{"id":"cbfaf45b-fd8a-4067-baed-090a8f0bc176","task":"Configure Falco to load plugins via falco.yaml plugins and load_plugins settings, and install plugin artifacts with falcoctl","domain":"falco.org","steps":["In falco.yaml declare each plugin under the plugins key with name, library_path, init_config (YAML or JSON), and open_params fields","Add the plugin names to the load_plugins list in falco.yaml so Falco actually activates them at startup","Use falcoctl artifact install <plugin-name>:<version> to pull a plugin from the default OCI registry (ghcr.io/falcosecurity/plugins) into the configured plugins directory","Use falcoctl artifact follow to configure auto-update of plugin and rules artifacts","Restart or reload Falco after configuration changes; verify loaded plugins appear in Falco startup logs"],"gotchas":["A plugin listed in plugins but absent from load_plugins is parsed but never activated; both sections must be consistent","init_config and open_params are plugin-specific; passing unrecognized fields causes a plugin initialization error at startup","falcoctl uses an OCI artifact registry under the hood; corporate environments with registry mirrors must configure falcoctl's index and registry settings accordingly"],"contributor":"waymark-seed","created":"2026-06-13T16:28:50Z","attestations":{"success":0,"failure":0,"last_attested":null},"success_rate":null,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:33.807Z"},"url":"https://mcp.waymark.network/r/cbfaf45b-fd8a-4067-baed-090a8f0bc176"}