generated from falcosecurity/template-repository
-
Notifications
You must be signed in to change notification settings - Fork 304
/
Copy pathvalues.yaml
1403 lines (1295 loc) · 58.4 KB
/
values.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Default values for falcosidekick.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
# -- number of running pods
replicaCount: 2
# -- number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10)
# revisionHistoryLimit: 1
image:
# -- The image registry to pull from
registry: docker.io
# -- The image repository to pull from
repository: falcosecurity/falcosidekick
# -- The image tag to pull
tag: 2.31.1
# -- The image pull policy
pullPolicy: IfNotPresent
# -- Sidekick pod securityContext
podSecurityContext:
runAsUser: 1234
fsGroup: 1234
# -- Sidekick container securityContext
securityContext: {}
# One or more secrets to be used when pulling images
# -- Secrets for the registry
imagePullSecrets: []
# - registrySecretName
# -- Override name
nameOverride: ""
# -- Override the name
fullnameOverride: ""
# -- podSecurityPolicy
podSecurityPolicy:
# -- Whether to create a podSecurityPolicy
create: false
# -- Name of the priority class to be used by the Sidekickpods, priority class needs to be created beforehand
priorityClassName: ""
# -- custom labels to add to all resources
customLabels: {}
# -- custom annotations to add to all resources
customAnnotations: {}
# -- additions labels on the pods
podLabels: {}
# -- additions annotations on the pods
podAnnotations: {}
serviceMonitor:
# -- enable the deployment of a Service Monitor for the Prometheus Operator.
enabled: false
# -- specify Additional labels to be added on the Service Monitor.
additionalLabels: {}
# -- specify a user defined interval. When not specified Prometheus default interval is used.
interval: ""
# -- specify a user defined scrape timeout. When not specified Prometheus default scrape timeout is used.
scrapeTimeout: ""
# -- allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.
additionalProperties: {}
prometheusRules:
# -- enable the creation of PrometheusRules for alerting
enabled: false
alerts:
warning:
# -- enable the high rate rule for the warning events
enabled: true
# -- rate interval for the high rate rule for the warning events
rate_interval: "5m"
# -- threshold for the high rate rule for the warning events
threshold: 0
error:
# -- enable the high rate rule for the error events
enabled: true
# -- rate interval for the high rate rule for the error events
rate_interval: "5m"
# -- threshold for the high rate rule for the error events
threshold: 0
critical:
# -- enable the high rate rule for the critical events
enabled: true
# -- rate interval for the high rate rule for the critical events
rate_interval: "5m"
# -- threshold for the high rate rule for the critical events
threshold: 0
alert:
# -- enable the high rate rule for the alert events
enabled: true
# -- rate interval for the high rate rule for the alert events
rate_interval: "5m"
# -- threshold for the high rate rule for the alert events
threshold: 0
emergency:
# -- enable the high rate rule for the emergency events
enabled: true
# -- rate interval for the high rate rule for the emergency events
rate_interval: "5m"
# -- threshold for the high rate rule for the emergency events
threshold: 0
output:
# -- enable the high rate rule for the errors with the outputs
enabled: true
# -- rate interval for the high rate rule for the errors with the outputs
rate_interval: "5m"
# -- threshold for the high rate rule for the errors with the outputs
threshold: 0
additionalAlerts: {}
# -- grafana contains the configuration related to grafana.
grafana:
# -- dashboards contains configuration for grafana dashboards.
dashboards:
# -- enabled specifies whether the dashboards should be deployed.
enabled: false
# --configmaps to be deployed that contain a grafana dashboard.
configMaps:
# -- falcosidekick contains the configuration for falcosidekick's dashboard.
falcosidekick:
# -- name specifies the name for the configmap.
name: falcosidekick-grafana-dashboard
# -- namespace specifies the namespace for the configmap.
namespace: ""
