Thank you for joining us. It's still our June 12th special as we celebrate with Nigerians within and without Democracy Day. I'm Marianna Kuhn and still with me is Well, we just have news coming in from Lagos apparently Protesters have been arrested at the Ghani highway meat park here in Lagos We will bring you details on that as we continue But right now was moving straight to the economy The performance of the Nigerian economy was mixed under former military head of state, Saniya Bacha Foreign reserves increased from less than five hundred million dollars to nearly ten billion dollars The national debt and inflation also reduced the Nigeria and but Nigeria remained a mono product economy Was oil as the major contributor to our economic growth Procedures and processes were also abused and there was unchecked looting quite interesting and the short tenure of Abdu Salaam-e-Bubaka saw the depletion of Nigerians foreign reserves and allegations of corruption the economy grew under President Ulusha Gumo Basaja with the liberalization of the telecommunications industry the Banking consolidation and the privatization program the growth was sustained under President Goodluck Jonathan, but external debt ballooned and the foreign reserves taxed Now under a president Muhammad upon hiring Nigeria has witnessed two recessions And we are currently on the way to a slow recovery well and We have joining us of a diamond Lafayette who is joining us from plateau state Vasu to take a look at how Nigeria has fared Economically he's a former deputy governor of the central bank of Nigeria a former official of the African Development Bank group And a former presidential candidate. Good afternoon. Dr. Melafia Well, thank you very much for joining us. Mr. Lafayette All right, happy democracy day Let's start with looking at, you know, the economy a lot of people have blamed the recessions that we've gone in and out of or the state of the economy on the successive governments To leadership some have also blamed it to bad Judgments that we've made in terms of who sits at the top of the apex bank But what do you think is the cause of the recession that we've faced is we've had lower prices Could he also be poor management of the economy because we also have the economic council Where the vice president under any administration heads? Well, you know As you you jolly well know This things never happened on a straight and simple Unilinear path from One cause to another there are often a multiplicity of causes domestic global Geopolitical Leadership all of them combine together to create a scenario in which we find ourselves at present And you will agree with me that it is far from being a happy scenario We in the space of five years. We've had two negative growths. I can tell you From 1968 to 1998 up to 2015 we had had only one negative growth and that was in 1968 at the peak of the civil war That growth came to minus 2.7 or thereabouts But in 2016 we had a minus growth of minus 1.6 and in 2020 last year we had a growth of almost 2 percent 1.8 percent minus 1.8 percent so and to have these Within, you know for five years Is is a very terrible time situation and for the five last five years We have never had growth that even reaches 3 percent Come back compared to a bus and just almost seven percent Grow through at his period in office. I mean that that was extraordinary Today we you know the figures look very pessimistic inflation about 19 percent Unemployment about 33 percent, you know, Nigeria in 2017 overtook India as the world capital of poverty So we as having very serious problems There has been a massive fall In foreign reserves from a peak of about 60 billion dollars To today around 30 33 34 billion dollars and not only that There's been a massive fall in the value of the Naira From about hundred and sixty Naira to the dollar In 2014 to now almost five hundred four eighty Naira to the dollar is an extraordinary fall Almost 200 percent. I mean it's it's terrible. I mean you can't imagine it and of course being an oil dependent rent rent here economy We we depend a lot on impulse of course a fall in the exchange rate the devaluation of a currency reflects in higher import prices and higher inflation and inflation on its part undermines long-term growth undermines investments undermines Employment and so you have a vicious circle of poverty. What are the causes of that? Of course? It's easy to blame The global collapse in oil prices that is a factor, but that is not the only factor because as a matter of fact Oil Has increasingly played a lesser part than it did before in our macroeconomy There's a time that oil accounted for 20 percent of the economy in fact 50 percent of the economy then 20 percent today oil accounts for less than 50 percent of our GDP and It accounts for only 50 percent of our You know government revenue even though it still accounts for over 90 percent of our foreign Receipts foreign earnings. So other sectors have come in getting stronger agriculture manufacturing You know building and construction these have become increasingly very important sectors But even then oil still continues to play a major part the crisis of insecurity in our country particularly in the rural areas is depressing agricultural productivity and increasing hunger and food inflation Food inflation for typical products like Gary beans and so it's almost hundred percent increase So the poor are getting more desperate the youth More unemployed they get a very angry. I mean, we're talking about over 20 million Nigerians who are unemployed and If you add to that number the underemployed and by the underemployed I mean Let's say graduate who did mechanical engineering is it just to riding a rocker Yeah, he's doing a job, but it's hardly the kind of job that he was trained for So our situation is is getting worse from back to worse and the peak of it is leadership There's a failure of leadership Yeah We're going to talk about the failure of leadership But I want to delve more into our dependence on oil because