[{"data":1,"prerenderedAt":1793},["ShallowReactive",2],{"/blog/securing-the-container-host-with-falco":3,"navigation-en-us":1008,"banner-en-us":1435,"footer-en-us":1445,"blog-post-authors-en-us-Fernando Diaz":1690,"blog-related-posts-en-us-securing-the-container-host-with-falco":1705,"blog-promotions-en-us":1730,"next-steps-en-us":1783},{"id":4,"title":5,"authors":6,"body":8,"category":989,"date":990,"description":991,"extension":992,"externalUrl":993,"faq":993,"featured":994,"heroImage":995,"meta":996,"navigation":182,"path":997,"seo":998,"slug":1003,"stem":1004,"tags":1005,"template":1006,"updatedDate":993,"__hash__":1007},"blogPosts/en-us/blog/securing-the-container-host-with-falco.md","Detecting and alerting on anomalies in your container host with GitLab + Falco",[7],"Fernando Diaz",{"type":9,"value":10,"toc":981},"minimark",[11,15,18,21,31,36,39,42,55,58,62,71,94,97,127,266,275,312,320,327,380,386,395,465,471,482,488,499,506,510,513,524,532,538,546,550,553,584,587,591,594,597,621,628,648,651,920,923,931,953,957,960,963,977],[12,13,14],"p",{},"Container Host Security in GitLab provides intrusion detection and prevention\ncapabilities that can monitor and (optionally) block activity inside the containers\nthemselves.",[12,16,17],{},"In this blog post, we will go over the basic concepts of Container Host\nSecurity. We will then use GitLab-Managed Apps to deploy Falco into our\nKubernetes Cluster using the GitLab CI/CD pipeline.",[12,19,20],{},"After that, we will set up Falco rules, examining when those\nrules have been broken, and create alerts. Falco Logs and Alerts will\nprovide us an insight to potential malious behavior occuring in our\ninfrastructure.",[12,22,23,24,30],{},"I created the ",[25,26,29],"a",{"href":27,"rel":28},"https://gitlab.com/tech-marketing/devsecops/initech/infrastructure",[],"Initech Infrastrucute","\nproject to showcase all the different integrations with Kubernetes. Feel free to\nclone it for this guide.",[32,33,35],"h2",{"id":34},"what-is-container-host-security","What is Container Host Security?",[12,37,38],{},"Container Host Security refers to the ability to detect, report, and respond\nto attacks on containerized infrastructure and workloads. For Container Host\nSecurity, GitLab relies on Falco. Falco is a cloud native, easy-to-use security\ntool for detecting runtime threats within Kubernetes containers.",[12,40,41],{},"Falco uses system calls to monitor the system by:",[43,44,45,49,52],"ul",{},[46,47,48],"li",{},"parsing the Linux system calls from the kernel at runtime",[46,50,51],{},"asserting the stream against a powerful rules engine",[46,53,54],{},"alerting when a rule is violated",[12,56,57],{},"Falco has a whole set of built-in rules that check the kernel for unusual\nbehaviors. New rules can be added to further secure our infrastructure as\nneeded. Whenever these rules are asserted, Falco can send alerts in many\ndifferent ways and be integrated with different tools, such as email and\nSlack.",[32,59,61],{"id":60},"installing-falco-on-gitlab","Installing Falco on GitLab",[12,63,64,65,70],{},"Installing Falco as a GitLab-Managed application is quite simple. We first need to make sure that we integrate a Kubernetes cluster into our application.\nThis is done via the ",[25,66,69],{"href":67,"rel":68},"https://docs.gitlab.com/user/clusters/agent/",[],"Kubernetes Agent",".",[12,72,73,74,79,80,83,84,88,89,70],{},"Before continuing, make sure you ",[25,75,78],{"href":76,"rel":77},"https://docs.gitlab.com/user/project/working_with_projects/#create-a-project",[],"create a new project"," and integrate the ",[25,81,69],{"href":67,"rel":82},[]," into your project. This ",[25,85,87],{"href":86},"/blog/setting-up-the-k-agent/","blog"," provides information on installing the agent or you can check out the ",[25,90,93],{"href":91,"rel":92},"https://docs.gitlab.com/user/clusters/agent/install/",[],"official documentation",[12,95,96],{},"Once you've integrated a Kubernetes cluster to your project, you can install\nFalco with the following steps:",[98,99,100,108,117],"ol",{},[46,101,102,103,107],{},"Create ",[104,105,106],"strong",{},"applications"," folder in root",[46,109,102,110,113,114,116],{},[104,111,112],{},"falco"," directory in ",[104,115,106],{}," folder",[46,118,119,120,123,124,126],{},"Create a ",[104,121,122],{},"helmfile.yaml"," in the ",[104,125,112],{}," folder and add the following contents:",[128,129,134],"pre",{"className":130,"code":131,"language":132,"meta":133,"style":133},"language-yaml shiki shiki-themes github-light","repositories:\n- name: falcosecurity-charts\n  url: https://falcosecurity.github.io/charts/\n\nreleases:\n- name: falco\n  namespace: gitlab-managed-apps\n  chart: falcosecurity-charts/falco\n  version: 1.1.8\n  installed: true\n  values:\n    - values.yaml\n\n","yaml","",[135,136,137,150,166,177,184,192,204,215,226,238,249,257],"code",{"__ignoreMap":133},[138,139,142,146],"span",{"class":140,"line":141},"line",1,[138,143,145],{"class":144},"shJU0","repositories",[138,147,149],{"class":148},"sgsFI",":\n",[138,151,153,156,159,162],{"class":140,"line":152},2,[138,154,155],{"class":148},"- ",[138,157,158],{"class":144},"name",[138,160,161],{"class":148},": ",[138,163,165],{"class":164},"sYBdl","falcosecurity-charts\n",[138,167,169,172,174],{"class":140,"line":168},3,[138,170,171],{"class":144},"  url",[138,173,161],{"class":148},[138,175,176],{"class":164},"https://falcosecurity.github.io/charts/\n",[138,178,180],{"class":140,"line":179},4,[138,181,183],{"emptyLinePlaceholder":182},true,"\n",[138,185,187,190],{"class":140,"line":186},5,[138,188,189],{"class":144},"releases",[138,191,149],{"class":148},[138,193,195,197,199,201],{"class":140,"line":194},6,[138,196,155],{"class":148},[138,198,158],{"class":144},[138,200,161],{"class":148},[138,202,203],{"class":164},"falco\n",[138,205,207,210,212],{"class":140,"line":206},7,[138,208,209],{"class":144},"  