Tutorials

Sometimes, reading the documentation doesn't suffice to fully picture how to implement a solution. For this reason, many Falco users have contributed to the project with blogs in form of tutorials where they've reflected their experience with Falco and its ecosystem.

Here you can find a curated list of those tutorials grouped per category.

Hands-on Blogs

Introduction to Falco

• Learn how you can secure Kubernetes with Falco

Falco Deployment

• Build Falco drivers with Falco Driverkit and Docker
• Run Falco on an Apple Silicon Mac
• Add prebuilt drivers for a kernel release

Falco Plugins & Integrations

• Configure Docker to integrate gVisor with Falco
• Analyze Okta Log Events with a Falco Plugin
• Extend Falco inputs by creating a Plugin: The Basics
• Extend Falco inputs by creating a Plugin: Register the Plugin
• Export Falco metrics to Prometheus and Grafana

Falco Development

• Get started developing Falco
• Extend Falco adding support for new syscalls

Falcosidekick

• Inspect Kubernetes Audit Logs with Falco using the Kubernetes Webhook Backend
• Inspect Kubernetes Audit Logs with FluentBit and Falco using the Kubernetes Log Backend
• Build a Kubernetes Response Engine with Falcosidekick & Kubeless
• Build a Kubernetes Response Engine with Falcosidekick & OpenFaas
• Build a Kubernetes Response Engine with Falcosidekick & Knative
• Build a Kubernetes Response Engine with Falcosidekick & Tekton
• Build a Kubernetes Response Engine with Falcosidekick & Argo
• Build a Kubernetes Response Engine with Falcosidekick & Cloud Run
• Build a Kubernetes Response Engine with Falcosidekick & Cloud Functions
• Build a Kubernetes Response Engine with Falcosidekick & Flux v2
• Build a Kubernetes Response Engine with Falcosidekick & Fission

Contribute

This is a new section that intends to offer hands-on guides on using Falco. Feel free to send your guide, either in a blog format, or as an actual tutorial that will appear under this section.