# -- folder where the dashboard is stored by grafana.
folder: ""
config:
# -- Existing secret with configuration
existingSecret: ""
# -- Extra environment variables
extraEnv: []
# -- Extra command-line arguments
extraArgs: []
# -- DEBUG environment variable
debug: false
# -- a list of escaped comma separated custom fields to add to falco events, syntax is "key:value\,key:value"
customfields: ""
# -- a list of escaped comma separated Go templated fields to add to falco events, syntax is "key:template\,key:template"
templatedfields: ""
# -- a list of escaped comma separated custom tags to add to falco events, syntax is "tag\,tag"
customtags: ""
# -- if not empty, the brackets in keys of Output Fields are replaced
bracketreplacer: ""
# if not empty, allow to change the format of the output field. (example: "<timestamp>: <priority> <output> <custom_fields> <templated_fields>") (default: "<timestamp>: <priority> <output>")
outputFieldFormat: ""
# -- folder which will used to store client.crt, client.key and ca.crt files for mutual tls for outputs, will be deprecated in the future (default: "/etc/certs")
mutualtlsfilespath: "/etc/certs"
mutualtlsclient:
# -- client certification file for mutual TLS client certification, takes priority over mutualtlsfilespath if not empty
certfile: ""
# -- client key file for mutual TLS client certification, takes priority over mutualtlsfilespath if not empty
keyfile: ""
# -- CA certification file for server certification for mutual TLS authentication, takes priority over mutualtlsfilespath if not empty
cacertfile: ""
tlsclient:
# -- CA certificate file for server certification on TLS connections, appended to the system CA pool if not empty
cacertfile: ""
tlsserver:
# -- if true TLS server will be deployed instead of HTTP
deploy: false
# -- existing secret with server.crt, server.key and ca.crt files for TLS Server
existingSecret: ""
# -- server.crt file for TLS Server
servercrt: ""
# -- server certification file path for TLS Server
certfile: "/etc/certs/server/server.crt"
# -- server.key file for TLS Server
serverkey: ""
# -- server key file path for TLS Server
keyfile: "/etc/certs/server/server.key"
# -- if true mutual TLS server will be deployed instead of TLS, deploy also has to be true
mutualtls: false
# ca.crt file for client certification if mutualtls is true
cacrt: ""
# -- CA certification file path for client certification if mutualtls is true
cacertfile: "/etc/certs/server/ca.crt"
# -- port to serve http server serving selected endpoints
notlsport: 2810
# -- a comma separated list of endpoints, if not empty, and tlsserver.deploy is true, a separate http server will be deployed for the specified endpoints (/ping endpoint needs to be notls for Kubernetes to be able to perform the healthchecks)
notlspaths: "/ping"
slack:
# -- Slack Webhook URL (ex: <https://hooks.slack.com/services/XXXX/YYYY/ZZZZ>), if not `empty`, Slack output is *enabled*
webhookurl: ""
# -- Slack channel (optionnal)
channel: ""
# -- Slack Footer
footer: ""
# -- Slack icon (avatar)
icon: ""
# -- Slack username
username: ""
# -- `all` (default), `text` (only text is displayed in Slack), `fields` (only fields are displayed in Slack)
outputformat: "all"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- a Go template to format Slack Text above Attachment, displayed in addition to the output from `slack.outputformat`. If empty, no Text is displayed before Attachment
messageformat: ""
rocketchat:
# -- Rocketchat Webhook URL (ex: <https://XXXX/hooks/YYYY>), if not `empty`, Rocketchat output is *enabled*
webhookurl: ""
# -- Rocketchat icon (avatar)
icon: ""
# -- Rocketchat username
username: ""
# -- `all` (default), `text` (only text is displayed in Rocketcaht), `fields` (only fields are displayed in Rocketchat)
outputformat: "all"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- a Go template to format Rocketchat Text above Attachment, displayed in addition to the output from `slack.outputformat`. If empty, no Text is displayed before Attachment
