Falco - Alerts

Overview

Falco is a cloud-native security tool. It provides near real-time threat detection for cloud, container, and Kubernetes workloads by leveraging runtime insights. Falco can monitor events defined with customizable rules from various sources, including the Linux kernel, and enrich them with metadata from the Kubernetes API server, container runtime, and more. This integration ingests the following logs:

• Alert: Represents details such as the rule name, description, condition, output message, priority level, and tags

The Falco integration seamlessly ingests the data of Falco logs using the webhook. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.

Setup

Configuration

Metric collection

Falco exposes Prometheus-formatted metrics that provide observability into its runtime, event processing, and security posture. The Datadog Agent can collect these metrics using the OpenMetrics integration. Follow the steps below to enable and configure metric collection from Falco.

1. Enable Prometheus Metrics in Falco

Edit your falco.yaml configuration file to enable the metrics endpoint:

metrics:
  enabled: true
  listen_address: "<FALCO_HOST>"
  listen_port: 8765

Restart Falco to apply the changes:

systemctl restart falco

If Falco is installed using Helm, you can enable metrics with:

helm upgrade -i falco falcosecurity/falco \
  --set metrics.enabled=true \
  --set metrics.listen_address="<FALCO_HOST>" \
  --set metrics.listen_port=8765

2. Configure the Datadog Agent

Update your Datadog Agent configuration to scrape Falco’s Prometheus metrics endpoint. For example, add the following to conf.d/prometheus.d/conf.yaml:

instances:
  - openmetrics_endpoint: http://<FALCO_HOST>:8765/metrics

Replace <FALCO_HOST> with the hostname or IP address where Falco is running.

For Kubernetes environments, you can use Autodiscovery Integration Templates to configure the Agent to automatically discover and scrape Falco metrics endpoints.

3. Validation

After configuration, verify that Falco metrics are being ingested by Datadog. You should see metrics with the prefix falco. in the Datadog Metrics Explorer.

Log Collection

json_output: true
file_output:
  enabled: true
  filename: <PATH TO LOGS>

master

Data Collected

Metrics

Logs

The Falco integration collects and forwards Falco alert logs to Datadog.

Events

The Falco integration does not include any events.

Support

For further assistance, contact Datadog Support.