namespace",[138,211,161],{"class":148},[138,213,214],{"class":164},"gitlab-managed-apps\n",[138,216,218,221,223],{"class":140,"line":217},8,[138,219,220],{"class":144},"  chart",[138,222,161],{"class":148},[138,224,225],{"class":164},"falcosecurity-charts/falco\n",[138,227,229,232,234],{"class":140,"line":228},9,[138,230,231],{"class":144},"  version",[138,233,161],{"class":148},[138,235,237],{"class":236},"sYu0t","1.1.8\n",[138,239,241,244,246],{"class":140,"line":240},10,[138,242,243],{"class":144},"  installed",[138,245,161],{"class":148},[138,247,248],{"class":236},"true\n",[138,250,252,255],{"class":140,"line":251},11,[138,253,254],{"class":144},"  values",[138,256,149],{"class":148},[138,258,260,263],{"class":140,"line":259},12,[138,261,262],{"class":148},"    - ",[138,264,265],{"class":164},"values.yaml\n",[98,267,268],{"start":179},[46,269,119,270,123,273,126],{},[104,271,272],{},"values.yaml",[104,274,112],{},[128,276,278],{"className":130,"code":277,"language":132,"meta":133,"style":133},"falco:\n  file_output:\n    enabled: true\n    keep_alive: false\n\n",[135,279,280,286,293,302],{"__ignoreMap":133},[138,281,282,284],{"class":140,"line":141},[138,283,112],{"class":144},[138,285,149],{"class":148},[138,287,288,291],{"class":140,"line":152},[138,289,290],{"class":144},"  file_output",[138,292,149],{"class":148},[138,294,295,298,300],{"class":140,"line":168},[138,296,297],{"class":144},"    enabled",[138,299,161],{"class":148},[138,301,248],{"class":236},[138,303,304,307,309],{"class":140,"line":179},[138,305,306],{"class":144},"    keep_alive",[138,308,161],{"class":148},[138,310,311],{"class":236},"false\n",[12,313,314,315,70],{},"Here is some ",[25,316,319],{"href":317,"rel":318},"https://gitlab.com/tech-marketing/devsecops/initech/infrastructure/-/blob/main/applications/falco/values.yaml",[],"sample code",[98,321,322],{"start":186},[46,323,102,324,326],{},[104,325,122],{}," in the root directory, adding the following:",[128,328,330],{"className":130,"code":329,"language":132,"meta":133,"style":133},"helmDefaults:\n  atomic: true\n  wait: true\n\nhelmfiles:\n    - path: applications/falco/helmfile.yaml\n\n",[135,331,332,339,348,357,361,368],{"__ignoreMap":133},[138,333,334,337],{"class":140,"line":141},[138,335,336],{"class":144},"helmDefaults",[138,338,149],{"class":148},[138,340,341,344,346],{"class":140,"line":152},[138,342,343],{"class":144},"  atomic",[138,345,161],{"class":148},[138,347,248],{"class":236},[138,349,350,353,355],{"class":140,"line":168},[138,351,352],{"class":144},"  wait",[138,354,161],{"class":148},[138,356,248],{"class":236},[138,358,359],{"class":140,"line":179},[138,360,183],{"emptyLinePlaceholder":182},[138,362,363,366],{"class":140,"line":186},[138,364,365],{"class":144},"helmfiles",[138,367,149],{"class":148},[138,369,370,372,375,377],{"class":140,"line":194},[138,371,262],{"class":148},[138,373,374],{"class":144},"path",[138,376,161],{"class":148},[138,378,379],{"class":164},"applications/falco/helmfile.yaml\n",[12,381,314,382,70],{},[25,383,319],{"href":384,"rel":385},"https://gitlab.com/tech-marketing/devsecops/initech/infrastructure/-/blob/main/helmfile.yaml",[],[98,387,388],{"start":194},[46,389,390,391,394],{},"In ",[104,392,393],{},".gitlab-ci.yaml",", add the following:",[128,396,398],{"className":130,"code":397,"language":132,"meta":133,"style":133},"apply:\n  stage: deploy\n  image: \"registry.gitlab.com/gitlab-org/cluster-integration/cluster-applications:v1.1.0\"\n  environment:\n    name: staging\n  script:\n    - gl-ensure-namespace gitlab-managed-apps\n    - gl-helmfile --file $CI_PROJECT_DIR/helmfile.yaml apply --suppress-secrets\n\n",[135,399,400,407,417,427,434,444,451,458],{"__ignoreMap":133},[138,401,402,405],{"class":140,"line":141},[138,403,404],{"class":144},"apply",[138,406,149],{"class":148},[138,408,409,412,414],{"class":140,"line":152},[138,410,411],{"class":144},"  stage",[138,413,161],{"class":148},[138,415,416],{"class":164},"deploy\n",[138,418,419,422,424],{"class":140,"line":168},[138,420,421],{"class":144},"  image",[138,423,161],{"class":148},[138,425,426],{"class":164},"\"registry.gitlab.com/gitlab-org/cluster-integration/cluster-applications:v1.1.0\"\n",[138,428,429,432],{"class":140,"line":179},[138,430,431],{"class":144},"  environment",[138,433,149],{"class":148},[138,435,436,439,441],{"class":140,"line":186},[138,437,438],{"class":144},"    name",[138,440,161],{"class":148},[138,442,443],{"class":164},"staging\n",[138,445,446,449],{"class":140,"line":194},[138,447,448],{"class":144},"  script",[138,450,149],{"class":148},[138,452,453,455],{"class":140,"line":206},[138,454,262],{"class":148},[138,456,457],{"class":164},"gl-ensure-namespace gitlab-managed-apps\n",[138,459,460,462],{"class":140,"line":217},[138,461,262],{"class":148},[138,463,464],{"class":164},"gl-helmfile --file $CI_PROJECT_DIR/helmfile.yaml apply --suppress-secrets\n",[12,466,314,467,70],{},[25,468,319],{"href":469,"rel":470},"https://gitlab.com/tech-marketing/devsecops/initech/infrastructure/-/blob/main/.gitlab-ci.yml",[],[98,472,473,476,479],{"start":206},[46,474,475],{},"Commit to master",[46,477,478],{},"Go back to the main project page",[46,480,481],{},"Verify Pipeline is running and click on the pipeline icon",[12,483,484],{},[485,486],"img",{"alt":133,"src":487},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398227/blog/Content%20Images/falco_pipeline.png",[98,489,490,496],{"start":240},[46,491,492,493,495],{},"Click on the ",[104,494,404],{}," job and wait for it to complete",[46,497,498],{},"Verify the job was successful",[12,500,501,502,505],{},"Once these steps are complete, you will have Falco running on the\n",[104,503,504],{},"gitlab-managed-apps"," namespace, monitoring the whole cluster for\nmalicious behavior.",[32,507,509],{"id":508},"adding-a-custom-rule","Adding a custom