ), if not empty, Teams output is enabled
#activityimage: "" # Image for message section
outputformat: "all" # all (default), text, facts
minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
datadog:
# apikey: "" # Datadog API Key, if not empty, Datadog output is enabled
# host: "" # Datadog host. Override if you are on the Datadog EU site. Defaults to american site with "https://api.datadoghq.com"
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
alertmanager:
# hostport: "" # http://{domain or ip}:{port}, if not empty, Alertmanager output is enabled
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# endpoint: "" # alertmanager endpoint for posting alerts: "/api/v1/alerts" or "/api/v2/alerts" (default: "/api/v1/alerts")
# expiresafter: "" if set to a non-zero value, alert expires after that time in seconds (default: 0)
# extralabels: "" # comma separated list of labels composed of a ':' separated name and value that is added to the Alerts. Example: my_label_1:my_value_1, my_label_1:my_value_2
# extraannotations: "" # comma separated list of annotations composed of a ':' separated name and value that is added to the Alerts. Example: my_annotation_1:my_value_1, my_annotation_1:my_value_2
elasticsearch:
# hostport: "" # http://{domain or ip}:{port}, if not empty, Elasticsearch output is enabled
# index: "falco" # index (default: falco)
# type: "_doc"
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# suffix: "daily" # date suffix for index rotation : daily (default), monthly, annually, none
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# username: "" # use this username to authenticate to Elasticsearch if the username is not empty (default: "")
# password: "" # use this password to authenticate to Elasticsearch if the password is not empty (default: "")
# customHeaders: # Custom headers to add in POST, useful for Authentication
# key: value
influxdb:
# hostport: "" # http://{domain or ip}:{port}, if not empty, Influxdb output is enabled
# database: "falco" # Influxdb database (api v1 only) (default: falco)
# organization: "" # Influxdb organization
# bucket: "falco" # bucket (default: falco)
# precision: "ns" # write precision
# user: "" # user to use if auth is enabled in Influxdb
# password: "" # pasword to use if auth is enabled in Influxdb
# token: "" # API token to use if auth in enabled in Influxdb (disables user and password)
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
loki:
# hostport: "" # http://{domain or ip}:{port}, if not empty, Loki output is enabled
# user: "" # user for Grafana Logs
# apikey: "" # API Key for Grafana Logs
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# tenant: "" # Add the Tenant header
# endpoint: "/loki/api/v1/push" # The endpoint URL path, default is "/loki/api/v1/push" more info : https://grafana.com/docs/loki/latest/api/#post-apiprompush
# extralabels: "" # comma separated list of fields to use as labels additionally to rule, source, priority, tags and custom_fields
# customHeaders: # Custom headers to add in POST, useful for Authentication
# key: value
nats:
# hostport: "" # nats://{domain or ip}:{port}, if not empty, NATS output is enabled
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
stan:
# hostport: "" # nats://{domain or ip}:{port}, if not empty, STAN output is enabled
# clusterid: "" # Cluster name, if not empty, STAN output is enabled
# clientid: "" # Client ID, if not empty, STAN output is enabled
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
aws:
# accesskeyid: "" # aws access key (optional if you use EC2 Instance Profile)
# secretaccesskey: "" # aws secret access key (optional if you use EC2 Instance Profile)
# region : "" # aws region (by default, the metadata are used to get it)
# checkidentity: true # check the identity credentials, set to false for locale developments (default: true)
lambda:
# functionname : "" # Lambda function name, if not empty, AWS Lambda output is enabled
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
sqs:
# url : "" # SQS Queue URL, if not empty, AWS SQS output is enabled
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
sns:
# topicarn : "" # SNS TopicArn, if not empty, AWS SNS output is enabled
rawjson: false # Send Raw JSON or parse it (default: false)
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
cloudwatchlogs:
# loggroup : "" # AWS CloudWatch Logs Group name, if not empty, CloudWatch Logs output is enabled
# logstream : "" # AWS CloudWatch Logs Stream name, if empty, Falcosidekick will try to create a log stream
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
s3:
# bucket: "falcosidekick" # AWS S3, bucket name
# prefix : "" # name of prefix, keys will have format: s3://<bucket>/<prefix>/YYYY-MM-DD/YYYY-MM-DDTHH:mm:ss.s+01:00.json
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
securitylake.:
