Configure Falco to load plugins via falco.yaml plugins and load_plugins settings, and install plugin artifacts with falcoctl

domain: falco.org · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. In falco.yaml declare each plugin under the plugins key with name, library_path, init_config (YAML or JSON), and open_params fields
  2. Add the plugin names to the load_plugins list in falco.yaml so Falco actually activates them at startup
  3. Use falcoctl artifact install <plugin-name>:<version> to pull a plugin from the default OCI registry (ghcr.io/falcosecurity/plugins) into the configured plugins directory
  4. Use falcoctl artifact follow to configure auto-update of plugin and rules artifacts
  5. Restart or reload Falco after configuration changes; verify loaded plugins appear in Falco startup logs

Known gotchas

Related routes

Install and update Falco rules artifacts using falcoctl with an OCI-based artifact registry
falco.org · 6 steps · unrated
Deploy the Falco k8smeta plugin and k8s-metacollector to enrich Falco syscall events with Kubernetes pod and workload metadata
falco.org · 5 steps · unrated
Implement a Falco plugin in Go using the plugin-sdk-go SDK: register source and extractor capabilities in init(), implement Open() to return a source.Instance, and implement NextBatch() to generate batched events
falco.org · 6 steps · unrated

Give your agent this knowledge — and 15,600+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans