May 2016 Summaries

Sysdig has introduced a Cloud Metrics Dictionary to enhance the understanding and usability of metrics monitoring by providing clear definitions for default metrics collected within its application. This tool is designed to assist new team members and those who may not regularly engage with monitoring data by offering accessible explanations in both the application and documentation. Users can view metric definitions by hovering over a question mark icon in the application or by browsing the published dictionary in the documentation, making it easy to find and understand relevant metrics. The Metrics Dictionary is immediately available and will be continuously updated as new metrics are added.

Falco is an open-source behavioral security monitoring tool released by Sysdig, designed to provide real-time notification of suspicious activities within container environments by analyzing system calls. Unlike traditional signature-based security systems, Falco focuses on detecting anomalous behaviors that occur after an attacker gains access to a system, rather than cataloging potential threats. By monitoring system calls, Falco can efficiently track host activities such as file integrity, process execution, and network connections, offering a simpler and more intuitive alternative to complex security configurations like SELinux and AppArmor. Falco operates as a long-running server agent, easily deployable as a container or host package, and integrates seamlessly with existing monitoring systems by adhering to the Unix philosophy of doing one thing well. Its flexible rule-based system allows users to express security concerns through simple filters, and its ability to back-test rules using historical data facilitates efficient rule development and testing. Falco aims to fill a niche in the market by being lightweight, easy to configure, and effective in containerized environments, with a focus on encouraging community contributions for evolving threat detection capabilities.

Sysdig Cloud's introduction of multi-condition alerts aims to reduce unnecessary notifications and enhance the specificity of alerts, allowing users to rest undisturbed unless critical conditions occur. This feature enables users to set alerts based on multiple metrics and conditions, such as a drop in database transactions combined with increased request latency, ensuring alerts are only triggered when truly necessary. The advanced alerting system allows for complex alert configurations using aggregate functions and relational operators, enabling users to define detailed conditions like monitoring CPU usage or database health across multiple nodes. When these alerts are triggered, Sysdig Cloud can initiate a Sysdig Capture, providing detailed insights into the system's state at the time of the alert, thus assisting in precise troubleshooting and remediation.