messageformat: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
mattermost:
# -- Mattermost Webhook URL (ex: <https://XXXX/hooks/YYYY>), if not `empty`, Mattermost output is *enabled*
webhookurl: ""
# -- Mattermost Footer
footer: ""
# -- Mattermost icon (avatar)
icon: ""
# -- Mattermost username
username: ""
# -- `all` (default), `text` (only text is displayed in Slack), `fields` (only fields are displayed in Mattermost)
outputformat: "all"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- a Go template to format Mattermost Text above Attachment, displayed in addition to the output from `slack.outputformat`. If empty, no Text is displayed before Attachment
messageformat: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
teams:
# -- Teams Webhook URL (ex: <https://outlook.office.com/webhook/XXXXXX/IncomingWebhook/YYYYYY>"), if not `empty`, Teams output is *enabled*
webhookurl: ""
# -- Teams section image
activityimage: ""
# -- `all` (default), `text` (only text is displayed in Teams), `facts` (only facts are displayed in Teams)
outputformat: "all"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
datadog:
# -- Datadog API Key, if not `empty`, Datadog output is *enabled*
apikey: ""
# -- Datadog host. Override if you are on the Datadog EU site. Defaults to american site with "<https://api.datadoghq.com>"
host: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
datadoglogs:
# -- Datadog API Key, if not empty, Datadog Logs output is enabled
apikey: ""
# -- Datadog host. Override if you are on the Datadog EU site. Defaults to american site with "https://http-intake.logs.datadoghq.com/"
host: ""
# -- The name of the application or service generating the log events.
service: ""
# -- minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
minimumpriority: ""
alertmanager:
# -- Comma separated list of http://{domain or ip}:{port} that will all receive the payload, if not empty, Alertmanager output is enabled
hostport: ""
# -- alertmanager endpoint on which falcosidekick posts alerts, choice is: `"/api/v1/alerts" or "/api/v2/alerts" , default is "/api/v1/alerts"`
endpoint: "/api/v1/alerts"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- if set to a non-zero value, alert expires after that time in seconds (default: 0)
expireafter: ""
# -- comma separated list of labels composed of a ':' separated name and value that is added to the Alerts. Example: my_label_1:my_value_1, my_label_1:my_value_2
extralabels: ""
# -- comma separated list of annotations composed of a ':' separated name and value that is added to the Alerts. Example: my_annotation_1:my_value_1, my_annotation_1:my_value_2
extraannotations: ""
# -- comma separated list of tuple composed of a ':' separated Falco priority and Alertmanager severity that is used to override the severity label associated to the priority level of falco event. Example: debug:value_1,critical:value2. Default mapping: emergency:critical,alert:critical,critical:critical,error:warning,warning:warning,notice:information,informational:information,debug:information.
customseveritymap: ""
# -- default priority of dropped events, values are emergency|alert|critical|error|warning|notice|informational|debug
dropeventdefaultpriority: "critical"
# -- comma separated list of priority re-evaluation thresholds of dropped events composed of a ':' separated integer threshold and string priority. Example: `10000:critical, 100:warning, 1:informational`
dropeventthresholds: "10000:critical, 1000:critical, 100:critical, 10:warning, 1:warning"
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
elasticsearch:
# -- Elasticsearch <http://host:port>, if not `empty`, Elasticsearch is *enabled*
hostport: ""
# -- Elasticsearch index
index: "falco"
# -- Elasticsearch document type
type: "_doc"
# -- Optional ingest pipeline name
pipeline: ""