rule",[12,511,512],{},"Falco can be configured to log/report on custom system actions. For example, we may want to know when a new file or directory is created\nwithin our container host, since this may not be something our application does.",[12,514,515,516,519,520,523],{},"To add a custom rule, we add a directory and file in ",[104,517,518],{},"/applications/falco/values.yaml"," where we can add rules within the ",[104,521,522],{},"customRules"," key as follows:",[128,525,530],{"className":526,"code":528,"language":529,"meta":133},[527],"language-text","customRules:\n  file-integrity.yaml: |-\n    - rule: Detect New File\n      desc: detect new file created\n      condition: >\n        evt.type = chmod or evt.type = fchmod\n      output: >\n        File below a known directory opened for writing (user=%user.name\n        command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline gparent=%proc.aname[2])\n      priority: ERROR\n      tags: [filesystem]\n    - rule: Detect New Directory\n      desc: detect new directory created\n      condition: >\n        mkdir\n      output: >\n        File below a known directory opened for writing (user=%user.name\n        command=%proc.cmdline file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline gparent=%proc.aname[2])\n      priority: ERROR\n      tags: [filesystem]\n\n","text",[135,531,528],{"__ignoreMap":133},[12,533,534,537],{},[104,535,536],{},"Note:"," Multiple Yamls can be added with multiple custom rules.",[12,539,540,541,70],{},"For more information on creating custom Falco rules, see the\n",[25,542,545],{"href":543,"rel":544},"https://falco.org/docs/rules/",[],"rules documentation",[32,547,549],{"id":548},"testing-a-rule","Testing a rule",[12,551,552],{},"To verify the rule works, we can look at the Falco logs within the falco pods in our cluster. This can be done by running the following\ncommand on your cluster.",[128,554,558],{"className":555,"code":556,"language":557,"meta":133,"style":133},"language-shell shiki shiki-themes github-light","$ kubectl -n gitlab-managed-apps logs -l app=falco\n","shell",[135,559,560],{"__ignoreMap":133},[138,561,562,566,569,572,575,578,581],{"class":140,"line":141},[138,563,565],{"class":564},"s7eDp","$",[138,567,568],{"class":164}," kubectl",[138,570,571],{"class":236}," -n",[138,573,574],{"class":164}," gitlab-managed-apps",[138,576,577],{"class":164}," logs",[138,579,580],{"class":236}," -l",[138,582,583],{"class":164}," app=falco\n",[12,585,586],{},"This command will spit out logs of all the custom\nrules that were broken as well as the default rules.",[32,588,590],{"id":589},"creating-alerts","Creating alerts",[12,592,593],{},"Alerts will send a message anytime a rule is broken.",[12,595,596],{},"Falco can send alerts to one or more channels:",[43,598,599,602,605,608,611,618],{},[46,600,601],{},"Standard Output",[46,603,604],{},"A file",[46,606,607],{},"Syslog",[46,609,610],{},"A spawned program",[46,612,613,614,617],{},"An HTTP",[138,615,616],{},"S"," end point",[46,619,620],{},"A client via the gRPC API",[12,622,623,624,627],{},"To create an alert, we can apply a new key to the falco ",[25,625,272],{"href":317,"rel":626},[],":",[128,629,631],{"className":130,"code":630,"language":132,"meta":133,"style":133},"falco:\n  jsonOutput: true\n\n",[135,632,633,639],{"__ignoreMap":133},[138,634,635,637],{"class":140,"line":141},[138,636,112],{"class":144},[138,638,149],{"class":148},[138,640,641,644,646],{"class":140,"line":152},[138,642,643],{"class":144},"  jsonOutput",[138,645,161],{"class":148},[138,647,248],{"class":236},[12,649,650],{},"This prints an alert line for each violated rule to syslog (in json) as follows:",[128,652,656],{"className":653,"code":654,"language":655,"meta":133,"style":133},"language-json shiki shiki-themes github-light","{\n  \"output\": \"2022-01-06T22:26:10.067069449+0000: Warning Shell history had been deleted or renamed (user=root user_loginuid=-1 type=open command=bash fd.name=/root/.bash_history name=/root/.bash_history path=\u003CNA> oldpath=\u003CNA> k8s.ns=default k8s.pod=yeet container=b736fee4fe8d) k8s.ns=default k8s.pod=yeet container=b736fee4fe8d k8s.ns=default k8s.pod=yeet container=b736fee4fe8d k8s.ns=default k8s.pod=yeet container=b736fee4fe8d\",\n  \"priority\": \"Warning\",\n  \"rule\": \"Delete or rename shell history\",\n  \"source\": \"syscall\",\n  \"tags\": [\n    \"mitre_defense_evasion\",\n    \"process\"\n  ],\n  \"time\": \"2022-01-06T22:26:10.067069449Z\",\n  \"output_fields\": {\n    \"container.id\": \"b736fee4fe8d\",\n    \"evt.arg.name\": \"/root/.bash_history\",\n    \"evt.arg.oldpath\": null,\n    \"evt.arg.path\": null,\n    \"evt.time.iso8601\": 1641507970067069400,\n    \"evt.type\": \"open\",\n    \"fd.name\": \"/root/.bash_history\",\n    \"k8s.ns.name\": \"default\",\n    \"k8s.pod.name\": \"yeet\",\n    \"proc.cmdline\": \"bash\",\n    \"user.loginuid\": -1,\n    \"user.name\": \"root\"\n  }\n}\n","json",[135,657,658,663,676,688,700,712,720,727,732,737,749,757,769,782,795,807,820,833,845,858,871,884,897,908,914],{"__ignoreMap":133},[138,659,660],{"class":140,"line":141},[138,661,662],{"class":148},"{\n",[138,664,665,668,670,673],{"class":140,"line":152},[138,666,667],{"class":236},"  \"output\"",[138,669,161],{"class":148},[138,671,672],{"class":164},"\"2022-01-06T22:26:10.067069449+0000: Warning Shell history had been deleted or renamed (user=root user_loginuid=-1 type=open command=bash fd.name=/root/.bash_history name=/root/.bash_history path=\u003CNA> oldpath=\u003CNA> k8s.ns=default k8s.pod=yeet container=b736fee4fe8d) k8s.ns=default k8s.pod=yeet container=b736fee4fe8d k8s.ns=default k8s.pod=yeet container=b736fee4fe8d k8s.ns=default k8s.pod=yeet container=b736fee4fe8d\"",[138,674,675],{"class":148},",\n",[138,677,678,681,683,686],{"class":140,"line":168},[138,679,680],{"class":236},"  \"priority\"",[138,682,161],{"class":148},[138,684,685],{"class":164},"\"Warning\"",[138,687,675],{"class":148},[138,689,690,693,695,698],{"class":140,"line":179},[138,691,692],{"class":236},"  \"rule\"",[138,694,161],{"class":148},[138,696,697],{"class":164},"\"Delete or rename shell history\"",[138,699,675],{"class":148},[138,701,702,705,707,710],{"class":140,"line":186},[138,703,704],{"class":236},"  \"source\"",[138,706,161],{"class":148},[138,708,709],{"class":164},"\"syscall\"",[138,711,675],{"class":148},[138,713,714,717],{"class":140,"line":194},[138,715,716],{"class":236},"  \"tags\"",[138,718,719],{"class":148},": [\n",[138,721,722,725],{"class":140,"line":206},[138,723,724],{"class":164},"    \"mitre_defense_evasion\"",[138,726,675],{"class":148},[138,728,729],{"class":140,"line":217},[138,730,731],{"class":164},"    \"process\"\n",[138,733,734],{"class":140,"line":228},[138,735,736],{"class":148},"  ],\n",[138,738,739,742,744,747],{"class":140,"line":240},[138,740,741],{"class":236},"  \"time\"",[138,743,161],{"class":148},[138,745,746],{"class":164},"\"2022-01-06T22:26:10.067069449Z\"",[138,748,675],{"class":148},[138,750,751,754],{"class":140,"line":251},[138,752,753],{"class":236},"  \"output_fields\"",[138,755,756],{"class":148},": {\n",[138,758,759,762,764,767],{"class":140,"line":259},[138,760,761],{"class":236},"    \"container.id\"",[138,763,161],{"class":148},[138,765,766],{"class":164},"\"b736fee4fe8d\"",[138,768,675],{"class":148},[138,770,772,775,777,780],{"class":140,"line":771},13,[138,773,774],{"class":236},"    \"evt.arg.name\"",[138,776,161],{"class":148},[138,778,779],{"class":164},"\"/root/.bash_history\"",[138,781,675],{"class":148},[138,783,785,788,790,793],{"class":140,"line":784},14,[138,786,787],{"class":236},"    \"evt.arg.oldpath\"",[138,789,161],{"class":148},[138,791,792],{"class":236},"null",[138,794,675],{"class":148},[138,796,798,801,803,805],{"class":140,"line":797},15,[138,799,800],{"class":236},"    \"evt.arg.path\"",[138,802,161],{"class":148},[138,804,792],{"class":236},[138,806,675],{"class":148},[138,808,810,813,815,818],{"class":140,"line":809},16,[138,811,812],{"class":236},"    \"evt.time.iso8601\"",[138,814,161],{"class":148},[138,816,817],{"class":236},"1641507970067069400",[138,819,675],{"class":148},[138,821,823,826,828,831],{"class":140,"line":822},17,[138,824,825],{"class":236},"    \"evt.type\"",[138,827,161],{"class":148},[138,829,830],{"class":164},"\"open\"",[138,832,675],{"class":148},[138,834,836,839,841,843],{"class":140,"line":835},18,[138,837,838],{"class":236},"    \"fd.name\"",[138,840,161],{"class":148},[138,842,779],{"class":164},[138,844,675],{"class":148},[138,846,848,851,853,856],{"class":140,"line":847},19,[138,849,850],{"class":236},"    \"k8s.ns.name\"",[138,852,161],{"class":148},[138,854,855],{"class":164},"\"default\"",[138,857,675],{"class":148},[138,859,861,864,866,869],{"class":140,"line":860},20,[138,862,863],{"class":236},"    \"k8s.pod.name\"",[138,865,161],{"class":148},[138,867,868],{"class":164},"\"yeet\"",[138,870,675],{"class":148},[138,872,874,877,879,882],{"class":140,"line":873},21,[138,875,876],{"class":236},"    \"proc.cmdline\"",[138,878,161],{"class":148},[138,880,881],{"class":164},"\"bash\"",[138,883,675],{"class":148},[138,885,887,890,892,895],{"class":140,"line":886},22,[138,888,889],{"class":236},"    \"user.loginuid\"",[138,891,161],{"class":148},[138,893,894],{"class":236},"-1",[138,896,675],{"class":148},[138,898,900,903,905],{"class":140,"line":899},23,[138,901,902],{"class":236},"    \"user.name\"",[138,904,161],{"class":148},[138,906,907],{"class":164},"\"root\"\n",[138,909,911],{"class":140,"line":910},24,[138,912,913],{"class":148},"  }\n",[138,915,917],{"class":140,"line":916},25,[138,918,919],{"class":148},"}\n",[12,921,922],{},"Which shows that I opened a terminal on a pod running within my cluster and closed it.",[12,924,925,930],{},[25,926,929],{"href":927,"rel":928},"https://falco.org/docs/alerts/",[],"Falco Alerts Documentation"," contains more\ninformation on the types of alerts you can configure and how. This includes:",[43,932,933,936,938,941,947,950],{},[46,934,935],{},"File Output",[46,937,601],{},[46,939,940],{},"Program Output",[46,942,943,944,946],{},"HTTP",[138,945,616],{}," Output",[46,948,949],{},"SysLog Output",[46,951,952],{},"gRPC Output",[32,954,956],{"id":955},"roadmap","Roadmap",[12,958,959],{},"Within the Protect Roadmap, we\ncan see the plans for the future of Container Host Security.",[12,961,962],{},"The roadmap contains the following Container Host Security enhancements\nwithin the next 12 months:",[43,964,965,968,971,974],{},[46,966,967],{},"Falco Statistics",[46,969,970],{},"Export logs to SIEM",[46,972,973],{},"Policy management via UI",[46,975,976],{},"Default policy set",[978,979,980],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}",{"title":133,"searchDepth":152,"depth":152,"links":982},[983,984,985,986,987,988],{"id":34,"depth":152,"text":35},{"id":60,"depth":152,"text":61},{"id":508,"depth":152,"text":509},{"id":548,"depth":152,"text":549},{"id":589,"depth":152,"text":590},{"id":955,"depth":152,"text":956},"security","2022-01-20","Learn how to install and use Falco to detect anomalies in your containers","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749663383/Blog/Hero%20Images/tanuki-bg-full.png",{},"/en-us/blog/securing-the-container-host-with-falco",{"title":999,"description":991,"ogTitle":999,"ogDescription":991,"noIndex":994,"ogImage":995,"ogUrl":1000,"ogSiteName":1001,"ogType":1002,"canonicalUrls":1000},"Detecting container host anomalies with GitLab and Falco","https://about.gitlab.com/blog/securing-the-container-host-with-falco","https://about.gitlab.com","article","securing-the-container-host-with-falco","en-us/blog/securing-the-container-host-with-falco",[989],"BlogPost","2066tfsnyQU6BP7br0djD3ytD7CCltLMEHDQtriYVfE",{"logo":1009,"freeTrial":1014,"sales":1019,"login":1024,"items":1029,"search":1355,"minimal":1386,"duo":1405,"switchNav":1414,"pricingDeployment":1425},{"config":1010},{"href":1011,"dataGaName":1012,"dataGaLocation":1013},"/","gitlab