you've just mentioned that it's played a lesser role that he used to in our in our economy, but Let's talk about agriculture something that we bandy every time we talk about maybe the oil benchmark Shifting from where it used to be or the when the oil price falls We remember that oh we have agriculture and then we begin to say it sounds more like we're going to do something about it But yes, there has been a growth to our agriculture But why have we not necessarily paid as much attention to our agricultural sector as we have paid or in fact solely Depended on oil. I mean there are people what I might I might not have grown up in that year I might not have been born, but I remember The fact that we used to as a country depends solely on agriculture and we did fairly well Why have we totally jettisoned it being that even now? Agriculture has gone beyond a hole and a machete We're now looking at mechanized farming and of course other things in technology wise Why has Nigeria not paid as much attention to it? In fact, we even have somebody sitting at the Africa Development Bank who used to be Someone in charge of agriculture and yet we seem not to be playing on the same levels like Rwanda or Kenya Well many factors I come for this, you know leaders when they come into power Come with their priorities and they come with an agenda I don't think this particular administration the APC led administration of President Muhammadu Buhari Has given enough attention to agriculture the way previous leaders did Certainly, Olusia Gunobasanjo a big-time farmer himself paid very big attention to agriculture and We never celebrate enough. I think in my humble opinion The late president Umar of Musa Yer-Adwa People don't know that after National Service he started his career as a farmer in Funtua He was the general manager of his elder brother's farm the late Musa Yer-Adwa He walked on his farm for many years So he had this passion for agriculture and I remember at some stages an advisor to the program minister of agriculture and I recall that more than once Musa Yer-Adwa had committed huge amounts of money to build silos So that they will be guaranteed prices for farmers for certain crops You know that will be bought and kept in those silos so that during times of shortage They would be released in order to cushion of extreme volatility in agricultural prices and Guaranteed income for rural farmers so that they have incentives to continue to produce and to grow more food Unfortunately, I don't know what became of that project after President passed away and here we are with the president who is more interested in cattle Well, he's a cattle farmer himself. He's full learning or so they tell us and so they have different priorities And agriculture is suffering the insecurity in the rural areas He's undermining agriculture. In fact, some people fear that this year we might face the ugly situation of farming and hunger Especially that the rains have been a bit temperamental and in many especially the savannah of the middle world a Lot of farmers are very scared of going to their farms They are being killed and maimed. They are to and maimed their wives raped There's a kind of unprecedented violence in the rural countryside. I grew up as a Missionary boy myself in a village where my father was evangelist so I understand the dilemmas facing farmers in the rural sector and We neglect that sector at our peril because a great nation requires food security That's Dr. Melafia. I will come back to you, but quickly we want to tell our Viewer to join us. You can watch this democracy day special live on our YouTube channel plots TV Africa lifestyle. You can also join the conversation That's you can join the conversation by sending a whatsapp and also make your phone calls the numbers are reaching on the screen You can get more insight on this conversation Please join us if you need to leave your house, and you don't want to miss anything you can continue that With us on our conversation. Thank you so much. So Dr. Melafia talking about Let me use the buzzword that we'll be using from different successive generation Diversification which is what she talked about but as we speak let's fast forward to our current reality We're talking about the ICT. We're talking about the pharmaceutical or call it helps that is trendy now Like they describe data as the new black oil and as we speak we're talking about Twitter being banned We're talking about listening to the president this morning. He said the two drivers of Insecurity Coating him now or poverty a huge unemployment So, how do we stay with the trend? How do we maximize this ICT that we seem not to be doing Nothing or little about it. Well ICT can also be a driver Poverty alleviation if only we could do it the right way Some of us condemned the burning of Suspension of Twitter. I think it is misguided. I think it is a wrong policy And above all it sends the wrong signals So the signals that Nigeria is a very insular Narrow-minded and inward-looking country that that is not open to the rest of the world and certain the wrong signals that we have a government that is determined to repress The liberties of its citizens particularly of young people who use Twitter a lot Who in fact even use it for business, you know Set up information systems for clients and they're paid for their services Where we are told that the laws the suspension will cost us something like over a trillion Naira a year. I Mean, this is 10% of last year's budget of 10 trillion. So I'm very worried about this We should we want to be a scientific country want to be a forward-looking country in the United States of America Donald J. Trump Said tweeted in a manner that Twitter did not like Twitter found it threatening and Twitter banned him He is the most powerful You know leader in the whole world Commander in chief of the most powerful country on earth Donald J. Trump Was not foolhardy enough as to ban Twitter and I don't see why Anyone in this country should ban Twitter Because he was not