# -- Date suffix for index rotation : daily, monthly, annually, none
suffix: "daily"
# -- Use this APIKey to authenticate to Elasticsearch if the APIKey is not empty (default: "")
apikey: ""
# -- Use this username to authenticate to Elasticsearch if the username is not empty
username: ""
# -- Use this password to authenticate to Elasticsearch if the password is not empty
password: ""
# -- Replace . by _ to avoid mapping conflicts, force to true if createindextemplate==true (default: false)
flattenfields: false
# -- Create an index template (default: false)
createindextemplate: false
# -- Number of shards set by the index template (default: 3)
numberofshards: 3
# -- Number of replicas set by the index template (default: 3)
numberofreplicas: 3
# -- a list of comma separated custom headers to add, syntax is "key:value,key:value"
customheaders: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
# -- if true enables gzip compression for http requests (default: false)
enablecompression: false
# -- max number of concurrent http requests (default: 1)
maxconcurrentrequests: 1
# -- batching configuration, improves throughput dramatically utilizing _bulk Elasticsearch API
batching:
# -- if true enables batching
enabled: true
# -- batch size in bytes (default: 5 MB) (use string to avoid the conversion into float64 by helm)
batchsize: "5242880"
# -- batch fush interval (default: 1s)
flushinterval: 1s
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
influxdb:
# -- Influxdb <http://host:port>, if not `empty`, Influxdb is *enabled*
hostport: ""
# -- Influxdb database
database: "falco"
# -- Influxdb organization
organization: ""
# -- write precision
precision: "ns"
# -- User to use if auth is *enabled* in Influxdb
user: ""
# -- Password to use if auth is *enabled* in Influxdb
password: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- API token to use if auth in enabled in Influxdb (disables user and password)
token: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
loki:
# -- Loki <http://host:port>, if not `empty`, Loki is *enabled*
hostport: ""
# -- user for Grafana Logs
user: ""
# -- API Key for Grafana Logs
apikey: ""
# -- Loki endpoint URL path, more info: <https://grafana.com/docs/loki/latest/api/#post-apiprompush>
endpoint: "/loki/api/v1/push"
# -- Loki tenant, if not `empty`, Loki tenant is *enabled*
tenant: ""
# -- Format for the log entry value: json, text (default)
format: "text"
# -- comma separated list of fields to use as labels additionally to rule, source, priority, tags and custom_fields
extralabels: ""
# -- a list of comma separated custom headers to add, syntax is "key:value,key:value"
customheaders: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
# -- dashboard for Grafana
grafanaDashboard:
# -- enabled specifies whether this dashboard should be deployed.
enabled: true
# --configmaps to be deployed that contain a grafana dashboard.
configMap:
# -- name specifies the name for the configmap.
name: falcosidekick-loki-dashboard-grafana
# -- namespace specifies the namespace for the configmap.
namespace: ""
# -- folder where the dashboard is stored by grafana.
folder: ""
prometheus:
# -- comma separated list of fields to use as labels additionally to rule, source, priority, tags and custom_fields
extralabels: ""
nats:
# -- NATS "nats://host:port", if not `empty`, NATS is *enabled*
hostport: ""
# -- template for the subject, tokens <priority> and <rule> will be automatically replaced (default: falco.<priority>.<rule>)
subjecttemplate: "falco.<priority>.<rule>"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
stan:
# -- Stan nats://{domain or ip}:{port}, if not empty, STAN output is *enabled*
hostport: ""
# -- Cluster name, if not empty, STAN output is *enabled*
clusterid: ""
# -- Client ID, if not empty, STAN output is *enabled*
clientid: ""