# bucket: "" # Bucket for AWS SecurityLake data, if not empty, AWS SecurityLake output is enabled
# region: "" # Bucket Region (mandatory)
# prefix: "" # Prefix for keys (mandatory)
# accountid: "" # Account ID (mandatory)
interval: 5 # Time in minutes between two puts to S3 (must be between 5 and 60min) (default: 5min)
batchsize: 1000 # Max number of events by parquet file (default: 1000)
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
kinesis:
# streamname: "" # AWS Kinesis Stream Name, if not empty, Kinesis output is enabled
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
smtp:
# hostport: "" # host:port address of SMTP server, if not empty, SMTP output is enabled
# authmechanism: "plain" # SASL Mechanisms : plain, oauthbearer, external, anonymous or "" (disable SASL). Default: plain
# user: "" # user for Plain Mechanism
# password: "" # password for Plain Mechanism
# token: "" # OAuthBearer token for OAuthBearer Mechanism
# identity: "" # identity string for Plain and External Mechanisms
# trace: "" trace string for Anonymous Mechanism
# from: "" # Sender address (mandatory if SMTP output is enabled)
# to: "" # comma-separated list of Recipident addresses, can't be empty (mandatory if SMTP output is enabled)
# outputformat: "" # html (default), text
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
prometheus:
# extralabels: "" # comma separated list of fields to use as labels additionally to rule, source, priority, tags and custom_fields
statsd:
forwarder: "" # The address for the StatsD forwarder, in the form "host:port", if not empty StatsD is enabled
namespace: "falcosidekick." # A prefix for all metrics (default: "falcosidekick.")
dogstatsd:
forwarder: "" # The address for the DogStatsD forwarder, in the form "host:port", if not empty DogStatsD is enabled
namespace: "falcosidekick." # A prefix for all metrics (default: "falcosidekick.")
# tag :
# key: "value"
opsgenie:
# apikey: "2c771471-e2af-4dc6-bd35-e7f6ff479b64" # Opsgenie API Key, if not empty, Opsgenie output is enabled
region: "eu" # (us|eu) region of your domain
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
webhook:
# address: "" # Webhook address, if not empty, Webhook output is enabled
# method: "POST" # HTTP method: POST or PUT (default: POST)
# customHeaders: # Custom headers to add in the request, useful for Authentication
# key: value
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
nodered:
# address: "" # Node-RED address, if not empty, Node-RED output is enabled
# user: "" # User if Basic Auth is enabled for 'http in' node in Node-RED
# password: "" # Password if Basic Auth is enabled for 'http in' node in Node-RED
# customHeaders: # Custom headers to add in POST, useful for Authentication
# key: value
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
cloudevents:
# address: "" # CloudEvents consumer http address, if not empty, CloudEvents output is enabled
# extensions: # Extensions to add in the outbound Event, useful for routing
# key: value
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
azure:
eventHub:
name: "" # Name of the Hub, if not empty, EventHub is enabled
namespace: "" # Name of the space the Hub is in
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
discord:
webhookurl: "" # Discord WebhookURL (ex: https://discord.com/api/webhooks/xxxxxxxxxx...), if not empty, Discord output is enabled
# icon: "" # Discord icon (avatar)
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
gcp:
credentials: "" # The base64-encoded JSON key file for the GCP service account
pubsub:
projectid: "" # The GCP Project ID containing the Pub/Sub Topic
topic: "" # The name of the Pub/Sub topic
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
storage:
# prefix : "" # name of prefix, keys will have format: gs://<bucket>/<prefix>/YYYY-MM-DD/YYYY-MM-DDTHH:mm:ss.s+01:00.json
bucket: "" # The name of the bucket
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
cloudfunctions:
name: "" # The name of the Cloud Function
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
cloudrun:
endpoint: "" # The URL of the Cloud Function
jwt: "" # Appropriate JWT to invoke the Cloud Function
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
googlechat:
webhookurl: "" # Google Chat WebhookURL (ex: https://chat.googleapis.com/v1/spaces/XXXXXX/YYYYYY), if not empty, Google Chat output is enabled
# outputformat: "" # all (default), text
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
messageformat: 'Alert: rule *{{ .Rule }}* ({{ index .OutputFields "teler.threat"}}) triggered on *{{ index .OutputFields "teler.caller" }}*' # a Go template to format Slack Text above Attachment, displayed in addition to the output from `SLACK_OUTPUTFORMAT`, see [Slack Message Formatting](#slack-message-formatting) in the README for details. If empty, no Text is displayed before Attachment.