happy with real suspending at the expense of 200 million of his own citizens It is not only misguided. It is wrong and it is despotic in nature and carrot That's what may laugh yet. Just before we wrap this segment up. I'm very curious I want to ask because I know that you're a very big critic of Governments including this government, but I want to ask if you were seated on the same table I remember under the good luck And under the Basantra administration if I'm very correct, we had a coordinating Minister for the economy which helped you know to Probably set the economy on the right, you know direction even though at that point we had our own problems But right now we're not necessarily sure where our economy is headed but if you were opportunity to sit on a table with the Economic committee or the the minister of finance What ideas would you be giving? What should we be dropping off these strategies? If there's even a blueprint for our economy under this administration What would you be advising them to focus on they have two more years and and of course Nigerians are already tight They've all over tightened their belts because of how bad the situation of things are because people's take-home pay People's take-home pay no longer takes them home What would be the idea that you would give in the interim that could help Nigeria's tear our economy in the right direction? I do not know whether my response will be useful in this regard. I don't think it will be Because we are dealing with people that are totally incorrigible They are unteachable They are not interested in anybody who is not of their come I am not a Muslim and I'm not a fuller and so I don't think they want to even hear the views of people like us I don't want to waste my time. I don't want to waste your time And but let me make this very important point. You describe me as Somebody who is a critic of the government. I don't consider myself like that at all and I've never packaged myself like that you know there are Nigerian politicians that if they are not in power or they don't have a position It is their stock in trade to be attacking everything being done and to be criticizing and when they're given a position They shut up immediately Look, I am not that kind of person through my education My my faith My intellectual convictions.   I think you've succeeded in letting us know that You shouldn't describe you as a critic of government and I wish that would allow us to listen to you on the way forward We never can tell what your advice might be to maybe not this government Maybe succeeding of me just for the test of time, but I'm so sorry We have to wrap up this particular Fantastic ideas. I have great ideas and I have a master plan. I think we would do that on our conversation Man them this country my vision. Let me tell you my vision is to benchmark Nigeria against Germany Not even Britain Britain is too small I want to benchmark Nigeria with Germany. That is the standard I've said for myself. Thank you. Dr. Milafia. Thank you so much We have to go well as Thank you very much. Well as we continue our democracy day special plus TV Africa's Jacinta or Buickle went to talk to a set of people born after 1979 Millennials and Generation Z's. This is her report


Oh, we figured that out. Yeah. Low talking does nothing on this thing. So recording going already? We good? All right. Start the timer. All right. All right. Good afternoon. Thank you guys for joining me today. My name's Phillip Bailey. I've been working for Red Hat for about two and a half years now on the Ogret Project. As the primary, you can read that as the only front end developer for the SLA team, which handles the maintenance of the host engine feature for Ogret. This presentation is going to focus on the rewrite of the hosted engine cockpit wizard. And don't worry if you don't know anything about the project or have no idea what I'm talking about. I'm going to go over all that in just a moment. I want to point out I don't consider myself a UX expert at this point. I don't really know that many of that could, because it's still a very new field. I consider myself an avid proponent who's lucky enough to get to work with it for a living. I learned a lot in the midst of this project. I pretty much drove this by myself. And when you do that, you have no choice but to put yourself up by the bootstraps. So I learned a lot, and I just wanted to share a little bit of what I learned during that period. Hopefully you can get something out of it. If not, enjoy your post-launch nap. But first, let's take a quick look at what we're going to cover in this presentation. So let's take a quick look first at all the projects that the wizard touches. It touches a lot of different things. And then we'll look at the definition of user experience in the context of this presentation. And a few guiding principles that help guide the decision making throughout the overhaul process. Following that, we'll look at a few of the important tools that we use. And then we'll finally get to the meat of the presentation and look at some of the drawbacks of the old wizard and then how we fix those in the new. My main goal for this presentation is just to demonstrate that providing a good user experience comes down to details and making a bunch of small decisions. And there's a lot of solid open source tools out there to help us in achieving that goal. So let's go ahead and jump right in. We don't have a lot here. How many here have used OVIRT in any capacity? OK, good. I'm actually going to teach something. Oh, we've got two. Sweet. How many have actually installed OVIRT using the command line? And how many have installed it using the Cockpit Wizard? None. All right, great. OK, so for now, we'll go and go through all this.  