π Image
README
ΒΆ
plugin-sdk-go
π Falco Core Repository
π Stable
π License
π Go Reference
π Release
π Go Report Card
Introduction
This SDK facilitates writing plugins for Falco or application using Falcosecurity's libs.
Quick start
Before using this SDK, review the developer's guide which fully documents the API and provides best practices for writing plugins. The developer's guide includes a walkthrough of a plugin written in Go that uses this package.
For a quick start, you can refer to the provided examples:
- plugin with field extraction
- plugin with event sourcing
- plugin with both event sourcing and field extraction
What's next
When ready to release your plugin, make sure to register the plugin with the Falcosecurity organization by creating a PR to the falcosecurity/plugins respository with details on the new plugin. This ensures that a given ID is used by exactly one plugin with event sourcing capability, and allows authors of plugins with field extraction capability to coordinate about event source formats.
Join the Community
To get involved with The Falco Project please visit the community repository to find more.
How to reach out?
- Join the #falco channel on the Kubernetes Slack
- Join the Falco mailing list
Contributing
See the CONTRIBUTING.md.
Security Audit
A third party security audit was performed by Cure53, you can see the full report here.
Reporting security vulnerabilities
Please report security vulnerabilities following the community process documented here.
License Terms
This project is licensed to you under the Apache 2.0 open source license.
π Image
Directories
ΒΆ
| Path | Synopsis |
|---|---|
|
benchmarks
|
|
|
async
module
|
|
|
examples
|
|
|
custom
module
|
|
|
extractor
module
|
|
|
full
module
|
|
|
source
module
|
|
|
pkg
|
|
|
sdk
Package sdk provides definitions and constructs for developers that would like to write Falcosecurity Plugins (https://falco.org/docs/plugins/) in Go.
|
Package sdk provides definitions and constructs for developers that would like to write Falcosecurity Plugins (https://falco.org/docs/plugins/) in Go. |
|
sdk/internal/hooks
Package hooks contains a set of hooks to be used internally in the SDK.
|
Package hooks contains a set of hooks to be used internally in the SDK. |
|
sdk/plugins
Package plugins and its subpackages provide high-level constructs to easily develop plugins, abstracting all the low-level details of the plugin framework.
|
Package plugins and its subpackages provide high-level constructs to easily develop plugins, abstracting all the low-level details of the plugin framework. |
|
sdk/plugins/extractor
Package extractor provides high-level constructs to easily build plugins with field extraction capability.
|
Package extractor provides high-level constructs to easily build plugins with field extraction capability. |
|
sdk/plugins/source
Package source provides high-level constructs to easily build plugins with event sourcing capability.
|
Package source provides high-level constructs to easily build plugins with event sourcing capability. |
|
sdk/symbols
Package symbols provides prebuilt implementations for all the C symbols required to develop plugins as for the definitions of plugin_types.h.
|
Package symbols provides prebuilt implementations for all the C symbols required to develop plugins as for the definitions of plugin_types.h. |
|
sdk/symbols/evtstr
This package exports the following C function: - char* plugin_event_to_string(ss_plugin_t *s, const ss_plugin_event *evt)
|
This package exports the following C function: - char* plugin_event_to_string(ss_plugin_t *s, const ss_plugin_event *evt) |
|
sdk/symbols/extract
This package exports the following C function: - ss_plugin_rc plugin_extract_fields(ss_plugin_t *s, const ss_plugin_event *evt, uint32_t num_fields, ss_plugin_extract_field *fields)
|
This package exports the following C function: - ss_plugin_rc plugin_extract_fields(ss_plugin_t *s, const ss_plugin_event *evt, uint32_t num_fields, ss_plugin_extract_field *fields) |
|
sdk/symbols/fields
This package exports the following C function: - char* plugin_get_fields()
|
This package exports the following C function: - char* plugin_get_fields() |
|
sdk/symbols/info
This package exports a set of C functions that provide general information about the plugin.
|
This package exports a set of C functions that provide general information about the plugin. |
|
sdk/symbols/initialize
This package exports the following C functions: - ss_plugin_t* plugin_init(char* config, int32_t* rc) - void* plugin_destroy(ss_plugin_t* s)
|
This package exports the following C functions: - ss_plugin_t* plugin_init(char* config, int32_t* rc) - void* plugin_destroy(ss_plugin_t* s) |
|
sdk/symbols/initschema
This package exports the following C function: - const char* get_init_schema(ss_plugin_schema_type* schema_type)
|
This package exports the following C function: - const char* get_init_schema(ss_plugin_schema_type* schema_type) |
|
sdk/symbols/lasterr
This package exports the following C function: - char* plugin_get_last_error(ss_plugin_t* s)
|
This package exports the following C function: - char* plugin_get_last_error(ss_plugin_t* s) |
|
sdk/symbols/listopen
This package exports the following C function: - char* plugin_list_open_params()
|
This package exports the following C function: - char* plugin_list_open_params() |
|
sdk/symbols/nextbatch
This package exports the following C function: - ss_plugin_rc plugin_next_batch(ss_plugin_t* s, ss_instance_t* h, uint32_t *nevts, ss_plugin_event ***evts)
|
This package exports the following C function: - ss_plugin_rc plugin_next_batch(ss_plugin_t* s, ss_instance_t* h, uint32_t *nevts, ss_plugin_event ***evts) |
|
sdk/symbols/open
This package exports the following C functions: - ss_instance_t* plugin_open(ss_plugin_t* s, char* params, ss_plugin_rc* rc) - void plugin_close(ss_plugin_t* s, ss_instance_t* h)
|
This package exports the following C functions: - ss_instance_t* plugin_open(ss_plugin_t* s, char* params, ss_plugin_rc* rc) - void plugin_close(ss_plugin_t* s, ss_instance_t* h) |
|
sdk/symbols/progress
This package exports the following C function: - char* plugin_get_progress(ss_plugin_t* s, ss_instance_t* h, uint32_t* progress_pct)
|
This package exports the following C function: - char* plugin_get_progress(ss_plugin_t* s, ss_instance_t* h, uint32_t* progress_pct) |