logo","header",{"text":1015,"config":1016},"Get free trial",{"href":1017,"dataGaName":1018,"dataGaLocation":1013},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":1020,"config":1021},"Request a demo",{"href":1022,"dataGaName":1023,"dataGaLocation":1013},"/sales/?contact-topic=request-demo","sales",{"text":1025,"config":1026},"Sign in",{"href":1027,"dataGaName":1028,"dataGaLocation":1013},"https://gitlab.com/users/sign_in/","sign in",[1030,1059,1159,1164,1277,1333],{"text":1031,"config":1032,"menu":1034},"Platform",{"dataNavLevelOne":1033},"platform",{"type":1035,"columns":1036},"cards",[1037,1043,1051],{"title":1031,"description":1038,"link":1039},"The intelligent orchestration platform for DevSecOps",{"text":1040,"config":1041},"Explore our Platform",{"href":1042,"dataGaName":1033,"dataGaLocation":1013},"/platform/",{"title":1044,"description":1045,"link":1046},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":1047,"config":1048},"Meet GitLab Duo",{"href":1049,"dataGaName":1050,"dataGaLocation":1013},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1052,"description":1053,"link":1054},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":1055,"config":1056},"Learn more",{"href":1057,"dataGaName":1058,"dataGaLocation":1013},"/why-gitlab/","why gitlab",{"text":1060,"left":182,"config":1061,"menu":1063},"Product",{"dataNavLevelOne":1062},"solutions",{"type":1064,"link":1065,"columns":1069,"feature":1138},"lists",{"text":1066,"config":1067},"View all Solutions",{"href":1068,"dataGaName":1062,"dataGaLocation":1013},"/solutions/",[1070,1094,1117],{"title":1071,"description":1072,"link":1073,"items":1078},"Automation","CI/CD and automation to accelerate deployment",{"config":1074},{"icon":1075,"href":1076,"dataGaName":1077,"dataGaLocation":1013},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[1079,1083,1086,1090],{"text":1080,"config":1081},"CI/CD",{"href":1082,"dataGaLocation":1013,"dataGaName":1080},"/solutions/continuous-integration/",{"text":1044,"config":1084},{"href":1049,"dataGaLocation":1013,"dataGaName":1085},"gitlab duo agent platform - product menu",{"text":1087,"config":1088},"Source Code Management",{"href":1089,"dataGaLocation":1013,"dataGaName":1087},"/solutions/source-code-management/",{"text":1091,"config":1092},"Automated Software Delivery",{"href":1076,"dataGaLocation":1013,"dataGaName":1093},"Automated software delivery",{"title":1095,"description":1096,"link":1097,"items":1102},"Security","Deliver code faster without compromising security",{"config":1098},{"href":1099,"dataGaName":1100,"dataGaLocation":1013,"icon":1101},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1103,1107,1112],{"text":1104,"config":1105},"Application Security Testing",{"href":1099,"dataGaName":1106,"dataGaLocation":1013},"Application security testing",{"text":1108,"config":1109},"Software Supply Chain Security",{"href":1110,"dataGaLocation":1013,"dataGaName":1111},"/solutions/supply-chain/","Software supply chain security",{"text":1113,"config":1114},"Software Compliance",{"href":1115,"dataGaName":1116,"dataGaLocation":1013},"/solutions/software-compliance/","software compliance",{"title":1118,"link":1119,"items":1124},"Measurement",{"config":1120},{"icon":1121,"href":1122,"dataGaName":1123,"dataGaLocation":1013},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[1125,1129,1133],{"text":1126,"config":1127},"Visibility & Measurement",{"href":1122,"dataGaLocation":1013,"dataGaName":1128},"Visibility and Measurement",{"text":1130,"config":1131},"Value Stream Management",{"href":1132,"dataGaLocation":1013,"dataGaName":1130},"/solutions/value-stream-management/",{"text":1134,"config":1135},"Analytics & Insights",{"href":1136,"dataGaLocation":1013,"dataGaName":1137},"/solutions/analytics-and-insights/","Analytics and insights",{"title":1139,"type":1064,"items":1140},"GitLab for",[1141,1147,1153],{"text":1142,"config":1143},"Enterprise",{"icon":1144,"href":1145,"dataGaLocation":1013,"dataGaName":1146},"Building","/enterprise/","enterprise",{"text":1148,"config":1149},"Small Business",{"icon":1150,"href":1151,"dataGaLocation":1013,"dataGaName":1152},"Work","/small-business/","small business",{"text":1154,"config":1155},"Public Sector",{"icon":1156,"href":1157,"dataGaLocation":1013,"dataGaName":1158},"Organization","/solutions/public-sector/","public sector",{"text":1160,"config":1161},"Pricing",{"href":1162,"dataGaName":1163,"dataGaLocation":1013,"dataNavLevelOne":1163},"/pricing/","pricing",{"text":1165,"config":1166,"menu":1168},"Resources",{"dataNavLevelOne":1167},"resources",{"type":1064,"link":1169,"columns":1173,"feature":1266},{"text":1170,"config":1171},"View all resources",{"href":1172,"dataGaName":1167,"dataGaLocation":1013},"/resources/",[1174,1207,1233],{"title":1175,"items":1176},"Getting started",[1177,1182,1187,1192,1197,1202],{"text":1178,"config":1179},"Install",{"href":1180,"dataGaName":1181,"dataGaLocation":1013},"/install/","install",{"text":1183,"config":1184},"Quick start guides",{"href":1185,"dataGaName":1186,"dataGaLocation":1013},"/get-started/","quick setup checklists",{"text":1188,"config":1189},"Learn",{"href":1190,"dataGaLocation":1013,"dataGaName":1191},"https://university.gitlab.com/","learn",{"text":1193,"config":1194},"Product documentation",{"href":1195,"dataGaName":1196,"dataGaLocation":1013},"https://docs.gitlab.com/","product documentation",{"text":1198,"config":1199},"Best practice videos",{"href":1200,"dataGaName":1201,"dataGaLocation":1013},"/getting-started-videos/","best practice videos",{"text":1203,"config":1204},"Integrations",{"href":1205,"dataGaName":1206,"dataGaLocation":1013},"/integrations/","integrations",{"title":1208,"items":1209},"Discover",[1210,1215,1219,1224,1228],{"text":1211,"config":1212},"Customer