Practical Cloud Native Security with Falco

Chapter 8. The Output Framework

In previous chapters, you learned how Falco collects events (its input) and how it processes them to allow you to receive important security notifications (its output). At the end of this processing pipeline, a key piece of Falco—the output framework—enables it to deliver those notifications (also called alerts) to the right place. We call it a framework because its modular design provides all you need to deliver notifications to any destination you wish. In this chapter, you will learn how the output framework works and how you can configure and extend it.

Falco’s Output Architecture

The output framework is the last piece of the event-processing pipeline that we have been describing in this part of the book. Falco’s user-space program implements the core mechanism internally, but external tools can extend it. Its job is to deliver notifications to the correct destination on time. Whenever an upstream event (produced by a driver, a plugin, or any other input source supported by Falco) meets a rule’s condition, the rule engine asks the output framework to send a notification to a downstream consumer, which could be any other program or system in your environment (or simply you).

The process of delivering alerts involves two distinct stages, as pictured in Figure 8-1.

In the first stage, a handler receives the event data and information about the event-triggered rule. It prepares the notification using the provided information and formats ...