Added#

• Attack graph. Entity-centric investigation view built on Cytoscape with a dagre rank layout. Nodes for host, pod, container, process, identity, file and external address; edges for spawned, connected-to, mounted, authenticated-as, runs-on and triggered. Selecting a node highlights its neighbourhood and dims everything else.
• Coverage matrix activity mode. The ATT&CK matrix now heats by observed findings as well as by mapped rules. Reading the two modes together surfaces the case that matters most: high activity with no direct coverage.
• Probe state feeds coverage. A technique whose rules depend on a probe that has failed to attach is no longer reported as covered on the affected hosts.
• falakctl preflight. A static, dependency-free binary that reports kernel capability without loading anything. Safe to run on production during evaluation.

Changed#

• Sensor overhead on build fleets. file_open gained an include_only parameter that inverts the filter semantics. On a CI runner with the low-overhead policy this cuts file event volume by roughly 80% and brings the sensor back under 1% of a core.
• Correlation keys default to device.uid. Previously correlations were global within the tenant unless a by clause was supplied, which produced surprising cross-host matches. Existing rules with an explicit by clause are unaffected.
• Alert table virtualization. The findings feed now renders only the visible window regardless of result size. Tested to 250,000 rows with column visibility, faceted filters and URL-synced state intact.

Fixed#

• Container identity could be briefly stale for a container's own init process when the cgroup cache had not yet been refreshed from the CRI. The event now carries the cgroup path so core can backfill.
• DNS answers were capped at 4 regardless of max_answers. The parameter is now honoured up to 16.
• The policy editor did not mark sampling changes as dirty, so a modified sampling rate could be lost on navigation.

Security#

• Response actions now carry a mandatory expiry. The sensor refuses an action whose expires_at has passed, closing a replay window on a captured action payload. Sensors below 1.7.0 ignore the field; upgrade before relying on it.

Added#

• Cloud control-plane ingestion. AWS CloudTrail, GCP audit logs and Azure activity logs are ingested as OCSF 6003 API Activity into the same store as kernel telemetry. Runtime and control-plane events are now correlatable in a single hunt query.
• Signed SensorConfig. Policy is signed by core with an ed25519 key and verified by the sensor before it is applied. An unsigned or badly-signed config is refused, and the sensor continues on its previous generation rather than falling back to a default.
• Convergence reporting. Sensors report applied_config_generation on every heartbeat. The console shows per-policy convergence, so "we published" and "the fleet is running it" are visibly distinct.
• IMDS detection. Connections to 169.254.169.254 from inside a container are reported with the pod, service account and image that made them.

Changed#

• Enrollment now issues a client certificate. The one-time token is exchanged for an mTLS client certificate with an expiry, rather than a long-lived bearer token. Existing sensors migrate on next restart.
• path_class moved in-kernel. Sensitive-path classification was previously computed in the Rust userspace. Moving it into the probe cut file event processing cost by around 40%.

Deprecated#

• Bearer-token-only sensor authentication. Supported until 2.0, warned on at startup.

Security#

• Advisory FALAK-2025-0003. The console's finding export endpoint applied the tenant predicate after pagination rather than before, so a crafted cursor could return a count — but not the contents — of findings outside the caller's tenant. No content disclosure was possible and we have no evidence of exploitation. Fixed in 1.6.0; managed customers were patched before disclosure.

Added#

• Container Lifecycle as an extension class. class_uid 990001, extension namespace falak, uid 990. Carries the container object, K8s context, init process, the full mount set with is_host_path and is_sensitive, port mappings and the complete SecurityContext. This is what makes correlated container-escape detection possible.
• Case management. Group related findings into a case with an owner, a priority, tags and a shared note thread. Cases roll up maximum severity and the distinct technique set across their members.
• Fast-path local rules. Compiled expressions evaluated in the sensor's userspace so a kill decision does not wait for a core round trip. Every local rule requires an ATT&CK technique, same as any other detection.

Changed#

• OCSF v1.3 throughout. The internal event schema is gone. Field names now mirror OCSF JSON attribute names 1:1, so protojson output is a valid OCSF document with no translation layer. This is a breaking wire change: sensors below 1.5.0 cannot report to core 1.5.0 and vice versa. Upgrade core first, then roll sensors.
• Actor and target disambiguation. OCSF distinguishes the actor from the target rigorously. Four rules that had been matching on the parent process where they meant the child have been corrected.
• Class subset documented. Falak implements eleven OCSF classes plus one extension. The list, and the reasoning for each omission, is now in the repository rather than in someone's head.

Removed#

• The v0 event API. It served the pre-OCSF schema and has no forward path.
• Three detection rules that mapped to ATT&CK techniques a Linux sensor cannot observe. They were producing coverage without producing detection.

Falak-Neo#

SIEM 
 
 
Security Information & events Manager

what does it do ?

It collects, analyzes, and reports on security events and incidents within an organization's IT infrastructure. It provides real-time monitoring, threat detection, and incident response capabilities to help organizations identify and mitigate security threats effectively.

SOAR 

Security Orchestration, Automation, and Response Tool

What does it do ?

IT does the same as the SIEM but it also has automated playbooks that automatically remidate threats within the organization. It also has a case management system that allows security teams to track and manage incidents from detection to resolution.

XDR 

What is XDR ?

extended detection and response (XDR) is a cybersecurity approach that integrates multiple security products into a unified system.