diff --git a/.htmltest.yml b/.htmltest.yml index 50cbb62c3..cb2be4e3a 100644 --- a/.htmltest.yml +++ b/.htmltest.yml @@ -2,3 +2,4 @@ DirectoryPath: public IgnoreDirectoryMissingTrailingSlash: true CheckExternal: false IgnoreAltMissing: true +IgnoreInternalEmptyHash: true diff --git a/config.yaml b/config.yaml index 2cb2f1746..8e45fb269 100644 --- a/config.yaml +++ b/config.yaml @@ -259,7 +259,7 @@ languages: - name: ブログ url: "/blog" weight: 5 - + params: version: v0.20.0 githubRepository : falcosecurity/falco diff --git a/content/en/blog/cloud-native-security-hub.md b/content/en/blog/cloud-native-security-hub.md index 6554ddf2b..28e6db5c7 100644 --- a/content/en/blog/cloud-native-security-hub.md +++ b/content/en/blog/cloud-native-security-hub.md @@ -72,7 +72,7 @@ Keep reading to find out more on how to get involved and contribute, especially The project was originally started by Sysdig, but maintaining the repositories, and building out rules will now be governed by the CNCF and the Falco community. -If you are interested in getting involved with writing rules, or building out tooling around the new hub please reach out to [The official CNCF Falco Mailing List](https://lists.cncf.io/g/cncf-falco-dev) or join the [Falco slack channel](slack.sysdig.com). +If you are interested in getting involved with writing rules, or building out tooling around the new hub please reach out to [The official CNCF Falco Mailing List](https://lists.cncf.io/g/cncf-falco-dev) or join the [Falco slack channel](https://slack.sysdig.com). ### Integrating with Falcoctl diff --git a/content/en/docs/_index.md b/content/en/docs/_index.md index ebcdfec12..dddccd12d 100644 --- a/content/en/docs/_index.md +++ b/content/en/docs/_index.md @@ -24,7 +24,7 @@ People often ask how Falco differs from [SELinux](https://en.wikipedia.org/wiki/ ## How to use Falco -Falco is deployed as a long-running daemon. You can install it as a [Debian](installation#debian)/[rpm](installation#rhel) package on a regular host or container host, you can deploy it as a [container](installation#docker), or you can build it [from source](source). +Falco is deployed as a long-running daemon. You can install it as a [Debian](installation#debian)/[rpm](installation#centos-rhel) package on a regular host or container host, you can deploy it as a [container](installation#docker), or you can build it [from source](source). Falco is configured via (1) a [rules file](rules) that defines which behaviors and events to watch for and (2) a [general configuration file](configuration). Rules are expressed in a high-level, human-readable language. We've provided a sample rules file [`./rules/falco_rules.yaml`](https://github.com/falcosecurity/falco/blob/master/rules/falco_rules.yaml) as a starting point—you can (and will likely want!) to adapt it to your environment. diff --git a/content/en/docs/grpc/_index.md b/content/en/docs/grpc/_index.md index a8616cc0e..284528fc8 100644 --- a/content/en/docs/grpc/_index.md +++ b/content/en/docs/grpc/_index.md @@ -7,8 +7,8 @@ Starting from version [0.18.0](https://github.com/falcosecurity/falco/releases/t The current APIs are: -- [schema definition](./outputs): Subscribe to Falco output events. -- [schema definition](./version): Retrieve the Falco version. +- [schema definition](outputs): Subscribe to Falco output events. +- schema definition: Retrieve the Falco version. The current version is **{{< latest >}}**. In order to interact with these APIs, the