# -- template for the subject, tokens <priority> and <rule> will be automatically replaced (default: falco.<priority>.<rule>)
subjecttemplate: "falco.<priority>.<rule>"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
aws:
# -- Use IRSA, if true, the rolearn value will be used to set the ServiceAccount annotations and not the env var
useirsa: true
# -- AWS IAM role ARN for falcosidekick service account to associate with (optionnal if you use EC2 Instance Profile)
rolearn: ""
# -- External id for the role to assume (optional if you use EC2 Instance Profile)
externalid: ""
# -- AWS Access Key Id (optionnal if you use EC2 Instance Profile)
accesskeyid: ""
# -- AWS Secret Access Key (optionnal if you use EC2 Instance Profile)
secretaccesskey: ""
# -- AWS Region (optionnal if you use EC2 Instance Profile)
region: ""
# -- check the identity credentials, set to false for locale developments
checkidentity: true
cloudwatchlogs:
# -- AWS CloudWatch Logs Group name, if not empty, CloudWatch Logs output is *enabled*
loggroup: ""
# -- AWS CloudWatch Logs Stream name, if empty, Falcosidekick will try to create a log stream
logstream: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
lambda:
# -- AWS Lambda Function Name, if not empty, AWS Lambda output is *enabled*
functionname: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
sns:
# -- AWS SNS TopicARN, if not empty, AWS SNS output is *enabled*
topicarn: ""
# -- Send RawJSON from `falco` or parse it to AWS SNS
rawjson: false
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
sqs:
# -- AWS SQS Queue URL, if not empty, AWS SQS output is *enabled*
url: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
s3:
# -- AWS S3, bucket name
bucket: ""
# -- AWS S3, name of prefix, keys will have format: s3://<bucket>/<prefix>/YYYY-MM-DD/YYYY-MM-DDTHH:mm:ss.s+01:00.json
prefix: ""
# -- Endpoint URL that overrides the default generated endpoint, use this for S3 compatible APIs
endpoint: ""
# -- Canned ACL (x-amz-acl) to use when creating the object
objectcannedacl: "bucket-owner-full-control"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
kinesis:
# -- AWS Kinesis Stream Name, if not empty, Kinesis output is *enabled*
streamname: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
securitylake:
# -- Bucket for AWS SecurityLake data, if not empty, AWS SecurityLake output is enabled
bucket: ""
# -- Bucket Region
region: ""
# -- Prefix for keys
prefix: ""
# -- Account ID
accountid: ""
# -- Time in minutes between two puts to S3 (must be between 5 and 60min)
interval: 5
# -- Max number of events by parquet file
batchsize: 1000
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
smtp:
# -- "host:port" address of SMTP server, if not empty, SMTP output is *enabled*
hostport: ""
# -- use TLS connection (true/false)
tls: true
# -- SASL Mechanisms : plain, oauthbearer, external, anonymous or "" (disable SASL)
authmechanism: "plain"
# -- user to access SMTP server
user: ""
# -- password to access SMTP server
password: ""
# -- OAuthBearer token for OAuthBearer Mechanism
token: ""
# -- identity string for Plain and External Mechanisms
identity: ""
# -- trace string for Anonymous Mechanism
trace: ""
# -- Sender address (mandatory if SMTP output is *enabled*)
from: ""
# -- comma-separated list of Recipident addresses, can't be empty (mandatory if SMTP output is *enabled*)
to: ""
# -- html, text
outputformat: "html"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
opsgenie:
# -- Opsgenie API Key, if not empty, Opsgenie output is *enabled*
apikey: ""
# -- (`us` or `eu`) region of your domain
region: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
statsd:
# -- The address for the StatsD forwarder, in the form <http://host:port>, if not empty StatsD is *enabled*
forwarder: ""
# -- A prefix for all metrics
namespace: "falcosidekick."
dogstatsd:
# -- The address for the DogStatsD forwarder, in the form <http://host:port>, if not empty DogStatsD is *enabled*
forwarder: ""
# -- A prefix for all metrics
namespace: "falcosidekick."
