falcodump - Man Page

Common options
falcodump [ --help ] [ --version ] [ --plugin-api-version ] [ --extcap-interfaces ] [ --extcap-dlts ] [ --extcap-interface=<interface> ] [ --extcap-config ] [ --extcap-capture-filter=<capture filter> ] [ --capture ] [ --fifo=<path to file or pipe> ] [ --plugin-source=<source path or URL> ] [ --log-level=<log level> ] [ --log-file=<path to file> ]

System call options
[ --include-capture-processes=<TRUE or FALSE> ] [ --include-switch-calls=<TRUE or FALSE> ]

CloudTrail plugin options
[ --cloudtrail-s3downloadconcurrency=<number of concurrent downloads> ] [ --cloudtrail-s3interval=<timeframe> ] [ --cloudtrail-s3accountlist=<comma separated account IDs> ] [ --cloudtrail-sqsdelete=<true or false> ] [ --cloudtrail-useasync=<true or false> ] [ --cloudtrail-uses3sns=<true or false> ] [ --cloudtrail-aws-region=<AWS region> ] [ --cloudtrail-aws-profile=<AWS profile> ] [ --cloudtrail-aws-config=<path> ] [ --cloudtrail-aws-credentials=<path to file> ]

falcodump is an extcap tool that allows one to capture log messages from cloud providers.

Each plugin is listed as a separate interface. For example, the AWS CloudTrail plugin is listed as “cloudtrail”.

--help

Print program arguments. This will also list the configuration arguments for each plugin.

--version

Print the program version.

--plugin-api-version

Print the Falco plugin API version.

--extcap-interfaces

List the available interfaces.

--extcap-interface=<interface>

Use the specified interface.

--extcap-dlts

List the DLTs of the specified interface.

--extcap-config

List the configuration options of specified interface.

--extcap-capture-filter=<capture filter>

The capture filter. Must be a valid Sysdig / Falco filter.

--capture

Start capturing from the source specified by --plugin-source via the specified interface and write raw packet data to the location specified by --fifo.

--fifo=<path to file or pipe>

Save captured packet to file or send it through pipe.

--plugin-source=<source path or URL>

Capture from the specified location.

--log-level

Set the log level

--log-file

Set a log file to log messages in addition to the console

--include-capture-processes

Include system calls for capture processes (falcodump, dumpcap, and Logray) if TRUE. Defaults to FALSE.

--include-switch-calls

Include "switch" calls if TRUE. Defaults to FALSE.

To see program arguments:

falcodump --help

To see program version:

falcodump --version

To see interfaces:

falcodump --extcap-interfaces

Only one interface (falcodump) is supported.

Example output

interface {value=cloudtrail}{display=Falco plugin}

To see interface DLTs:

falcodump --extcap-interface=cloudtrail --extcap-dlts

Example output

dlt {number=147}{name=cloudtrail}{display=USER0}

To see interface configuration options:

falcodump --extcap-interface=cloudtrail --extcap-config

Example output

arg {number=0}{call=--plugin-source}{display=Plugin source}{type=string}{tooltip=The plugin data source. This us usually a URL.}{placeholder=Enter a source URL…}{required=true}{group=Capture}
arg {number=1}{call=cloudtrail-s3downloadconcurrency}{display=s3DownloadConcurrency}{type=integer}{default=1}{tooltip=Controls the number of background goroutines used to download S3 files (Default: 1)}{group=Capture}
arg {number=2}{call=cloudtrail-sqsdelete}{display=sqsDelete}{type=boolean}{default=true}{tooltip=If true then the plugin will delete sqs messages from the queue immediately after receiving them (Default: true)}{group=Capture}
arg {number=3}{call=cloudtrail-useasync}{display=useAsync}{type=boolean}{default=true}{tooltip=If true then async extraction optimization is enabled (Default: true)}{group=Capture}

To capture AWS CloudTrail events from an S3 bucket:

falcodump --extcap-interface=cloudtrail --fifo=/tmp/cloudtrail.pcap --plugin-source=s3://aws-cloudtrail-logs.../CloudTrail/us-east-2/... --capture

or:

falcodump --capture --extcap-interface cloudtrail --fifo ~/cloudtrail.pcap --plugin-source s3://my-cloudtrail-bucket/AWSLogs/o-abc12345/123456789012/ --cloudtrail-s3downloadconcurrency 32 --cloudtrail-s3interval 5d-2d --cloudtrail-aws-region eu-west-1

wireshark(1), tshark(1), dumpcap(1), extcap(4)

falcodump is part of the Logray distribution. The latest version of Logray can be found at https://www.wireshark.org.

HTML versions of the Wireshark project man pages are available at https://www.wireshark.org/docs/man-pages.

Original Author
Gerald Combs <gerald[AT]wireshark.org>