falcosecurity · ashutoshcloud · Sep 14, 2023 · Aug 18, 2023 · Sep 14, 2023 · Sep 14, 2023
diff --git a/content/en/blog/falcosidekick-ui-2-2-0/images/dialog-box-button.png b/content/en/blog/falcosidekick-ui-2-2-0/images/dialog-box-button.png
diff --git a/content/en/blog/falcosidekick-ui-2-2-0/images/dialog-box.png b/content/en/blog/falcosidekick-ui-2-2-0/images/dialog-box.png
diff --git a/content/en/blog/falcosidekick-ui-2-2-0/images/export.png b/content/en/blog/falcosidekick-ui-2-2-0/images/export.png
diff --git a/content/en/blog/falcosidekick-ui-2-2-0/images/featured.png b/content/en/blog/falcosidekick-ui-2-2-0/images/featured.png
diff --git a/content/en/blog/falcosidekick-ui-2-2-0/images/json.png b/content/en/blog/falcosidekick-ui-2-2-0/images/json.png
diff --git a/content/en/blog/falcosidekick-ui-2-2-0/index.md b/content/en/blog/falcosidekick-ui-2-2-0/index.md
@@ -0,0 +1,73 @@
+---
+title: Falcosidekick-UI 2.2.0
+linktitle: Falcosidekick-UI 2.2.0
+date: 2023-09-14
+author: Thomas Labarussias
+slug: falcosidekick-ui-2-2-0
+images:
+  - /blog/falcosidekick-ui-2-2-0/images/featured.png
+tags: ["Falcosidekick-UI","Release"]
+---
+
+Not so long ago, we proudly released a new fantastic release of [falcosidekick](/blog/falcosidekick-2-28-0/), it's time for its little brother, [falcosidekick-ui](https://github.com/falcosecurity/falcosidekick-ui) to know the same, with the version v2.2.0.
+
+Let's take a tour to introduce the most important cool new features of this release.
+
+## Disabling the authentication
+
+The previous version introduced a basic auth mechanism to protect access to the dashboard and API. Some complained it broke the access through their reverse proxy. You can now disable the authentication:
+
+```shell
+-d boolean
+      Disable authentication (environment "FALCOSIDEKICK_UI_DISABLEAUTH")
+```
+
+## Dialog box to display the details of an event
+
+To have a better view of each event, you can now open a dialog box that displays all details but also the raw JSON of the event. You can even copy it into your clipboard with a simple click.
+
+![dialog-box](/blog/falcosidekick-ui-2-2-0/images/dialog-box.png)
+
+To display the dialog box, just click on the `{...}` at the end of the event row.
+
+![dialog-box-button](/blog/falcosidekick-ui-2-2-0/images/dialog-box-button.png)
+
+## Export
+
+A new `Export` button appeared, it allows you to export all the events found in json format. It takes in consideration the filters, of course.
+
+![export](/blog/falcosidekick-ui-2-2-0/images/export.png)
+
+![json](/blog/falcosidekick-ui-2-2-0/images/json.png)
+
+## Units for TTL
+
+For users with a lot of events, it can be useful to specify a TTL (time to live) for the keys in Redis (the storage backend). It can be done with `-t` argument for a while, and the value had to be in seconds, which is not convenient for long-term storage. You can now specify a unit (`s`econds, `m`inutes, `h`ours, `W`eeks, `M`onths, `y`ear). If no unit is specified, it's considered as seconds to avoid breaking previous configs.
+
+```shell
+-t string
+      TTL for keys, the format is X<unit>,
+      with unit (s, m, h, d, W, M, y)" (default "0", environment "FALCOSIDEKICK_UI_TTL")
+```
+## Redis password
+
+The access to the dashboard and the API can be protected by credentials, but the Redis wasn't. You can now specify a password for access to Redis, it will prevent your security scans from complaining ;-).
+
+```shell
+-w string  
+      Redis password (default "", environment "FALCOSIDEKICK_REDIS_PASSWORD")
+```
+
+## Conclusion
+
+Thanks again to our amazing community, most of these features came from your ideas and we're still thrilled to see how much you find falcosidekick-ui useful.