cliq:
webhookurl: "" # WebhookURL (ex: https://cliq.zoho.eu/api/v2/channelsbyname/XXXX/message?zapikey=YYYY), if not empty, Cliq output is enabled
# icon: "" # Cliq icon (avatar)
# useemoji: true # Prefix message with an emoji
# outputformat: "all" # all (default), text, fields
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
messageformat: 'Alert: rule *{{ .Rule }}* ({{ index .OutputFields "teler.threat"}}) triggered on *{{ index .OutputFields "teler.caller" }}*' # a Go template to format Cliq Text above Table, displayed in addition to the output from `CLIQ_OUTPUTFORMAT`, see [Slack Message Formatting](#slack-message-formatting) in the README for details. If empty, no Text is displayed before Table.
kafka:
hostport: "" # Apache Kafka Host:Port (ex: localhost:9092). Defaults to port 9092 if no port is specified after the domain, if not empty, Kafka output is enabled
topic: "" # Name of the topic, if not empty, Kafka output is enabled
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
sasl: "" # SASL authentication mechanism, if empty, no authentication (PLAIN|SCRAM_SHA256|SCRAM_SHA512)
username: "" # use this username to authenticate to Kafka via SASL (default: "")
password: "" # use this password to authenticate to Kafka via SASL (default: "")
# async: false # produce messages without blocking (default: false)
# requiredacks: NONE # number of acknowledges from partition replicas required before receiving (default: "NONE")
# compression: "" # enable message compression using this algorithm, no compression (GZIP|SNAPPY|LZ4|ZSTD|NONE) (default: "NONE")
# balancer: "" # partition balancing strategy when producing, (default: "round_robin")
# clientid: "" # specify a client.id when communicating with the broker for tracing
kafkarest:
address: "" # The full URL to the topic (example "http://kafkarest:8082/topics/test")
#version: 2 # Kafka Rest Proxy API version 2|1 (default: 2)
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
pagerduty:
routingKey: "" # Pagerduty Routing Key, if not empty, Pagerduty output is enabled
minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
kubeless:
function: "" # Name of Kubeless function, if not empty, Kubeless is enabled
namespace: "" # Namespace of Kubeless function (mandatory)
port: 8080 # Port of service of Kubeless function
kubeconfig: "~/.kube/config" # Kubeconfig file to use (only if falcoside is running outside the cluster)
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
openfaas:
functionname: "" # Name of OpenFaaS function, if not empty, OpenFaaS is enabled
functionnamespace: "openfaas-fn" # Namespace of OpenFaaS function, "openfaas-fn" (default)
gatewayservice: "gateway" # Service of OpenFaaS Gateway, "gateway" (default)
gatewayport: 8080 # Port of service of OpenFaaS Gateway
gatewaynamespace: "openfaas" # Namespace of OpenFaaS Gateway, "openfaas" (default)
kubeconfig: "~/.kube/config" # Kubeconfig file to use (only if falcosidekick is running outside the cluster)
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
rabbitmq:
url: "" # Rabbitmq URL, if not empty, Rabbitmq output is enabled
queue: "" # Rabbitmq Queue name
minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
wavefront:
endpointtype: "" # Wavefront endpoint type, must be 'direct' or 'proxy'. If not empty, with endpointhost, Wavefront output is enabled
endpointhost: "" # Wavefront endpoint address (only the host). If not empty, with endpointhost, Wavefront output is enabled
endpointtoken: "" # Wavefront token. Must be used only when endpointtype is 'direct'
# endpointmetricport: 2878 # Port to send metrics. Only used when endpointtype is 'proxy'. Defaults to 2878
# metricname: "falco.alert" # Metric to be created in Wavefront. Defaults to falco.alert
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# batchsize: 10000 # Wavefront batch size. If empty uses the default 10000. Only used when endpointtype is 'direct'
# flushintervalseconds: 1 # Wavefront flush interval in seconds. Defaults to 1
grafana:
hostport: "" # http://{domain or ip}:{port}, if not empty, Grafana output is enabled
apikey: "" # API Key to authenticate to Grafana, if not empty, Grafana output is enabled
