registry.yaml

#
# Copyright (C) 2022 The Falco Authors.
#
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# The list of the data sources not allowed in plugins, since they are already
# used in Falco.
reserved_sources: ["syscall", "internal", "plugins"]

# The list of plugins officially recognized by the Falcosecurity organization.
# Registering your plugin here is required to reserve a given name, source, or id.
#
# License IDs refer to the SPDX License List at https://spdx.org/licenses
plugins:
  - name: k8saudit
    description: Read Kubernetes Audit Events and monitor Kubernetes Clusters
    authors: The Falco Authors
    contact: https://falco.org/community
    maintainers:
      - name: The Falco Authors
        email: cncf-falco-dev@lists.cncf.io
    keywords:
      - audit
      - audit-log
      - audit-events
      - kubernetes
    url: https://github.com/falcosecurity/plugins/tree/master/plugins/k8saudit
    rules_url: https://github.com/falcosecurity/plugins/tree/master/plugins/k8saudit/rules
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 1
        source: k8s_audit
      extraction:
        supported: true
  - name: cloudtrail
    description: Reads Cloudtrail JSON logs from files/S3 and injects as events
    authors: The Falco Authors
    contact: https://falco.org/community
    maintainers:
      - name: The Falco Authors
        email: cncf-falco-dev@lists.cncf.io
    keywords:
      - audit
      - user-activity
      - api-usage
      - aws
    url: https://github.com/falcosecurity/plugins/tree/master/plugins/cloudtrail
    rules_url: https://github.com/falcosecurity/plugins/tree/master/plugins/cloudtrail/rules
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 2
        source: aws_cloudtrail
      extraction:
        supported: true
  - name: json
    description: Extract values from any JSON payload
    authors: The Falco Authors
    contact: https://falco.org/community
    maintainers:
      - name: The Falco Authors
        email: cncf-falco-dev@lists.cncf.io
    keywords:
      - json-events
      - json-payload
      - extractor
    url: https://github.com/falcosecurity/plugins/tree/master/plugins/json
    license: Apache-2.0
    capabilities:
      extraction:
        supported: true
  - name: dummy
    description: Reference plugin used to document interface
    authors: The Falco Authors
    contact: https://falco.org/community
    maintainers:
      - name: The Falco Authors
        email: cncf-falco-dev@lists.cncf.io
    url: https://github.com/falcosecurity/plugins/tree/master/plugins/dummy
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 3
        source: dummy
      extraction:
        supported: true
  - name: dummy_c
    description: Like dummy, but written in C++
    authors: The Falco Authors
    contact: https://falco.org/community
    maintainers:
      - name: The Falco Authors
        email: cncf-falco-dev@lists.cncf.io
    url: https://github.com/falcosecurity/plugins/tree/master/plugins/dummy_c
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 4
        source: dummy_c
      extraction:
        supported: true
  - name: docker
    description: Docker Events
    authors: Thomas Labarussias
    contact: https://github.com/Issif
    maintainers:
      - name: Thomas Labarussias
        email: issif_github@gadz.org
    keywords:
      - docker-events
    url: https://github.com/Issif/docker-plugin
    rules_url: https://github.com/Issif/docker-plugin/tree/main/rules
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 5
        source: docker
      extraction:
        supported: true
  - name: seccompagent
    description: Seccomp Agent Events
    authors: Alban Crequy
    contact: https://github.com/kinvolk/seccompagent
    url: https://github.com/kinvolk/seccompagent
    keywords:
      - seccomp
      - kinvolk
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 6
        source: seccompagent
      extraction:
        supported: true
  - name: okta
    description: Okta Log Events
    authors: The Falco Authors
    contact: https://falco.org/community
    maintainers:
      - name: The Falco Authors
        email: cncf-falco-dev@lists.cncf.io
    keywords:
      - audit
      - log-events
      - okta
    url: https://github.com/falcosecurity/plugins/tree/master/plugins/okta
    rules_url: https://github.com/falcosecurity/plugins/tree/master/plugins/okta/rules
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 7
        source: okta
      extraction:
        supported: true
  - name: github
    description: Github Webhook Events
    authors: The Falco Authors
    contact: https://falco.org/community
    maintainers:
      - name: The Falco Authors
        email: cncf-falco-dev@lists.cncf.io
    keywords:
      - audit
      - log-events
      - webhook
      - github-activity
      - github
    url: https://github.com/falcosecurity/plugins/tree/master/plugins/github
    rules_url: https://github.com/falcosecurity/plugins/tree/master/plugins/github/rules
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 8
        source: github
      extraction:
        supported: true
  - name: k8saudit-eks
    description: Read Kubernetes Audit Events from AWS EKS Clusters
    authors: The Falco Authors
    contact: https://falco.org/community
    url: https://github.com/falcosecurity/plugins/tree/master/plugins/k8saudit-eks
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 9
        source: k8s_audit
      extraction:
        supported: true
  - name: nomad
    description: Read Hashicorp Nomad Events Stream
    authors: Alberto Llamas
    contact: https://github.com/albertollamaso/nomad-plugin/issues
    maintainers:
      - name: Alberto Llamas
    keywords:
      - audit
      - audit-events
      - nomad
    url: https://github.com/albertollamaso/nomad-plugin/tree/main
    rules_url: https://github.com/albertollamaso/nomad-plugin/tree/main/rules
    license: Apache-2.0
    capabilities:
      sourcing:
        supported: true
        id: 10
        source: nomad
      extraction:
        supported: true
  - name: test
    description: This ID is reserved for source plugin development. Any plugin author can use this ID, but authors can expect events from other developers with this ID. After development is complete, the author should request an actual ID
    reserved: true
    capabilities:
      sourcing:
        supported: true
        id: 999
        source: test