# -- A comma-separated list of tags to add to all metrics
tags: ""
webhook:
# -- Webhook address, if not empty, Webhook output is *enabled*
address: ""
# -- HTTP method: POST or PUT
method: "POST"
# -- a list of comma separated custom headers to add, syntax is "key:value\,key:value"
customHeaders: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
azure:
# -- Azure Subscription ID
subscriptionID: ""
# -- Azure Resource Group name
resourceGroupName: ""
# -- Azure Identity Client ID
podIdentityClientID: ""
# -- Azure Identity name
podIdentityName: ""
# -- Azure Workload Identity Client ID
workloadIdentityClientID: ""
eventHub:
# -- Name of the space the Hub is in
namespace: ""
# -- Name of the Hub, if not empty, EventHub is *enabled*
name: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
discord:
# -- Discord WebhookURL (ex: <https://discord.com/api/webhooks/xxxxxxxxxx>...), if not empty, Discord output is *enabled*
webhookurl: ""
# -- Discord icon (avatar)
icon: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
gcp:
# -- Base64 encoded JSON key file for the GCP service account
credentials: ""
pubsub:
# -- The GCP Project ID containing the Pub/Sub Topic
projectid: ""
# -- Name of the Pub/Sub topic
topic: ""
# -- a list of comma separated custom headers to add, syntax is "key:value,key:value"
customattributes: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
storage:
# -- Name of prefix, keys will have format: gs://<bucket>/<prefix>/YYYY-MM-DD/YYYY-MM-DDTHH:mm:ss.s+01:00.json
prefix: ""
# -- The name of the bucket
bucket: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: "debug"
cloudfunctions:
# -- The name of the Cloud Function which is in form `projects/<project_id>/locations/<region>/functions/<function_name>`
name: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
cloudrun:
# -- the URL of the Cloud Run function
endpoint: "" # the URL of the Cloud Run function
# -- JWT for the private access to Cloud Run function
jwt: "" # JWT for the private access to Cloud Run function
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
googlechat:
# -- Google Chat Webhook URL (ex: <https://chat.googleapis.com/v1/spaces/XXXXXX/YYYYYY>), if not `empty`, Google Chat output is *enabled*
webhookurl: ""
# -- `all` (default), `text` (only text is displayed in Google chat)
outputformat: "all"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- a Go template to format Google Chat Text above Attachment, displayed in addition to the output from `config.googlechat.outputformat`. If empty, no Text is displayed before Attachment
messageformat: ""
kafka:
# -- comma separated list of Apache Kafka bootstrap nodes for establishing the initial connection to the cluster (ex: localhost:9092,localhost:9093). Defaults to port 9092 if no port is specified after the domain, if not empty, Kafka output is *enabled*
hostport: ""
# -- Name of the topic, if not empty, Kafka output is enabled
topic: ""
# -- SASL authentication mechanism, if empty, no authentication (PLAIN|SCRAM_SHA256|SCRAM_SHA512)
sasl: ""
# -- Use TLS for the connections
tls: false
# -- use this username to authenticate to Kafka via SASL
username: ""
# -- use this password to authenticate to Kafka via SASL
password: ""
# -- produce messages without blocking
async: false
# -- number of acknowledges from partition replicas required before receiving
requiredacks: NONE
# -- enable message compression using this algorithm, no compression (GZIP|SNAPPY|LZ4|ZSTD|NONE)
compression: "NONE"
# -- partition balancing strategy when producing
balancer: "round_robin"
# -- auto create the topic if it doesn't exist
topiccreation: false
# -- specify a client.id when communicating with the broker for tracing
clientid: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
pagerduty:
# -- Pagerduty Routing Key, if not empty, Pagerduty output is *enabled*
routingkey: ""
# -- Pagerduty Region, can be 'us' or 'eu'
region: "us"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
kubeless:
# -- Name of Kubeless function, if not empty, EventHub is *enabled*
function: ""
# -- Namespace of Kubeless function (mandatory)
namespace: ""
# -- Port of service of Kubeless function. Default is `8080`
port: 8080
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
openfaas:
# -- Name of OpenFaaS function, if not empty, OpenFaaS is *enabled*
functionname: ""
# -- Namespace of OpenFaaS function, "openfaas-fn" (default)
functionnamespace: "openfaas-fn"
# -- Service of OpenFaaS Gateway, "gateway" (default)
gatewayservice: "gateway"
# -- Port of service of OpenFaaS Gateway Default is `8080`
gatewayport: 8080
# -- Namespace of OpenFaaS Gateway, "openfaas" (default)
gatewaynamespace: "openfaas"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
cloudevents:
# -- CloudEvents consumer http address, if not empty, CloudEvents output is *enabled*
address: ""
# -- Extensions to add in the outbound Event, useful for routing
extension: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
rabbitmq:
# -- Rabbitmq URL, if not empty, Rabbitmq output is *enabled*
url: ""
# -- Rabbitmq Queue name
queue: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: "debug"
wavefront:
# -- Wavefront endpoint type, must be 'direct' or 'proxy'. If not empty, with endpointhost, Wavefront output is *enabled*
endpointtype: ""
# -- Wavefront endpoint address (only the host). If not empty, with endpointhost, Wavefront output is *enabled*
endpointhost: ""
# -- Wavefront token. Must be used only when endpointtype is 'direct'
endpointtoken: ""
# -- Port to send metrics. Only used when endpointtype is 'proxy'
endpointmetricport: 2878
# -- Metric to be created in Wavefront. Defaults to falco.alert
metricname: "falco.alert"
# -- Wavefront batch size. If empty uses the default 10000. Only used when endpointtype is 'direct'
batchsize: 10000
# -- Wavefront flush interval in seconds. Defaults to 1
flushintervalseconds: 1
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: "debug"
grafana:
# -- <http://{domain> or ip}:{port}, if not empty, Grafana output is *enabled*
hostport: ""
# -- API Key to authenticate to Grafana, if not empty, Grafana output is *enabled*
apikey: ""