success stories",{"href":1213,"dataGaName":1214,"dataGaLocation":1013},"/customers/","customer success stories",{"text":1216,"config":1217},"Blog",{"href":1218,"dataGaName":87,"dataGaLocation":1013},"/blog/",{"text":1220,"config":1221},"Demo Hub",{"href":1222,"dataGaName":1223,"dataGaLocation":1013},"/demo-hub/","demo hub",{"text":1225,"config":1226},"The Source",{"href":1227,"dataGaName":87,"dataGaLocation":1013},"/the-source/",{"text":1229,"config":1230},"Remote",{"href":1231,"dataGaName":1232,"dataGaLocation":1013},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1234,"items":1235},"Connect",[1236,1241,1246,1251,1256,1261],{"text":1237,"config":1238},"GitLab Services",{"href":1239,"dataGaName":1240,"dataGaLocation":1013},"/services/","services",{"text":1242,"config":1243},"Contribute",{"href":1244,"dataGaName":1245,"dataGaLocation":1013},"https://contributors.gitlab.com","contribute",{"text":1247,"config":1248},"Community",{"href":1249,"dataGaName":1250,"dataGaLocation":1013},"/community/","community",{"text":1252,"config":1253},"Forum",{"href":1254,"dataGaName":1255,"dataGaLocation":1013},"https://forum.gitlab.com/","forum",{"text":1257,"config":1258},"Events",{"href":1259,"dataGaName":1260,"dataGaLocation":1013},"/events/","events",{"text":1262,"config":1263},"Partners",{"href":1264,"dataGaName":1265,"dataGaLocation":1013},"/partners/","partners",{"config":1267,"title":1270,"text":1271,"link":1272},{"background":1268,"textColor":1269},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1273,"config":1274},"Read the latest",{"href":1275,"dataGaName":1276,"dataGaLocation":1013},"/whats-new/","whats new",{"text":1278,"config":1279,"menu":1281},"Company",{"dataNavLevelOne":1280},"company",{"type":1064,"columns":1282},[1283],{"items":1284},[1285,1290,1296,1298,1303,1308,1313,1318,1323,1328],{"text":1286,"config":1287},"About",{"href":1288,"dataGaName":1289,"dataGaLocation":1013},"/company/","about",{"text":1291,"config":1292,"footerGa":1295},"Jobs",{"href":1293,"dataGaName":1294,"dataGaLocation":1013},"/jobs/","jobs",{"dataGaName":1294},{"text":1257,"config":1297},{"href":1259,"dataGaName":1260,"dataGaLocation":1013},{"text":1299,"config":1300},"Leadership",{"href":1301,"dataGaName":1302,"dataGaLocation":1013},"/company/team/e-group/","leadership",{"text":1304,"config":1305},"Handbook",{"href":1306,"dataGaName":1307,"dataGaLocation":1013},"https://handbook.gitlab.com/","handbook",{"text":1309,"config":1310},"Investor relations",{"href":1311,"dataGaName":1312,"dataGaLocation":1013},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1314,"config":1315},"Trust Center",{"href":1316,"dataGaName":1317,"dataGaLocation":1013},"/security/","trust center",{"text":1319,"config":1320},"AI Transparency Center",{"href":1321,"dataGaName":1322,"dataGaLocation":1013},"/ai-transparency-center/","ai transparency center",{"text":1324,"config":1325},"Newsletter",{"href":1326,"dataGaName":1327,"dataGaLocation":1013},"/company/contact/#contact-forms","newsletter",{"text":1329,"config":1330},"Press",{"href":1331,"dataGaName":1332,"dataGaLocation":1013},"/press/","press",{"text":1334,"config":1335,"menu":1336},"Contact us",{"dataNavLevelOne":1280},{"type":1064,"columns":1337},[1338],{"items":1339},[1340,1345,1350],{"text":1341,"config":1342},"Talk to sales",{"href":1343,"dataGaName":1344,"dataGaLocation":1013},"/sales/","talk to sales",{"text":1346,"config":1347},"Support portal",{"href":1348,"dataGaName":1349,"dataGaLocation":1013},"https://support.gitlab.com/hc/en-us","support portal",{"text":1351,"config":1352},"Customer portal",{"href":1353,"dataGaName":1354,"dataGaLocation":1013},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1356,"login":1357,"suggestions":1364},"Close",{"text":1358,"link":1359},"To search repositories and projects, login to",{"text":1360,"config":1361},"gitlab.com",{"href":1027,"dataGaName":1362,"dataGaLocation":1363},"search login","search",{"text":1365,"default":1366},"Suggestions",[1367,1369,1373,1375,1379,1383],{"text":1044,"config":1368},{"href":1049,"dataGaName":1044,"dataGaLocation":1363},{"text":1370,"config":1371},"Code Suggestions (AI)",{"href":1372,"dataGaName":1370,"dataGaLocation":1363},"/solutions/code-suggestions/",{"text":1080,"config":1374},{"href":1082,"dataGaName":1080,"dataGaLocation":1363},{"text":1376,"config":1377},"GitLab on AWS",{"href":1378,"dataGaName":1376,"dataGaLocation":1363},"/partners/technology-partners/aws/",{"text":1380,"config":1381},"GitLab on Google Cloud",{"href":1382,"dataGaName":1380,"dataGaLocation":1363},"/partners/technology-partners/google-cloud-platform/",{"text":1384,"config":1385},"Why GitLab?",{"href":1057,"dataGaName":1384,"dataGaLocation":1363},{"freeTrial":1387,"mobileIcon":1392,"desktopIcon":1397,"secondaryButton":1400},{"text":1388,"config":1389},"Start free trial",{"href":1390,"dataGaName":1018,"dataGaLocation":1391},"https://gitlab.com/-/trials/new/","nav",{"altText":1393,"config":1394},"Gitlab Icon",{"src":1395,"dataGaName":1396,"dataGaLocation":1391},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1393,"config":1398},{"src":1399,"dataGaName":1396,"dataGaLocation":1391},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1401,"config":1402},"Get Started",{"href":1403,"dataGaName":1404,"dataGaLocation":1391},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1406,"mobileIcon":1410,"desktopIcon":1412},{"text":1407,"config":1408},"Learn more about GitLab Duo",{"href":1049,"dataGaName":1409,"dataGaLocation":1391},"gitlab