falcosecurity organization provides the [Go](./client-go) and the [Python](./client-python) clients. diff --git a/content/en/docs/grpc/client-go.md b/content/en/docs/grpc/client-go.md index df87ff470..162c4066d 100644 --- a/content/en/docs/grpc/client-go.md +++ b/content/en/docs/grpc/client-go.md @@ -5,7 +5,7 @@ weight: 2 The [client-go](https://github.com/falcosecurity/client-go) Go library provides: -- [type and service mappings](https://godoc.org/github.com/falcosecurity/client-go/pkg/api/output) for the Falco gRPC API. For more information, see [output schema](./outputs). +- [type and service mappings](https://godoc.org/github.com/falcosecurity/client-go/pkg/api/output) for the Falco gRPC API. For more information, see [output schema](../outputs). - `Client` and `Config` structs aimed at simplifying the connection to the gRPC server. For more information, see [documentation](https://godoc.org/github.com/falcosecurity/client-go/pkg/client). Refer to the [fully-functional example](https://github.com/falcosecurity/client-go/blob/master/examples/output/main.go) to see how the Go client connects to the Falco gRPC Outputs API and displays the events in JSON. diff --git a/content/en/docs/installation.md b/content/en/docs/installation.md index bad643725..10ab75f58 100644 --- a/content/en/docs/installation.md +++ b/content/en/docs/installation.md @@ -65,7 +65,7 @@ cd falco/integrations/k8s-using-daemonset ```shell kubectl apply -f k8s-with-rbac/falco-account.yaml ``` -3. Create a service for the Falco pods. This will allow Falco to receive [Kubernetes Audit Log Events](event-sources/kubernetes-audit). If you're not planning on using this feature, you can skip this step. +3. Create a service for the Falco pods. This will allow Falco to receive [Kubernetes Audit Log Events](../event-sources/kubernetes-audit). If you're not planning on using this feature, you can skip this step. ```shell kubectl apply -f k8s-with-rbac/falco-service.yaml ``` @@ -84,7 +84,7 @@ k8s-using-daemonset$ cp ../../rules/falco_rules.* k8s-with-rbac/falco-config/ k8s-using-daemonset$ cp ../../rules/k8s_audit_rules.yaml k8s-with-rbac/falco-config/ ``` -5. Add the custom rules for your environment to the `falco_rules.local.yaml` file and they will be picked up by Falco at start time. You can also modify the `falco.yaml` file to change any [configuration options](configuration/) required for your deployment. Create the configMap as follows: +5. Add the custom rules for your environment to the `falco_rules.local.yaml` file and they will be picked up by Falco at start time. You can also modify the `falco.yaml` file to change any [configuration options](../configuration) required for your deployment. Create the configMap as follows: ```shell kubectl create configmap falco-config --from-file=k8s-with-rbac/falco-config ``` @@ -208,7 +208,7 @@ sudo bash install_falco ### Package install {#package} -#### CentOS/RHEL/Amazon Linux +#### CentOS/RHEL/Amazon Linux {#centos-rhel} 1. Trust the falcosecurity GPG key and configure the yum repository: diff --git a/content/en/docs/rules/supported-fields.md b/content/en/docs/rules/supported-fields.md index eed9da07f..1a1f5962f 100644 --- a/content/en/docs/rules/supported-fields.md +++ b/content/en/docs/rules/supported-fields.md @@ -5,13 +5,13 @@ weight: 3 # Introduction -Here are the fields supported by Falco. These fields can be used in the `condition` key of a Falco rule and well as the `output` key. Any fields included