+
+---
+As usual, if you have any feedback or need help, you can find us at any of the following locations.
+
+* Get started in [Falco.org](http://falco.org/)
+* Check out the [Falcosidekick project on GitHub](https://github.com/falcosecurity/falcosidekick).
+* Check out the [Falcosidekick UI project on GitHub](https://github.com/falcosecurity/falcosidekick-ui).
+* Get involved in the [Falco community](https://falco.org/community/).
+* Meet the maintainers on the [Falco Slack](https://kubernetes.slack.com/?redir=%2Farchives%2FCMWH3EH32).
+* Follow [@falco_org on Twitter](https://twitter.com/falco_org).
diff --git a/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-01.png b/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-01.png
diff --git a/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-02.png b/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-02.png
diff --git a/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-03.png b/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-03.png
diff --git a/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-04.png b/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-04.png
diff --git a/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-05.png b/content/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-05.png
diff --git a/...t/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-blog-featured.png b/...t/en/blog/tracing-system-calls-using-ebpf-part-2/images/ebpf2-blog-featured.png
diff --git a/content/en/blog/tracing-system-calls-using-ebpf-part-2/index.md b/content/en/blog/tracing-system-calls-using-ebpf-part-2/index.md
@@ -0,0 +1,92 @@
+---
+title: Tracing System Calls Using eBPF - Part 2
+linktitle: Tracing System Calls Using eBPF - Part 2
+description: Learn how to trace system calls using eBPF probes.
+date: 2023-09-12
-date: 2023-09-12
+date: 2023-09-21
-date: 2023-09-12
+date: 2023-09-21
+author: Anshu Bansal, Rakshit Awasthi, Ashutosh Venkatrao More
+slug: tracing-system-calls-using-ebpf-part-2
+images:
+  - /blog/tracing-syscalls-using-ebpf-part-2/images/ebpf2-blog-featured.png
+tags: ["eBPF", "Falco", "Syscalls", "Probes"] 
+---
+
+## Introduction
+
+In [Tracing System Calls Using eBPF Part 1](https://falco.org/blog/tracing-syscalls-using-ebpf-part-1/), we lay the groundwork, introducing you to the fundamentals of `eBPF` and its predecessor, `BPF (Berkeley Packet Filter)`. We delve into the evolution of this technology, its safety, performance, and observability advantages over traditional kernel modules, and its pivotal role in securing modern cloud-native environments. We guide you through the intricate process of working with eBPF programs, from compilation to execution, highlighting its power in tracing system calls.
+
+In the second installment, `Tracing System Calls Using eBPF Part 2`, we elevate our understanding of eBPF's capabilities. We unravel the world of `Uprobes` and `Uretprobes`, demonstrating how these features empower developers to instrument and monitor user-space applications seamlessly. We then venture into `Kprobes` and `Kretprobes`, unlocking the potential to dynamically trace and debug kernel functions, offering insights into system behavior and performance analysis.
+
+## Uprobes
+
+Uprobes, short for user probes, are a feature in the Linux kernel that enables developers to instrument and monitor user-space applications without modifying their code directly. They allow for the insertion of breakpoints at specific points of interest within an application, facilitating the collection of data, tracing of function calls, debugging, and performance analysis. 
+
+## Uretprobes
+
+Uretprobes, short for User Return Probes, are a feature in the Linux kernel that allows developers to trace and monitor the return paths of functions in user-space applications. While uprobes are used to instrument and intercept the entry points of functions, URETprobes specifically focus on the exit points or return paths. They enable developers to set up probes that are triggered when a specific function returns to its caller.
+
+Here is an eBPF program that uses user probes to trace the printf function present in `glibc (the standard GNU C Library)`.
+
+<br><a target="_blank" href="images/ebpf2-01.png">
+  <img style="border: 2px solid #00b4c8" 
+       alt="An eBPF program that uses user probes to trace the printf function present in `glibc (the standard GNU C Library)`"
+       src="images/ebpf2-01.png">
+  </img>
+</a><br><br>
+
+In accordance with the instructions outlined in our [Tracing System Calls Using eBPF Part 1](https://falco.org/blog/tracing-syscalls-using-ebpf-part-1/) blog, we can create a loader to effectively load this eBPF program and read the logs from the file `/sys/kernel/tracing/trace_pipe` .
