Kubernative by Palark | Kubernetes news and goodies: “A new tool is announced for those who use Falco to detect suspicious e…”

A new tool is announced for those who use Falco to detect suspicious events and lack a convenient way of reacting to them: Falco Talon.

Thomas Labarussias, the author of Falcosidekick, calls his new project a missing piece for Falco users. Falco Talon is a response engine for managing threats in Kubernetes clusters. It provides you with a simple, no-code solution to react to events from Falco by creating simple rules in YAML. Its features available with the first GA release (v0.1.0) include:

- Numerous ready-to-use actions to perform (actionners), such as kubernetes:exec, kubernetes:log, aws:lambda, cilium:networkpolicy, and more;
- Writing artifacts resulting from actions to local files, AWS S3, or MinIO S3;
- Various notifiers to forward action results, including Kubernetes events, Loki, Slack, webhooks, etc.;
- Structured logs, metrics (Prometheus and OTEL formats), and OTEL traces.

▶️ GitHub repo
📢 Project announcement

#tools #security #news