duo",{"altText":1393,"config":1411},{"src":1395,"dataGaName":1396,"dataGaLocation":1391},{"altText":1393,"config":1413},{"src":1399,"dataGaName":1396,"dataGaLocation":1391},{"button":1415,"mobileIcon":1420,"desktopIcon":1422},{"text":1416,"config":1417},"/switch",{"href":1418,"dataGaName":1419,"dataGaLocation":1391},"#contact","switch",{"altText":1393,"config":1421},{"src":1395,"dataGaName":1396,"dataGaLocation":1391},{"altText":1393,"config":1423},{"src":1424,"dataGaName":1396,"dataGaLocation":1391},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1426,"mobileIcon":1431,"desktopIcon":1433},{"text":1427,"config":1428},"Back to pricing",{"href":1162,"dataGaName":1429,"dataGaLocation":1391,"icon":1430},"back to pricing","GoBack",{"altText":1393,"config":1432},{"src":1395,"dataGaName":1396,"dataGaLocation":1391},{"altText":1393,"config":1434},{"src":1399,"dataGaName":1396,"dataGaLocation":1391},{"title":1436,"titleMobile":1437,"button":1438,"config":1443},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":1055,"config":1439},{"href":1440,"dataGaName":1441,"dataGaLocation":1442},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1444,"disabled":994},"release",{"data":1446},{"text":1447,"source":1448,"edit":1454,"contribute":1459,"config":1464,"items":1469,"minimal":1679},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1449,"config":1450},"View page source",{"href":1451,"dataGaName":1452,"dataGaLocation":1453},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1455,"config":1456},"Edit this page",{"href":1457,"dataGaName":1458,"dataGaLocation":1453},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1460,"config":1461},"Please contribute",{"href":1462,"dataGaName":1463,"dataGaLocation":1453},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1465,"facebook":1466,"youtube":1467,"linkedin":1468},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1470,1517,1571,1615,1647],{"title":1160,"links":1471,"subMenu":1486},[1472,1476,1481],{"text":1473,"config":1474},"View plans",{"href":1162,"dataGaName":1475,"dataGaLocation":1453},"view plans",{"text":1477,"config":1478},"Why Premium?",{"href":1479,"dataGaName":1480,"dataGaLocation":1453},"/pricing/premium/","why premium",{"text":1482,"config":1483},"Why Ultimate?",{"href":1484,"dataGaName":1485,"dataGaLocation":1453},"/pricing/ultimate/","why ultimate",[1487],{"title":1488,"links":1489},"Contact Us",[1490,1493,1495,1497,1502,1507,1512],{"text":1491,"config":1492},"Contact sales",{"href":1343,"dataGaName":1023,"dataGaLocation":1453},{"text":1346,"config":1494},{"href":1348,"dataGaName":1349,"dataGaLocation":1453},{"text":1351,"config":1496},{"href":1353,"dataGaName":1354,"dataGaLocation":1453},{"text":1498,"config":1499},"Status",{"href":1500,"dataGaName":1501,"dataGaLocation":1453},"https://status.gitlab.com/","status",{"text":1503,"config":1504},"Terms of use",{"href":1505,"dataGaName":1506,"dataGaLocation":1453},"/terms/","terms of use",{"text":1508,"config":1509},"Privacy statement",{"href":1510,"dataGaName":1511,"dataGaLocation":1453},"/privacy/","privacy statement",{"text":1513,"config":1514},"Cookie preferences",{"dataGaName":1515,"dataGaLocation":1453,"id":1516,"isOneTrustButton":182},"cookie preferences","ot-sdk-btn",{"title":1060,"links":1518,"subMenu":1527},[1519,1523],{"text":1520,"config":1521},"DevSecOps platform",{"href":1042,"dataGaName":1522,"dataGaLocation":1453},"devsecops platform",{"text":1524,"config":1525},"AI-Assisted Development",{"href":1049,"dataGaName":1526,"dataGaLocation":1453},"ai-assisted development",[1528],{"title":1529,"links":1530},"Topics",[1531,1536,1541,1546,1551,1556,1561,1566],{"text":1532,"config":1533},"CICD",{"href":1534,"dataGaName":1535,"dataGaLocation":1453},"/topics/ci-cd/","cicd",{"text":1537,"config":1538},"GitOps",{"href":1539,"dataGaName":1540,"dataGaLocation":1453},"/topics/gitops/","gitops",{"text":1542,"config":1543},"DevOps",{"href":1544,"dataGaName":1545,"dataGaLocation":1453},"/topics/devops/","devops",{"text":1547,"config":1548},"Version Control",{"href":1549,"dataGaName":1550,"dataGaLocation":1453},"/topics/version-control/","version control",{"text":1552,"config":1553},"DevSecOps",{"href":1554,"dataGaName":1555,"dataGaLocation":1453},"/topics/devsecops/","devsecops",{"text":1557,"config":1558},"Cloud Native",{"href":1559,"dataGaName":1560,"dataGaLocation":1453},"/topics/cloud-native/","cloud native",{"text":1562,"config":1563},"AI for Coding",{"href":1564,"dataGaName":1565,"dataGaLocation":1453},"/topics/devops/ai-for-coding/","ai for coding",{"text":1567,"config":1568},"Agentic AI",{"href":1569,"dataGaName":1570,"dataGaLocation":1453},"/topics/agentic-ai/","agentic ai",{"title":1572,"links":1573},"Solutions",[1574,1576,1578,1583,1587,1590,1594,1597,1599,1602,1605,1610],{"text":1104,"config":1575},{"href":1099,"dataGaName":1104,"dataGaLocation":1453},{"text":1093,"config":1577},{"href":1076,"dataGaName":1077,"dataGaLocation":1453},{"text":1579,"config":1580},"Agile development",{"href":1581,"dataGaName":1582,"dataGaLocation":1453},"/solutions/agile-delivery/","agile delivery",{"text":1584,"config":1585},"SCM",{"href":1089,"dataGaName":1586,"dataGaLocation":1453},"source code management",{"text":1532,"config":1588},{"href":1082,"dataGaName":1589,"dataGaLocation":1453},"continuous integration & delivery",{"text":1591,"config":1592},"Value stream management",{"href":1132,"dataGaName":1593,"dataGaLocation":1453},"value stream management",{"text":1537,"config":1595},{"href":1596,"dataGaName":1540,"dataGaLocation":1453},"/solutions/gitops/",{"text":1142,"config":1598},{"href":1145,"dataGaName":1146,"dataGaLocation":1453},{"text":1600,"config":1601},"Small business",{"href":1151,"dataGaName":1152,"dataGaLocation":1453},{"text":1603,"config":1604},"Public sector",{"href":1157,"dataGaName":1158,"dataGaLocation":1453},{"text":1606,"config":1607},"Education",{"href":1608,"dataGaName":1609,"dataGaLocation":1453},"/solutions/education/","education",{"text":1611,"config":1612},"Financial services",{"href":1613,"dataGaName":1614,"dataGaLocation":1453},"/solutions/finance/","financial