+
+## Kprobes
+
+Kprobes, short for Kernel Probes, are a feature in the Linux kernel that allow dynamic tracing and debugging of kernel functions. They are particularly useful for tasks like performance analysis, bug diagnosis, and system monitoring. They provide a non-intrusive way to gather runtime information from the kernel without requiring modifications to the kernel code itself. Additionally, they can be used to trace specific function calls, track parameters and return values, and gather statistical data on function execution
+
+## Kretprobes
+
+Kretprobes, short for Kernel Return Probes, are a feature in the Linux kernel that complements Kprobes by allowing dynamic tracing and debugging of kernel function return points. While Kprobes focus on probing the entry points of kernel functions, kretprobes specifically target the return points of these functions.Similar to Kprobes, kretprobes work by inserting a probe handler function that gets executed when a specific kernel function is about to return. This allows developers and system administrators to gather information, modify return values, or perform additional actions at the point of function return.
+
+Here is an eBPF program that uses kernel probes to trace a kernel function named `prepare_kernel_cred`. This function is used to create a new `struct cred object` that represents the credentials or privileges associated with a kernel task. It is commonly used in `privilege escalation exploits` for gaining root access. By tracing this function, we can identify all processes that invoke it, providing valuable insight for analyzing potential malicious activity.
+
+<br><a target="_blank" href="images/ebpf2-02.png">
+  <img style="border: 2px solid #00b4c8" 
+       alt="An eBPF program that uses kernel probes to trace a kernel function"
+       src="images/ebpf2-02.png">
+  </img>
+</a><br><br>
+
+`SEC(“kprobe/prepare_kernel_cred”)` indicates that an eBPF program is associated with the kprobe event for the `"prepare_kernel_cred"` kernel function. This event allows dynamic tracing and debugging by intercepting the entry point of the function.
+
+`struct pt_regs` is a data structure that provides access to the register state of the program when it is executed. It contains information about the `CPU registers` at the time of the eBPF program invocation. It is defined as :
+
+<br><a target="_blank" href="images/ebpf2-03.png">
+  <img style="border: 2px solid #00b4c8" 
+       alt="Consolidated rule"
+       src="images/ebpf2-03.png">
+  </img>
+</a><br><br>
+
+To facilitate the loading of the aforementioned eBPF program, we’ll use the following program.
+
+<br><a target="_blank" href="images/ebpf2-04.png">
+  <img style="border: 2px solid #00b4c8" 
+       alt="Loader for the above program"
+       src="images/ebpf2-04.png">
+  </img>
+</a><br><br>
+
+Here is a Makefile for compiling the eBPF program and the loader
+
+<br><a target="_blank" href="images/ebpf2-05.png">
+  <img style="border: 2px solid #00b4c8" 
+       alt="A Makefile for compiling the eBPF program and the loader"
+       src="images/ebpf2-05.png">
+  </img>
+</a><br><br>
+
+## Conclusion
+
+In this two-part exploration of **Tracing System Calls Using eBPF**, we've embarked on a fascinating journey through the inner workings of this powerful technology. `Part 1` laid the foundation by introducing us to the fundamentals of eBPF and its predecessor, BPF, shedding light on their evolution and significance in modern cloud-native environments. We uncovered how eBPF's safety, performance, and observability advantages empower us to trace system calls with unmatched efficiency.
+
+In `Part 2`, we took our understanding to new heights. We delved into the world of `Uprobes` and `Uretprobes`, showcasing how they enable seamless instrumentation and monitoring of user-space applications. We then ventured into `Kprobes` and `Kretprobes`, unlocking the ability to dynamically trace and debug kernel functions. Armed with these advanced techniques, we gained valuable insights into system behavior, performance analysis, and even the detection of potential malicious activity.
+
+As we conclude this journey into the heart of eBPF, we stand equipped with a powerful set of tools and knowledge. Whether you're a seasoned sysadmin, a curious developer, or a vigilant security enthusiast, the capabilities of eBPF open new doors to real-time monitoring and analysis. 
