This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Installation and Usage

How to install and use Falco Talon

1 - Usage

How to use Falco Talon
$ falco-talon --help

Falco Talon is a Response Engine for managing threats in Kubernetes 
It enhances the solutions proposed by Falco community with a dedicated, 
no-code solution. With easy rules, you can perform actions over compromised pods

  falco-talon [command]

Available Commands:
  check       Check Falco Talon Rules file
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  server      Start Falco Talon
  version     Print version of Falco Talon.

  -c, --config string       Falco Talon Config File (default "/etc/falco-talon/config.yaml")
  -h, --help                help for falco-talon
  -r, --rules stringArray   Falco Talon Rules File (default [/etc/falco-talon/rules.yaml])

Use "falco-talon [command] --help" for more information about a command.
$ falco-talon server --help

Start Falco Talon

  falco-talon server [flags]

  -h, --help   help for server

Global Flags:
  -c, --config string       Falco Talon Config File (default "/etc/falco-talon/config.yaml")
  -r, --rules stringArray   Falco Talon Rules File (default [/etc/falco-talon/rules.yaml])
$ falco-talon check --help

Check Falco Talon Rules file

  falco-talon check [flags]

  -h, --help   help for check

Global Flags:
  -c, --config string       Falco Talon Config File (default "/etc/falco-talon/config.yaml")
  -r, --rules stringArray   Falco Talon Rules File (default [/etc/falco-talon/rules.yaml])

2 - Connect Falcosidekick to Falco Talon

How to receive the Falco Events from Falcosidekick

Once you have installed Falco Talon with Helm in the falco namespace, you have to connect Falcosidekick by adding the flag --set falcosidekick.config.webhook.address=http://falco-talon:2803

helm install falco falcosecurity/falco --namespace falco \
  --create-namespace \
  --set tty=true \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.webhook.address=http://falco-talon:2803

3 - Installation from the sources

How to install Falco Talon locally from the sources


4 - Installation in k8s with Helm

How to install Falco Talon in Kubernetes with Helm


The helm chart is available in this folder deployment/helm. Two main config files are provided:

  • values.yaml allows you to configure the static settings of Falcon Talon and its deployment
  • rules.yaml contains the rules to set

Clone and install

Git clone is used to target and create a copy of the falco-talon repository:

git clone

Once downloaded, change directory to the Helm folder before running the helm install command:

cd falco-talon/deployment/helm/
helm install falco-talon . -n falco --create-namespace

5 - Prometheus metrics

Prometheus metrics

Falco Talon exposes a /metrics endpoint to with some metrics in the Prometheus format.

# HELP action_total number of actions
# TYPE action_total counter
action_total{action="Disable outbound connections",actionner="kubernetes:networkpolicy",event="Test logs",namespace="falco",otel_scope_name="",otel_scope_version="devel",pod="falco-5b7kc",rule="Suspicious outbound connection",status="failure"} 6
action_total{action="Terminate Pod",actionner="kubernetes:terminate",event="Test logs",namespace="falco",otel_scope_name="",otel_scope_version="devel",pod="falco-5b7kc",rule="Suspicious outbound connection",status="failure"} 6
# HELP event_total number of received events
# TYPE event_total counter
event_total{event="Unexpected outbound connection destination",otel_scope_name="",otel_scope_version="devel",priority="Critical",source="syscalls"} 2
# HELP match_total number of matched events
# TYPE match_total counter
match_total{event="Unexpected outbound connection destination",otel_scope_name="",otel_scope_version="devel",priority="Critical",rule="Suspicious outbound connection",source="syscalls"} 2