9 pages

Documentation

Everything from putting a sensor on one node to writing correlated detection content against OCSF fields. If you are here for the first time, start with the quickstart — it ends by triggering a real detection, which is a better introduction than any amount of prose.

New here

Deploy a sensor, confirm nine probes attached, and trigger a fileless-execution finding. About five minutes.

Quickstart

Evaluating

The architectural laws, the data contract, and what happens in each failure mode. Written for someone who has to defend the choice internally.

Architecture

Getting started

Quickstart

Deploy a Falak Neo sensor on a Linux host or a Kubernetes cluster and see your first OCSF events in about five minutes.

Kernel requirements

Which kernels Falak Neo supports, what BTF and BPF LSM change, and what degrades gracefully on older systems.

Architecture

How falak-neo-minion, falak-neo-core and the analyst console fit together, and the architectural laws that keep them honest.

Sensor

Sensor configuration

Probes, filters, sampling, batching and fast-path rules — how a SensorConfig is built, signed, distributed and verified.

Probe reference

What each eBPF probe attaches to, which OCSF class it feeds, its overhead, and the detections that depend on it.

Detection

Detection engineering

Writing, testing and shipping detection content against OCSF fields, with ATT&CK mapping enforced by the pipeline.

Operations

Self-hosting

Running falak-neo-core and the console on your own infrastructure, including sizing, storage and upgrade guidance.

Reference

OCSF schema

The exact OCSF v1.3 classes Falak Neo emits, the fields the sensor populates, and the one documented Falak extension.

API reference

The falak-neo-core REST and JSON API — authentication, tenancy, findings, events, agents, policies and the event stream.