New release of Sysdig Open Source leverages Falco plugins
Blog post from Sysdig
Sysdig's latest release of its open-source tool introduces significant enhancements, including support for plugins, which extend the tool's capabilities by allowing the integration of new event sources similar to Falco's functionality. The update includes features such as output color coding, Podman support, and new syscalls, alongside a new filtering option. By leveraging plugins, users can define new fields and evaluate additional event sources using Falco rules, enhancing the tool’s versatility in threat detection. Installation instructions are provided, showcasing how to set up and test plugins like the dummy and docker plugins, which facilitate interaction with Docker events. This advancement signifies Sysdig's commitment to enhancing its open-source security framework, enabling the detection of infrastructure threats in a more efficient manner, whether on-premise or in the cloud.