You're going to hear a lot of names of different projects throughout this talk. And I just want to make sure that you don't get lost on me. So we'll start with OVIRT. OVIRT is in the upstream version of Red Hat Virtualization. It's an open source, enterprise grade, virtualization solution. In other words, it allows for the management of the major aspects of a data center environment, which include your physical host, your storage, your network, all that jazz. But most importantly, it manages virtual machines. And the OVIRT engine is the brain that keeps all of that working in harmony. It's responsible for scheduling your virtual machines, migrating them when they need to be migrated, restarting them on a new host if their existing host fails for some reason. So now if you wonder what happens if the host that your engine is on fails, everything comes to a screeching halt. So that's where your hosted engine comes into play. It's the critical component in assuring the high availability of your resources. And it's the result of placing that engine into a virtual machine of its own. And then if that host goes down, that virtual machine starts up on another device or another host. And this is a gross oversimplification of a very sophisticated problem. If anybody cares, there's an older talk by Daron Fedeuk about the chicken and egg problem the host that the engine presents. I recommend checking it out. It's on YouTube. So next up is Gluster. It's a powerful open source and scalable network file system that allows you to set up a distributed network solution using off-the-shelf components. And it is, of course, the upstream version of Red Hat Gluster Storage. Now when you put together a hosted engine installation and a Gluster Storage base, you get a hyper-converged infrastructure that relationship plays into some of the work that I needed to do in the wizard. So just keep that in mind going forward. Now Cockpit is an open source, browser-based server management platform. It's aimed specifically at system administrators. It simplifies server management by allowing you to handle common management tasks all in one place with a nice interface and nice dashboard to keep you up to date with what's going on in that machine. Additionally, it provides a plug-in infrastructure that lets you make custom modules, and that's what we use for the hosted engine wizard. All right, so that injured crash course. So let's talk a little bit about what you're here for, UX. The term user experience is a humongous buzzword right now. It sounds fairly self-explanatory, but the UX world is already very big, and it is growing quickly. And so the exact definition and interpretation you get of the term user experience differs depending on who you're talking to. So we'll go ahead and nail it down a little bit for the context of this presentation. So I'm going to use the basic definition by the International Organization for Standards. It seems very simple at first. It just tells you that the user's experience is defined by the perceptions and responses that come about for not only using the product, but also from its anticipated use. And the first time I read that, I had to stop and think about it. And then I started thinking about all the things I hate to use. Everybody has some app or product that they just absolutely hate to pull up and tap to use. And it became much clearer to me why that's a piece of user experience. Now to emphasize how deceptively simple this definition is, I want you to check out the additional clauses that the ISO tax onto their base definition. It's extremely daunting when you consider the scope of what goes into making the user experience. And on top of that, to further complicate it, there's no singular checklist of items or best practices that we can follow that will guarantee a foolproof user experience. It's just not that simple. As much as we love a definitive source of truth in the development world, it just doesn't exist at this point. But just because there's no guaranteed path for US success, it doesn't mean that we have to stumble about in the dark and do trial and error to figure out what works. A lot can be accomplished just by following a few guiding principles. So let's talk about a few of the principles that, even though they weren't explicitly stated in the process of developing the wizard, they developed organically throughout the development process. And they were distilled from things that were continually repeated in one form or another. You just keep hearing the same things over and over during meetings. So the first principle emphasizes consistency, which is a critical factor in providing a positive user experience. If elements look the same and they behave the same, it helps the user to know what to expect when they see that same element reappear in other parts of the application or other applications if you have a suite of them that share the same type of interface. The human brain just excels at pattern recognition. Whether you're aware of it or not, your brain's always looking for common patterns to provide information about the state of the world around you and then how you should react to that state. So consider, for example, a stoplight. You're driving down the road, you see a stoplight, your brain automatically considers what the state is and what you need to do. What color is it and where is it placed? Where has that light lit up? So if I took that color away, you'd still know what to do because you know which light is illuminated and because it's always consistent, it's always the same.  But if you went to a different country and they had different colored lights or a different orientation of lights and nobody told you what to expect, you're going to have no idea what to do. Your brain will automatically start trying to figure out what it means and watching other people and seeing how they respond to it, but until that happens, you're going to be a little bit lost. The second kind of principle is around assumptions. And we all know the old phrase, OK, well, maybe don't, because that's an assumption. So there might be somebody here from another country and they don't know what that idiom means. And I'm not going to go through it here because I'm going to keep this clean. But I wanted to call this label or this principle never assume anything. But that's impossible. You always have to make base assumptions at some point. It's not feasible to cater to every possible user situation. There are a few common assumptions that cause trouble.  