+
+Stay tuned for further insights and practical guidance in the world of eBPF, where innovation meets security, and the future of system monitoring becomes a reality.
diff --git a/data/en/events.yaml b/data/en/events.yaml
@@ -1,68 +1,3 @@
-
-- title: "Falco on Tour: Virtual"
-  start: "2023-08-29T09:00:00-0700"
-  end: "2023-08-29T12:00:00-0700"
-  timezone: America/Los_Angeles
-  timezoneName: PDT
-  location: Virtual
-  type: workshop
-  description: "Up & Running with Runtime Security Workshop"
-  url: https://www.aicamp.ai/event/eventdetails/W2023082909?utm_source=sysdig0829
-  schedule:
-    - start: "2023-08-29T09:00:00-0700"
-      time:
-        - start: "2023-08-29T09:00:00-0700"
-          end: "2023-08-29T12:00:00-0700"
-          content: '<a href="https://www.aicamp.ai/event/eventdetails/W2023082909?utm_source=sysdig0829" target="_blank">Up & Running with Runtime Security Workshop</a><br>Virtual<br>'
-
-- title: "Falco on Tour: Melbourne"
-  start: "2023-08-31T09:00:00+1000"
-  end: "2023-08-31T13:00:00-1000"
-  timezone: Australia/Melbourne
-  timezoneName: AEST
-  location: Melbourne, Australia
-  type: workshop
-  description: "Up & Running with Runtime Security Workshop"
-  url: https://www.eventbrite.com/e/falco-on-tour-melbourne-tickets-681037059177?aff=oddtdtcreator
-  schedule:
-    - start: "2023-08-31T09:00:00+1000"
-      time:
-        - start: "2023-08-31T09:00:00+1000"
-          end: "2023-08-31T13:00:00-1000"
-          content: '<a href="https://www.eventbrite.com/e/falco-on-tour-melbourne-tickets-681037059177?aff=oddtdtcreator" target="_blank">Up & Running with Runtime Security Workshop</a><br>Melbourne, Australia<br>'
-
-- title: "Falco on Tour: Wellington (Cloud Native Summit)"
-  start: "2023-09-04T09:00:00+1200"
-  end: "2023-08-31T16:00:00+1200"
-  timezone: Australia/Melbourne
-  timezoneName: NZST
-  location: Wellington, New Zealand
-  type: workshop
-  description: "Up & Running with Runtime Security Workshop"
-  url: https://www.cloudnativesummit.co/index.html
-  schedule:
-    - start: "2023-09-04T09:00:00+1200"
-      time:
-        - start: "2023-09-04T09:00:00+1200"
-          end: "2023-08-31T16:00:00+1200"
-          content: '<a href="https://www.cloudnativesummit.co/index.html" target="_blank">Up & Running with Runtime Security Workshop</a><br>Wellington, New Zealand<br>'
-
-- title: "Falco on Tour: London (CIVO Navigate)"
-  start: "2023-09-06T13:00:00+0100"
-  end: "2023-09-06T14:00:00+0100"
-  timezone: Europe/London
-  timezoneName: BST
-  location: London, England
-  type: workshop
-  description: "Up & Running with Runtime Security Workshop"
-  url: https://www.civo.com/navigate/register
-  schedule:
-    - start: "2023-09-06T13:00:00+0100"
-      time:
-        - start: "2023-09-06T13:00:00+0100"
-          end: "2023-09-06T14:00:00+0100"
-          content: '<a href="https://www.civo.com/navigate/register" target="_blank">Up & Running with Runtime Security Workshop</a><br>London, England<br>'
-
 - title: "Réagir à temps aux menaces dans vos clusters Kubernetes avec Falco et son écosystème"
   start: "2023-09-19T19:00:00+0200"
   end: "2023-09-19T22:00:00+0200"
@@ -79,7 +14,7 @@
           end: "2023-09-19T22:00:00+0200"
           content: '<a href="https://www.meetup.com/fr-FR/cloud-native-computing-paris/events/295167585/" target="_blank">Réagir à temps aux menaces dans vos clusters Kubernetes avec Falco et son écosystème</a><br>Paris, France<br>'
 
-- title: "Falco on Tour: New York"
+- title: "Falco on Tour: New York with Wolfi!"