# dashboardid: # annotations are scoped to a specific dashboard. Optionnal.
# panelid: "" # annotations are scoped to a specific panel. Optionnal.
# allfieldsastags: false # if true, all custom fields are added as tags (default: false)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# customHeaders: # Custom headers to add in POST, useful for Authentication
# key: value
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
webui:
url: "" # WebUI URL, if not empty, WebUI output is enabled
fission:
function: "" # Name of Fission function, if not empty, Fission is enabled
routernamespace: "fission" # Namespace of Fission Router, "fission" (default)
routerservice: "router" # Service of Fission Router, "router" (default)
routerport: 80 # Port of service of Fission Router
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# mutualtls: false # if true, checkcert flag will be ignored (server cert will always be checked)
policyreport:
enabled: false # if true policyreport output is enabled
kubeconfig: "~/.kube/config" # Kubeconfig file to use (only if falcosidekick is running outside the cluster)
failthreshold: 4 # events with priority above this threshold are mapped to fail in PolicyReport Summary and lower that those are mapped to warn (default=4)
maxevents: 1000 # the max number of events per report(default: 1000)
prunebypriority: false # if true; the events with lowest severity are pruned first, in FIFO order (default: false)
yandex:
# accesskeyid: "" # yandex access key
# secretaccesskey: "" # yandex secret access key
# region: "" # yandex storage region (default: ru-central-1)
s3:
# endpoint: "" # yandex storage endpoint (default: https://storage.yandexcloud.net)
# bucket: "falcosidekick" # Yandex storage, bucket name
# prefix: "" # name of prefix, keys will have format: s3://<bucket>/<prefix>/YYYY-MM-DD/YYYY-MM-DDTHH:mm:ss.s+01:00.json
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug
datastreams:
# endpoint: "" # Yandex Data Streams endpoint (default: https://yds.serverless.yandexcloud.net)
# streamname: "" # stream name in format /${region}/${folder_id}/${ydb_id}/${stream_name}
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug
syslog:
# host: "" # Syslog host, if not empty, Syslog output is enabled
# port: "" # Syslog endpoint port number
# protocol: "" # Syslog transport protocol. It can be either "tcp" or "udp" (default: tcp)
# format: "" # Syslog payload format. It can be either "json" or "cef" (default: json)
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
mqtt:
broker: "" # Broker address, can start with tcp:// or ssl://, if not empty, MQTT output is enabled
# topic: "falco/events" # Topic for messages (default: falco/events)
# qos: 0 # QOS for messages (default: 0)
# retained: false # If true, messages are retained (default: false)
# user: "" # User if the authentication is enabled in the broker
# password: "" # Password if the authentication is enabled in the broker
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
zincsearch:
# hostport: "" # http://{domain or ip}:{port}, if not empty, ZincSearch output is enabled
# index: "falco" # index (default: falco)
# username: "" # use this username to authenticate to ZincSearch (default: "")
# password: "" # use this password to authenticate to ZincSearch (default: "")
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
gotify:
# hostport: "" # http://{domain or ip}:{port}, if not empty, Gotify output is enabled
# token: "" # API Token
# format: "markdown" # Format of the messages (plaintext, markdown, json) (default: markdown)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
tekton:
# eventListener: "" # EventListener address, if not empty, Tekton output is enabled
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
# checkcert: true # check if ssl certificate of the output is valid (default: true)
spyderbat:
# orguid: "" # Organization to send output to, if not empty, Spyderbat output is enabled
# apikey: "" # Spyderbat API key with access to the organization
# apiurl: "https://api.spyderbat.com" # Spyderbat API url (default: "https://api.spyderbat.com")
# source: "falcosidekick" # Spyderbat source ID, max 32 characters (default: "falcosidekick")
# sourcedescription: "" # Spyderbat source description and display name if not empty, max 256 characters
# minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
timescaledb:
# host: "" # TimescaleDB host, if not empty, TImescaleDB output is enabled
# port: "5432" # TimescaleDB port (default: 5432)
# user: "postgres" # Username to authenticate with TimescaleDB (default: postgres)
# password: "postgres" # Password to authenticate with TimescaleDB (default: postgres)
# database: "" # TimescaleDB database used
# hypertablename: "falco_events" # Hypertable to store data events (default: falco_events) See TimescaleDB setup for more info
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
redis:
# address: "" # Redis address, if not empty, Redis output is enabled
# password: "" # Password to authenticate with Redis (default: "")
# database: "" # Redis database number (default: 0)
# storagetype: "" # Redis storage type: hashmap or list (default: "list")
# key: "" # Redis storage key name for hashmap, list(default: "falco")
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
telegram:
# token: "" # telegram bot authentication token
# chatid: "" # telegram Identifier of the shared chat
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
n8n:
# address: "" # N8N address, if not empty, N8N output is enabled
# user: "" # Username to authenticate with N8N in basic auth
# password: "" # Password to authenticate with N8N in basic auth
# headerauthname: "" # Header Auth Key to authenticate with N8N
# headerauthvalue: "" # Header Auth Value to authenticate with N8N
# checkcert: true # check if ssl certificate of the output is valid (default: true)
# minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)