Skip to content

Commit

Permalink
docs(brand): update glossary of key terms
Browse files Browse the repository at this point in the history
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
  • Loading branch information
leogr authored and poiana committed Aug 4, 2023
1 parent 5ba4fd1 commit 2583ea9
Showing 1 changed file with 13 additions and 15 deletions.
28 changes: 13 additions & 15 deletions brand/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,37 +49,35 @@ Notice the capitalization of the following terms.

---

# Glossary
# Glossary

#### Probe
This section contains key terms specifically used within the context of The Falco Project. For a more comprehensive list of Falco-related terminology, we invite you to visit the [Glossary](https://falco.org/docs/reference/glossary/) page on our official website.

#### eBPF Probe

Used to describe the `.o` object that would be dynamically loaded into the kernel as a secure and stable (e)BPF probe.
This is one option used to pass kernel events up to userspace for Falco to consume.
Sometimes this word is incorrectly used to refer to a `module`.

#### Module
#### Modern eBPF Probe

More robust [eBPF probe](#ebpf-probe), which brings the CO-RE paradigm, better performances, and maintainability.
Unlike the legacy probe, the modern eBPF probe is not shipped as a separate artifact but bundled into the Falco binary itself.
This is one option used to pass kernel events up to userspace for Falco to consume.

#### Kernel Module

Used to describe the `.ko` object that would be loaded into the kernel as a potentially risky kernel module.
This is one option used to pass kernel events up to userspace for Falco to consume.
Sometimes this word is incorrectly used to refer to a `probe`.

#### Driver

The global term for the software that sends events from the kernel. Such as the eBPF `probe` or the `kernel module`.
The global term for the software that sends events from the kernel. Such as the [eBPF probe](#ebpf-probe), the [Modern eBPF probe](#modern-ebpf-probe), or the [Kernel Module](#kernel-module).

#### Plugin

Used to describe a dynamic shared library (`.so` files in Unix, `.dll` files in Windows) that conforms to a documented API and allows to extend Falco's capabilities.

#### Falco

The name of the project, and also the name of [the main engine](https://github.com/falcosecurity/falco) that the rest of the project is built on.

#### Sysdig, Inc

The name of the company that originally created The Falco Project, and later donated to the CNCF.

#### sysdig

A [CLI tool](https://github.com/draios/sysdig) used to evaluate kernel system events at runtime.
The name of the project and also the name of [the main engine](https://github.com/falcosecurity/falco) that the rest of the project is built on.

0 comments on commit 2583ea9

Please sign in to comment.