   start: "2023-09-19T17:00:00-0400"
   end: "2023-09-19T20:00:00-0400"
   timezone: America/New_York
@@ -112,20 +47,20 @@
           content: '<a href="https://www.eventbrite.com/e/632747634207" target="_blank">Up & Running with Runtime Security Workshop</a><br>Toronto, Canada<br>'
 
 - title: "Falco on Tour: Amsterdam"
-  start: "2023-09-26T14:30:00+0200"
-  end: "2023-09-26T17:00:00+0200"
+  start: "2023-09-27T17:00:00+0200"
+  end: "2023-09-27T19:00:00+0200"
   timezone: Europe/Amsterdam
   timezoneName: CEST
   location: Amsterdam, Netherlands
   type: workshop
   description: "Up & Running with Runtime Security Workshop"
-  url: https://www.eventbrite.com/e/falco-on-tour-amsterdam-tickets-691062244777?aff=oddtdtcreator
+  url: https://www.aicamp.ai/event/eventdetails/W2023092708
   schedule:
-    - start: "2023-09-26T14:30:00+0200"
+    - start: "2023-09-27T17:00:00+0200"
       time:
-        - start: "2023-09-26T14:30:00+0200"
-          end: "2023-09-26T17:00:00+0200"
-          content: '<a href="https://www.eventbrite.com/e/falco-on-tour-amsterdam-tickets-691062244777?aff=oddtdtcreator" target="_blank">Up & Running with Runtime Security Workshop</a><br>Amsterdam, Netherlands<br>'
+        - start: "2023-09-27T17:00:00+0200"
+          end: "2023-09-27T19:00:00+0200"
+          content: '<a href="https://www.aicamp.ai/event/eventdetails/W2023092708" target="_blank">Up & Running with Runtime Security Workshop</a><br>Amsterdam, Netherlands<br>'
 
 - title: "Falco on Tour: Seattle"
   start: "2023-09-26T17:00:00-0700"
@@ -143,23 +78,24 @@
           end: "2023-09-26T20:30:00-0700"
           content: '<a href="https://www.eventbrite.com/e/falco-on-tour-seattle-tickets-695521271847?aff=oddtdtcreator" target="_blank">Up & Running with Runtime Security Workshop</a><br>Seattle, WA<br>'
 
-- title: "Falco on Tour: Houston"
-  start: "2023-10-11T09:00:00-0500"
-  end: "2023-10-11T12:30:00-0500"
-  timezone: America/Chicago
-  timezoneName: CDT
-  location: Houston, TX
+
+- title: "Falco on Tour: Virtual"
+  start: "2023-09-28T09:00:00-0700"
+  end: "2023-09-28T11:00:00-0700"
+  timezone: America/Los_Angeles
+  timezoneName: PDT
+  location: Virtual
   type: workshop
   description: "Up & Running with Runtime Security Workshop"
-  url: https://www.eventbrite.com/e/627311855647
+  url: https://www.aicamp.ai/event/eventdetails/W2023092809
   schedule:
-    - start: "2023-10-11T09:00:00-0500"
+    - start: "2023-09-28T09:00:00-0700"
       time:
-        - start: "2023-10-11T09:00:00-0500"
-          end: "2023-10-11T12:30:00-0500"
-          content: '<a href="https://www.eventbrite.com/e/627311855647" target="_blank">Up & Running with Runtime Security Workshop</a><br>Houston, TX<br>'
+        - start: "2023-09-28T09:00:00-0700"
+          end: "2023-09-28T11:00:00-0700"
+          content: '<a href="https://www.aicamp.ai/event/eventdetails/W2023092809" target="_blank">Up & Running with Runtime Security Workshop</a><br>Virtual<br>'
 
-- title: "Falco on Tour: Virtual"
+- title: "Deep Dive into Falco: Empower DevSecOps with Real-time Container Security"
   start: "2023-10-17T12:00:00+0200"
   end: "2023-10-17T13:00:00+0200"
   timezone: Europe/Berlin