gRPC API
Starting from version 0.18.0, Falco has its own gRPC server which provides a set of gRPC APIs.
The current APIs are:
- schema definition: get or subscribe to Falco output events.
- schema definition: retrieve the Falco version.
In order to interact with these APIs, the falcosecurity organization provides some clients/SDKs:
Configuration
The Falco gRPC server and the Falco gRPC Outputs APIs are not enabled by default.
To enable them, edit the falco.yaml
Falco configuration file. A sample Falco configuration file is given below:
As you can see, binding to a network address requires you to generate and specify a set of TLS certificates as show in the next section.
Alternatively, if you want something simpler, you can tell Falco to bind the gRPC server to a local unix socket, this does not require you to generate certificates for mTLS but also comes without any authentication mechanism.
Then, remember to enable the services you need, otherwise the gRPC server won't expose anything, for the outputs use:
Certificates
When configured to bind to a network address, the Falco gRPC server works only with mutual TLS by design. Therefore, you have to generate the certificates and update the paths in the above configuration.
The Falco authors plan to automate the certificates generation soon.
In the meantime, use the following script to generate the certificates.
Note: Ensure that you configure the -passin
, -passout
, and -subj
flags according to your settings.
Generate valid CA
Run the following command:
Generate valid Server Key/Cert
Run the following command:
Remove passphrase from the Server Key
Run the following command:
Generate valid Client Key/Cert
Run the following command:
Remove passphrase from Client Key
Run the following command:
Usage
When the configuration is complete, Falco is ready to expose its gRPC server and its Outputs APIs.
To do so, simply run Falco. For example:
Refer to the Go client or Python client documentation to learn how to receive and consume Falco output events.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.