# -- annotations are scoped to a specific dashboard. Optionnal.
dashboardid: ""
# -- annotations are scoped to a specific panel. Optionnal.
panelid: ""
# -- if true, all custom fields are added as tags (default: false)
allfieldsastags: false
# -- a list of comma separated custom headers to add, syntax is "key:value,key:value"
customheaders: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
grafanaoncall:
# -- if not empty, Grafana OnCall output is enabled
webhookurl: ""
# -- a list of comma separated custom headers to add, syntax is "key:value,key:value"
customheaders: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
fission:
# -- Name of Fission function, if not empty, Fission is enabled
function: ""
# -- Namespace of Fission Router, "fission" (default)
routernamespace: "fission"
# -- Service of Fission Router, "router" (default)
routerservice: "router"
# -- Port of service of Fission Router
routerport: 80 # Port of service of Fission Router
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- check if ssl certificate of the output is valid
checkcert: true
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
yandex:
# -- yandex access key
accesskeyid: ""
# -- yandex secret access key
secretaccesskey: ""
# -- yandex storage region (default: ru-central-1)
region: ""
s3:
# -- yandex storage endpoint (default: https://storage.yandexcloud.net)
endpoint: ""
# -- Yandex storage, bucket name
bucket: ""
# -- name of prefix, keys will have format: s3://<bucket>/<prefix>/YYYY-MM-DD/YYYY-MM-DDTHH:mm:ss.s+01:00.json
prefix: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
datastreams:
# -- yandex data streams endpoint (default: https://yds.serverless.yandexcloud.net)
endpoint: ""
# -- stream name in format /${region}/${folder_id}/${ydb_id}/${stream_name}
streamname: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
kafkarest:
# -- The full URL to the topic (example "http://kafkarest:8082/topics/test")
address: ""
# -- Kafka Rest Proxy API version 2|1 (default: 2)
version: 2
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- if true, checkcert flag will be ignored (server cert will always be checked)
mutualtls: false
# -- check if ssl certificate of the output is valid
checkcert: true
syslog:
# -- Syslog Host, if not empty, Syslog output is *enabled*
host: ""
# -- Syslog endpoint port number
port: ""
# -- Syslog transport protocol. It can be either "tcp" or "udp"
protocol: "tcp"
# -- Syslog payload format. It can be either "json" or "cef"
format: "json"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
cliq:
# -- Zoho Cliq Channel URL (ex: <https://cliq.zoho.eu/api/v2/channelsbyname/XXXX/message?zapikey=YYYY>), if not empty, Cliq Chat output is *enabled*
webhookurl: ""
# -- Cliq icon (avatar)
icon: ""
# -- Prefix message text with an emoji
useemoji: true
# -- `all` (default), `text` (only text is displayed in Cliq), `fields` (only fields are displayed in Cliq)
outputformat: "all"
# -- a Go template to format Google Chat Text above Attachment, displayed in addition to the output from `cliq.outputformat`. If empty, no Text is displayed before sections.