services",{"title":1165,"links":1616},[1617,1619,1621,1623,1626,1628,1631,1633,1635,1637,1639,1641,1643,1645],{"text":1178,"config":1618},{"href":1180,"dataGaName":1181,"dataGaLocation":1453},{"text":1183,"config":1620},{"href":1185,"dataGaName":1186,"dataGaLocation":1453},{"text":1188,"config":1622},{"href":1190,"dataGaName":1191,"dataGaLocation":1453},{"text":1193,"config":1624},{"href":1195,"dataGaName":1625,"dataGaLocation":1453},"docs",{"text":1216,"config":1627},{"href":1218,"dataGaName":87,"dataGaLocation":1453},{"text":1629,"config":1630},"What's new",{"href":1275,"dataGaName":1276,"dataGaLocation":1453},{"text":1211,"config":1632},{"href":1213,"dataGaName":1214,"dataGaLocation":1453},{"text":1229,"config":1634},{"href":1231,"dataGaName":1232,"dataGaLocation":1453},{"text":1237,"config":1636},{"href":1239,"dataGaName":1240,"dataGaLocation":1453},{"text":1242,"config":1638},{"href":1244,"dataGaName":1245,"dataGaLocation":1453},{"text":1247,"config":1640},{"href":1249,"dataGaName":1250,"dataGaLocation":1453},{"text":1252,"config":1642},{"href":1254,"dataGaName":1255,"dataGaLocation":1453},{"text":1257,"config":1644},{"href":1259,"dataGaName":1260,"dataGaLocation":1453},{"text":1262,"config":1646},{"href":1264,"dataGaName":1265,"dataGaLocation":1453},{"title":1278,"links":1648},[1649,1651,1653,1655,1657,1659,1663,1668,1670,1672,1674],{"text":1286,"config":1650},{"href":1288,"dataGaName":1280,"dataGaLocation":1453},{"text":1291,"config":1652},{"href":1293,"dataGaName":1294,"dataGaLocation":1453},{"text":1299,"config":1654},{"href":1301,"dataGaName":1302,"dataGaLocation":1453},{"text":1304,"config":1656},{"href":1306,"dataGaName":1307,"dataGaLocation":1453},{"text":1309,"config":1658},{"href":1311,"dataGaName":1312,"dataGaLocation":1453},{"text":1660,"config":1661},"Sustainability",{"href":1662,"dataGaName":1660,"dataGaLocation":1453},"/sustainability/",{"text":1664,"config":1665},"Diversity, inclusion and belonging (DIB)",{"href":1666,"dataGaName":1667,"dataGaLocation":1453},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1314,"config":1669},{"href":1316,"dataGaName":1317,"dataGaLocation":1453},{"text":1324,"config":1671},{"href":1326,"dataGaName":1327,"dataGaLocation":1453},{"text":1329,"config":1673},{"href":1331,"dataGaName":1332,"dataGaLocation":1453},{"text":1675,"config":1676},"Modern Slavery Transparency Statement",{"href":1677,"dataGaName":1678,"dataGaLocation":1453},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1680},[1681,1684,1687],{"text":1682,"config":1683},"Terms",{"href":1505,"dataGaName":1506,"dataGaLocation":1453},{"text":1685,"config":1686},"Cookies",{"dataGaName":1515,"dataGaLocation":1453,"id":1516,"isOneTrustButton":182},{"text":1688,"config":1689},"Privacy",{"href":1510,"dataGaName":1511,"dataGaLocation":1453},[1691],{"id":1692,"title":7,"body":993,"config":1693,"content":1695,"description":993,"extension":1699,"meta":1700,"navigation":182,"path":1701,"seo":1702,"stem":1703,"__hash__":1704},"blogAuthors/en-us/blog/authors/fernando-diaz.yml",{"template":1694},"BlogAuthor",{"name":7,"config":1696},{"headshot":1697,"ctfId":1698},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659556/Blog/Author%20Headshots/fern_diaz.png","fjdiaz","yml",{},"/en-us/blog/authors/fernando-diaz",{},"en-us/blog/authors/fernando-diaz","lxRJIOydP4_yzYZvsPcuQevP9AYAKREF7i8QmmdnOWc",[1706,1714,1722],{"title":1707,"description":1708,"heroImage":1709,"category":989,"date":1710,"authors":1711,"slug":1713,"externalUrl":993},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1712],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1715,"description":1716,"heroImage":1709,"category":989,"date":1717,"authors":1718,"slug":1721,"externalUrl":993},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1719,1720],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1723,"description":1724,"heroImage":1725,"category":989,"date":1726,"authors":1727,"slug":1729,"externalUrl":993},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1728],"Alisa Ho","claude-security-and-gitlab",{"promotions":1731},[1732,1746,1758,1769],{"id":1733,"categories":1734,"header":1736,"text":1737,"button":1738,"image":1743},"ai-modernization",[1735],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1739,"config":1740},"Get your AI maturity score",{"href":1741,"dataGaName":1742,"dataGaLocation":87},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1744},{"src":1745},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1747,"categories":1748,"header":1750,"text":1737,"button":1751,"image":1755},"devops-modernization",[1749,1555],"product","Are you just managing tools or shipping innovation?",{"text":1752,"config":1753},"Get your DevOps maturity score",{"href":1754,"dataGaName":1742,"dataGaLocation":87},"/assessments/devops-modernization-assessment/",{"config":1756},{"src":1757},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1759,"categories":1760,"header":1761,"text":1737,"button":1762,"image":1766},"security-modernization",[989],"Are you trading speed for security?",{"text":1763,"config":1764},"Get your security maturity score",{"href":1765,"dataGaName":1742,"dataGaLocation":87},"/assessments/security-modernization-assessment/",{"config":1767},{"src":1768},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1770,"paths":1771,"header":1774,"text":1775,"button":1776,"image":1781},"github-azure-migration",[1772,1773],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1777,"config":1778},"See how GitLab compares to GitHub",{"href":1779,"dataGaName":1780,"dataGaLocation":87},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1782},{"src":1757},{"header":1784,"blurb":1785,"button":1786,"secondaryButton":1791},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1787,"config":1788},"Get your free trial",{"href":1789,"dataGaName":1018,"dataGaLocation":1790},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1491,"config":1792},{"href":1343,"dataGaName":1023,"dataGaLocation":1790},1786803754642]