Understanding Falco’s Kubernetes Audit Log Plugins

Communities Falco
1

Since this is a recurring topic, I wanted to share a quick explanation about Falco’s Kubernetes audit log plugins. EKS is just one example, but the same principles apply to all K8s audit plugins.

  • Which plugin should I use?
    All audit plugins are equivalent. They just differ in how they collect logs depending on the cloud.
    :backhand_index_pointing_right: On EKS, use k8saudit-eks.

  • How do I check the latest version?

  • Do I need to pin versions in Helm?
    Yes, if you don’t want to always follow the latest. You can set refs in your falcoctl config.

  • Do syscall events get enriched with audit log data?
    No — syscall and k8saudit are separate data sources.
    :backhand_index_pointing_right: If you want syscall events enriched with Kubernetes metadata, check out the k8smeta plugin.