Plugins Architecture Concepts
Learn the basic concepts of the Plugin Architecture
Falco Plugins
Last modified December 15, 2022
Extend Falco functionality using Plugins for Falco libraries/Falco daemon
The Falco libraries and Falco itself can be extended by using Plugins. Plugins are shared libraries that conform to a documented API and allow for:
- Adding new event sources that can be evaluated using filtering expressions/Falco rules.
- Adding the ability to define new fields that can extract information from events.
This section describes how plugins fit into the existing event processing pipeline and how to enable/configure plugins in Falco.
If you're interested in how this feature came about, you can view the original proposal for the plugin system.
How Falco Uses Plugins
Plugins for Falco libraries/Falco daemon
Where's the Code
Find out about the included plugins in Falco and the Plugins SDK
Falco Plugins Developers Guide
Start writing your own Falco plugins
Falco Plugins Go SDK Walkthrough
High-level documentation of the Go SDK
Falco Plugins API Reference
Learn how the Plugins API works
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.
Last modified December 15, 2022: limit _index.md to intro content (7070ae8)