in the `output` key of a rule will also be included in the alert's `output_fields` object when [`json_output`](../alerts/#json-output) is set to `true`. +Here are the fields supported by Falco. These fields can be used in the `condition` key of a Falco rule and well as the `output` key. Any fields included in the `output` key of a rule will also be included in the alert's `output_fields` object when [`json_output`](../../alerts#json-output) is set to `true`. You can also see this set of fields via `falco --list=`, with `` being one of the sources below. # System Calls (source `syscall`) -`syscall` event source fields are provided by the [kernel module](../event-sources/kernel-module/). These fields are identical to the [Sysdig filter fields](https://github.com/draios/sysdig/wiki/Sysdig-User-Guide#all-supported-filters) that can be used to filter Sysdig captures. +`syscall` event source fields are provided by the [kernel module](../../event-sources/kernel-module/). These fields are identical to the [Sysdig filter fields](https://github.com/draios/sysdig/wiki/Sysdig-User-Guide#all-supported-filters) that can be used to filter Sysdig captures. ``` # System Kernel Fields @@ -478,7 +478,7 @@ marathon.group.id # Kubernetes Audit Events (source `k8s_audit`) -Kubernetes Audit event fields are supported by the Kubernetes Audit event source. For more information please refer to the [Kubernetes Audit event source](../event-sources/kubernetes-audit/) documentation. +Kubernetes Audit event fields are supported by the Kubernetes Audit event source. For more information please refer to the [Kubernetes Audit event source](../../event-sources/kubernetes-audit) documentation. ``` # Kubernetes Audit event Fields diff --git a/content/zh/docs/_index.md b/content/zh/docs/_index.md index b8519dad1..7fb808ff2 100644 --- a/content/zh/docs/_index.md +++ b/content/zh/docs/_index.md @@ -6,7 +6,7 @@ weight: 1 ## 关于 Falco -Falco 是一款旨在检测应用中反常活动的行为监视器,由[Sysdig](https://github.com/draios/sysdig)的[系统调用捕获](https://sysdig.com/blog/fascinating-world-linux-system-calls/)基础设施驱动。您仅需为 Falco 撰写[一套规则](rules),即可在一处持续监测并监控容器、应用、主机及网络的异常活动。 +Falco 是一款旨在检测应用中反常活动的行为监视器,由[Sysdig](https://github.com/draios/sysdig)的[系统调用捕获](https://sysdig.com/blog/fascinating-world-linux-system-calls/)基础设施驱动。您仅需为 Falco 撰写[一套规则](/docs/rules),即可在一处持续监测并监控容器、应用、主机及网络的异常活动。 ### Falco 可检测哪些行为? @@ -24,9 +24,9 @@ Falco 可以监测调用 [Linux 系统调用](http://man7.org/linux/man-pages/ma ## 如何使用 Falco -Falco 应作为守护程序部署。您可将其作为一款 [Debian](installation#debian)/[rpm](installation#rhel) 软件包安装在主机或容器宿主上,亦或可以作为[容器](installation#docker)部署。当然,您也可以下载[源代码](source)并自己动手编译安装。 +Falco 应作为守护程序部署。您可将其作为一款 [Debian](/docs/installation#debian)/[rpm](/docs/installation#centos-rhel) 软件包安装在主机或容器宿主上,亦或可以作为[容器](/docs/installation#docker)部署。当然,您也可以下载[源代码](/docs/source)并自己动手编译安装。 -您可通过[规则文件](rules)或[通用配置文件](configuration)定义 Falco 应监视的行为及事件。我们提供了一份示例规则文件 [`./rules/falco_rules.yaml`](https://github.com/falcosecurity/falco/blob/master/rules/falco_rules.yaml),您可随意修改规则来适配您的工作环境。 +您可通过[规则文件](/docs/rules)或[通用配置文件](/docs/configuration)定义 Falco 应监视的行为及事件。我们提供了一份示例规则文件 [`./rules/falco_rules.yaml`](https://github.com/falcosecurity/falco/blob/master/rules/falco_rules.yaml),您可随意修改规则来适配您的工作环境。 当您撰写规则时,Falco 可读取由 Sysdig 产生的回溯文件。这一特性可让您在调整规则时“录制”有害行为,并无限次数地回放。 @@ -34,7 +34,7 @@ Falco 应作为守护程序部署。您可将其作为一款 [Debian](installati ## Falco 行为报警 -当 Falco 检测到可疑行为时,[报警信息](alerts)可通过下列渠道输出: +当 Falco 检测到可疑行为时,[报警信息](/docs/alerts)可通过下列渠道输出: * 写入标准错误 * 写入文件