Or they'll be able to figure out what it is. They simply come about when you're trying to be lazy. You don't want to fix it. You know, the little thing would make it that much better, but you just don't want to do it. So when you hear those types of things, those are red flags. It should caution you to stop and take a look at what exactly we're talking about and what can we do to make that foolproof and concrete so that user always knows what to do. The final kind of principle focuses on simplicity. It's time just appropriate to have a cluttered and busy user interface. If you have a dashboard that's displaying information, it's just meant to be taken in in a glance. That's fine. That's one thing. You don't want to overdo it, but it's OK to have a high density there. But when you have a user conducting a task, such as filling out a form or selecting settings, it's typically better to just reduce the clutter where you can and make it a lot easier to see what's important, because this will achieve two goals that often creep up in UX design. It reduces the cognitive load on the user by removing all the distractions that would take additional time and brainpower to filter through, and it highlights the steps that you want the user to perform and the path that you want them to take through your application. You may have heard the old adage before, a good craftsman never blames his tools. But I've never heard a craftsman turn down a good tool when it's offered to them. The tools we use have the ability to either increase our capabilities and productivity or to diminish them, which makes choosing the right tools an important step. And I didn't have much choice in the tools I used for the wizard, but I have zero complaints about the ones that were chosen for me, and we'll take a look at those now. The first tool is what I consider a complete game changer in terms of UX design, a design language system. Some of you may be familiar with the term, others may not, but you've probably all seen components of one at some point in time or another. A design language system provides an established set of principles and patterns that guide the design and development of an interface. It's a toolbox in and of itself that can help drive consistency across a single product or all products in an ecosystem. Additionally, it benefits individual designers and developers by answering questions such as what type of button or font or notification should I be using here, or what should I show if there's no data to populate this given dialogue. But don't get locked into the idea that a design language system has to be the be-all end-all if it's being used. I've seen that happen multiple times in the course of this project and the others that I've been working on, and that's just not the case. When it comes to user experience, it's next impossible to account for every possible situation and every context in a system. But in my opinion, it's better to consider the design language system as a strongly preferred guideline and then deviate from it when necessary. Just make sure that the conditions for deviating are given strong consideration and that the deviation provides an observable increase in the end experience. In other words, don't just change the color of a secondary button just because your favorite color is orange and you think it looks cooler that way. So the existing design language systems can be adopted that are out there. There are several companies have made them for themselves and open sourced them. Use it as a base, extend it, modify it to fit your project. Just make sure that whatever changes you make or being given sufficient consideration and being made for the right reasons. So as design language systems go, pattern fly is the one of choice for a lot of open source projects. It is itself an open source system sponsored by Red Hat. It provides all of the previously mentioned benefits and more. It provides a style guide that explains when to use certain patterns and why to use them, which is extremely helpful. It links to research when it's available. It also provides code for most, if not all, the elements in their pattern library, which is very helpful for the developers. It offers CSS files for styling, libraries for both Angular and React. And I highly recommend checking out the pattern fly react library if you are reactive. They have a storybook available for those that know what storybook is. It's a great way to get an idea of what's possible with a collection of components. The URL's here. It's not very memorable, so you can find it either on the pattern fly react GitHub page or just use Google. That was a good testament to how a design language system can promote consistency between products. I want to show a change that was made recently to Ovir. But first, take a look at the images here. From left to right, we have OpenShift, Manage IQ, and Cockpit. They're not exactly the same, but they're consistent enough that you know they belong together. And if you've used one, you'd fill a home in any of the others. Well, not too long ago, this is what the Ovir UI looked like. It obviously stood out among its siblings. But luckily, in version 4.2, a guy named Alice Wells redesigned it and recoded it to be pattern fly compliant. So look at her now. Fits right in. It's that simple. Just follow the guide. The other major tool that helped considerably was the UI library, which is React. The plug-in infrastructure dictated the choice. I definitely didn't mind it, though. For those who don't know, React is library developed by Facebook for creating user interfaces due to its component-based nature. One of the many benefits it provides is easy reuse of existing code, which was very beneficial for me in this project. And now with all the plaminaries out