messageformat: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
policyreport:
# -- if true; policyreport output is *enabled*
enabled: false
# -- Kubeconfig file to use (only if falcosidekick is running outside the cluster)
kubeconfig: "~/.kube/config"
# -- the max number of events that can be in a policyreport
maxevents: 1000
# -- if true; the events with lowest severity are pruned first, in FIFO order
prunebypriority: false
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
nodered:
# -- Node-RED address, if not empty, Node-RED output is enabled
address: ""
# -- User if Basic Auth is enabled for 'http in' node in Node-RED
user: ""
# -- Password if Basic Auth is enabled for 'http in' node in Node-RED
password: ""
# -- Custom headers to add in POST, useful for Authentication, syntax is "key:value\,key:value"
customheaders: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- check if ssl certificate of the output is valid
checkcert: true
mqtt:
# -- Broker address, can start with tcp:// or ssl://, if not empty, MQTT output is enabled
broker: ""
# -- Topic for messages
topic: "falco/events"
# -- QOS for messages
qos: 0
# -- If true, messages are retained
retained: false
# -- User if the authentication is enabled in the broker
user: ""
# -- Password if the authentication is enabled in the broker
password: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- check if ssl certificate of the output is valid
checkcert: true
zincsearch:
# -- http://{domain or ip}:{port}, if not empty, ZincSearch output is enabled
hostport: ""
# -- index
index: "falco"
# -- use this username to authenticate to ZincSearch
username: ""
# -- use this password to authenticate to ZincSearch
password: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- check if ssl certificate of the output is valid
checkcert: true
gotify:
# -- http://{domain or ip}:{port}, if not empty, Gotify output is enabled
hostport: ""
# -- API Token
token: ""
# -- Format of the messages (plaintext, markdown, json)
format: "markdown"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- check if ssl certificate of the output is valid
checkcert: true
tekton:
# -- EventListener address, if not empty, Tekton output is enabled
eventlistener: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
# -- check if ssl certificate of the output is valid
checkcert: true
spyderbat:
# -- Organization to send output to, if not empty, Spyderbat output is enabled
orguid: ""
# -- Spyderbat API key with access to the organization
apikey: ""
# -- Spyderbat API url
apiurl: "https://api.spyderbat.com"
# -- Spyderbat source ID, max 32 characters
source: "falcosidekick"
# -- Spyderbat source description and display name if not empty, max 256 characters
sourcedescription: ""
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
timescaledb:
# -- TimescaleDB host, if not empty, TImescaleDB output is enabled
host: ""
# -- TimescaleDB port (default: 5432)
port: 5432
# -- Username to authenticate with TimescaleDB
user: "postgres"
# -- Password to authenticate with TimescaleDB
password: "postgres"
# -- TimescaleDB database used
database: ""
# -- Hypertable to store data events (default: falco_events) See TimescaleDB setup for more info
hypertablename: "falco_events"
# -- minimum priority of event to use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`
minimumpriority: ""
redis:
# -- Redis address, if not empty, Redis output is enabled
address: ""
# -- Password to authenticate with Redis
password: ""
# -- Redis database number
database: 0
# -- Redis storage type: hashmap or list
storagetype: "list"
# -- Redis storage key name for hashmap, list
key: "falco"
# -- minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or ""
minimumpriority: ""
telegram:
# -- telegram bot authentication token
token: ""
# -- telegram Identifier of the shared chat
chatid: ""
# -- Telegram individual chats within the group
messagethreadid: ""
# -- check if ssl certificate of the output is valid
checkcert: true
# -- minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or ""
minimumpriority: ""
n8n:
# -- N8N address, if not empty, N8N output is enabled
address: ""
# -- Username to authenticate with N8N in basic auth
user: ""
# -- Password to authenticate with N8N in basic auth
password: ""
# -- Header Auth Key to authenticate with N8N
headerauthname: ""
# -- Header Auth Value to authenticate with N8N
headerauthvalue: ""
# -- check if ssl certificate of the output is valid