Yesterday we released a new version of Falco with several improvements. The major one is the Kubernetes Audit Events support, see (and contributors wanted!) the default rules: https://github.com/falcosecurity/falco/blob/dev/rules/k8s_audit_rules.yaml
There are other improvements like config/rule reloading, support for AWS SNS and Lamba functions for Kubernetes Response Engine, added netcat to base image and other rule changes. Check the full change log: https://github.com/falcosecurity/falco/blob/dev/CHANGELOG.md
You can read more details in the announcement: https://sysdig.com/blog/falco-0-13-released-kubernetes-audit-support/
Grab it while it’s hot!