of the way, let's take a look at what we started with. What once was. So in Ovir at version 4.1, there were two primary ways to install it over at hosted-in and set up. There was the command line installer, and then there was a wizard, which was also provided as a cockpit plug-in. The problem, however, was that the plug-in was essentially the command line interface wrapped in the cockpit GUI. I'm sure there's at least one person out there thinking, oh, what's wrong with that? Yeah, we all have our command line, but what's the point if we're going to put it into a GUI? We can always go back to the command line. So from the user's perspective, there was really no advantage to using it. You answer the same exact questions in the same exact order using a text box for every single input. And I want to point out this wasn't anybody's dream or vision of what this thing should look like. This was obviously the result of prioritization and constraint on resources. But it's OK, because it gave me the opportunity to breathe some new life into it. From the US perspective, there are a number of drawbacks to the approach of wrapping a command line in a GUI. I've listed a handful of the more significant offenses here. And we'll look at these one by one in a moment. But in the end, the major takeaway for me was that if the user wanted a command line experience, they'll use the command line. Little or nothing's gained from emulating that experience in a graphical environment. Now, one of the most troubling problems with the old wizard was the poor transition between the cluster wizard and the hosted engine wizard. Remember that hyper-converged infrastructure thing I told you about? We want to push it. We want to make it available to the user. So this occurred when the user installed a hyper-converged setup. They would first go through the cluster wizard, set up their storage, and then it would push them into the hosted engine wizard, which is on the right. Now imagine for a moment, the user's reaction going from this on the left to this on the right. I'll take a moment. But this is what I figured it was like. And as I said before, a good user experience is all about the details. Each of the items on the list doesn't seem like it would make that much of a difference on its own, but you put them all together and you have a pretty miserable experience. So let's take a look at the new design and how it solved each of the problems that were on that list. So here's a couple of screenshots of the new wizard. At the time, the pattern fly rat library did not have a wizard component available for me. Luckily, the original author of the cluster wizard had created one based on the style guide and using pattern fly CSS. I was able to use it, which heavily accelerated the starting phase of the project. And the pattern fly rat library has since been updated, so they do now have a wizard component available for you to just plug in and go. And they have a lot more available as well. So let's look at how this design solved the problems. One of the drawbacks of the old wizard was that it appeared as a never-ending stream of questions. The user had no idea how many questions they needed to answer before they reached the end, unless they had used the wizard before. But even then, due to the state machine nature, the back end that was driving that wizard, if they answered any question differently, they may end up with a completely different set of questions. So it still didn't give them a good gauge. And the new wizard solved that problem by splitting the fields into distinct steps that are clearly marked on a status indicator bar visible at the top of the modal at all times. They always know where they're at and where they're going. The next drawback on the list was that the related fields weren't clearly grouped. Grouping-like items is a natural behavior, and our brains like the order that it brings. So it just made more sense to group the like fields and place them into steps, whose title indicates what type of information can be found there. So it's easy to go back and change something if you need to. It just makes it easier to scan the information for errors as there's less context switching for the brain to do. In the old wizard, each item had to be explicitly confirmed one at a time, which became tedious. The new wizard presents the fields in a given step, pre-filled with all the default values up front. So the user only has to enter any desired changes or fill in any empty fields. But aside from that, they can just review all the inputs in one scan, and then just move on to the next step. After they complete all the fields in the old wizard, the user was presented with a review of the information that they had entered. But if the user discovered an error, they couldn't just go back and edit that piece of information and continue on in the process. They had to completely close out and then start back over again or feed in an answer file. And it's miserable. So in the new wizard, the user is still presented a preview of all the information that they entered, but they can go back and edit the fields as many times as they want before continuing on to the next step. Now, as I mentioned before, the previous wizard used a text box element for every input, regardless of the type of data being entered. There are definitely situations where a text box just doesn't make sense as the input element of choice. I mean, imagine a huge list of things that you can't remember all the different time zone codes and all that kind of stuff. So why would you give somebody a text box to enter that information? In the new wizard, various element types were used based on the data being collected, making it easier on the user to enter the information. But more importantly, it reduces the likelihood of errors. The old wizard was limited in the way it could validate information talking about errors. The user would first have to enter information, then they would submit it, and then it would tell them if there were any errors. But the new wizard, they would validate certain types of data such as email addresses, IP addresses on the fly. It can also prevent the user from entering numerical values such as port numbers outside of specified ranges. The ability gives the user more actionable feedback more quickly, providing more robust validation experience in the process. The new wizard also allows validation of all the fields on that page when the next button is clicked. We've all come to expect this type of behavior from a form. So again, we're giving them some consistency. All right, so we've got a couple more of additional changes that were made that just overall helped the experience. On the left is the original landing page for the plug-in. It's not terrible. But a couple of small changes made it that much better. It just falls under the Assumptions guideline. Don't assume what your user knows. Just assume the least common denominator if you're assuming anything. So in this case, we added some distributive text under the buttons to tell them exactly what to do. I know it's small and it's kind of hard to read. But it just kind of gives the user a better indication of what's going to happen when I click this button. What am I going to do? And that's always important. We also added an exit confirmation dialog to prevent the user from exiting the wizard prematurely, which, again, was an assumption issue. I didn't think that that would be a problem. When the button says close, you expect that they know if they click the close button that it's going to close. But it's just something that actually I found in use works for myself as well. We also found out that if you hit the escape button, it would accidentally close on you. So imagine the other process could make you pretty angry if you hit the escape button by mistake, and it just disappears. So this was a very small change again, but it made a big difference in the overall experience. Now, shortly after I started development on the wizard, I found out that the back end that was driving it was being rewritten from a Python script-based back end to one this Ansible-based. And the most important thing was that it was going to go from being able to handle everything in one shot if I just gave it a list of all the values, just running it in one swing to I had to do phases. And that completely changed the look and feel of what this thing needed to do. Patternfly saved me because they actually have a pattern specifically for this situation. So I was able to go in there, look at their styling and their code, and retrofit the existing React module or component to handle that. And then they changed their mind again and made a two phase approach. So this is not the wizard we have now, but this was a nice interim stop in the middle. But it just goes to show that having that library there saved me a lot of time without having to worry about figuring out how to do it myself, because I probably would not have ended up with anything this clean and nice. The plugin sells a lot of room for improvement. There's a whole list of changes yet to be made, but that's OK. As with other areas of development, UX is iterative. You're always going to find areas that could be better if you don't. Your users will find them for you. So don't worry if you don't see them yourself. But what's important is that you're actively trying to improve the user experience of your projects. Second major takeaway from this is the small things do matter. If you neglect those small nitpicky issues, it's going to affect your user's overall experience. And we should all know this one by now. Do not recreate the will when you don't have to, especially if your experience isn't in designing wills. And I'll leave you with that. Thank you very much. Any questions? Sorry, oh, thank you. No? All right, awesome. Let you take over. Hello, hello. Can you hear me? How low is it? Is that low? I can kind of hear. It's not sensitive. What's that? Put it really high on the collar and then just speak loud, but that should be OK. Hello. Can you hear? Not really. It's not captured. Where'd you put it on? I didn't see it, so. You put it right here. I buttoned my, yeah. You had to bite it. I buttoned the top button, but I forgot about it. Oh, OK. I really want to hear your presentation, but I have to take him to eat something because we didn't get much, and he's going to kill me if I don't feed him. I'm not the catchers on YouTube, so I really wanted to hear it. I love good technical documentation.  Yes, oh my gosh. And now I'm trying to teach developers how to write. Hello, kind of sorter. Hello, hello. Yeah, that's good. OK, so here, you can take this, and I don't want to risk HR, but I like to just put down your belt, or your pocket, and you got everything up there. Yep, everything is good. I think it's good. This is Libra. This I'm using well. Yeah, Libra. Yeah, yeah, I like it. I do like it a lot. That's why I wanted to use my computer. Yeah, the speaker notes. I know you're like, OK, I carry it, yes, yes. I put my glasses on. I was like, oh man, I really Yeah, yeah, yeah, so this is good. All right, thank you. Yeah, after this, I can relax. You're on rail, you gotta be. Who said? I know, that was me. I was like, can I go home? I hate to hate to I can relax.  Last time I've been stressing it, because I'm the type of person I'm going to keep working on something. Yes. To make me turn to the end. Yes, yes. And then you're pulling up my fingers, but, you know. Right. I'm just going to do it on Friday morning and then I can just go to my house. Yes, that's what I was saying. I know. So the next time you expose day one, because we got stuck. That's right. All right, I think we're in your timeframe. Yeah, okay, nice meeting you. Nice meeting you, Phillip. Sure, long time. Yes. Where are you at? Where are you based out of? In Raleigh. Okay, me too. Okay, yes, yep, on the tower. Yep, the 11th floor. I don't have a problem, but I need excuses to go to the tower. Yeah, that's right, we do the tower. Yep, that's right.


So, today we're out doing practical training exercises. We're doing, this morning we did a chemical operations, so our team is tasked to respond wartime scenario and going out and resolving an issue that involves chemical ordnance, chemical agents, and trying to defeat the task at hand. And then, this afternoon we're running a UXO, unexploded ordnance problem. We have a couple guys that are in upgrade training, so they're trying to get their certifications. And so, they have to run through several problems in order to do so, unexploded ordnance being one of those, usually the first one. We have a partnership with the 149th, where we go out. They have a training bird for us. They load up different armament systems, and we create a problem like a hung gung, hung flare, hung ordnance on one of the pylons, and our team members are tasked to resolve the issue without any major safety violations.


Ladies and gentlemen, very warm welcome to 126th module, where we are going to discuss about the purposeful innovation. What is purposeful innovation? This is very much important stress able point. What is purposeful innovation? Innovation is innovation, is it not? Anything I mean discovered anything I mean never mean heard is innovation or anything new process comes in your life or new comes new process comes in your mechanism or in a machinic view. So that is what we call it innovation, is it not? So what is purposeful innovation?  So, here we have talked about innovation is a specific instrument of entrepreneurship and then innovation indeed creates a resource. And they are getting into research but it was innovation. Every mineral is not a rock. So, if the same whole just as true in a social and economic sphere there is no great resource in an economy than the purchasing power. Here I want to give you an example of Moccamon. He was a man, Macaron Maccommon, like in Pakistan, 136 trillion, if we are going on the decreasing side then we will have to boost the economy and how will they do it? We will do it with this innovation. What is the innovation that I am talking about? Okay, with those farmers, Macsab, Macsab did what? They attached banking channels and banks gave them such a loan which was specific to machinery. I will tell you one more thing. Like we are talking about targeted, you do give the targeted loans. For commercialization, I want to give the best result of today's century to bankers that targeted loans are the things that you will buy. Otherwise, they will be bought in the name of the loan, they will take it in the form of a loan, they will pay for the loan and then in front of you they will show you the loan or not. So by useful knowledge is that you have seen, you have given specific targets, you have given the tractors, you have given the machinery, you have given the tools to run the mill, the result is that the farming has increased significantly. Now what happened here? I added the fund. I told you that when you add the fund here, then your purchasing power increases.  They are moving on to the management that is useful knowledge. Is any knowledge useful? Now this is the biggest question ever. Therefore the 21st century is my biggest problem at this time with all the youth is that they always ask irrelevant questions. There was a time when people used to ask questions. About 10 years ago, they used to ask questions where the mind opens.  Unusual knowledge is taking you, you simply say that this is not my subject. If you are sitting at your back of the car, driver is driving the car. If you are sitting on the brake, on the clutch and on the movement of his hand, you will keep an eye on him all day and then ask him to drive a 400 kilometer car. So you will be more tired of him. The job of a driver is that you will be tired too.  The useful knowledge for you is that you have rest at that time and the next time your work, your movement, you go according to that. That you have to be focused. I am going to give you a last example for today. Now, you have to put a blinder. For example, you might have seen a horse in a race. You can't see his right and left. Because his focus doesn't come from here. When his focus doesn't come from here, he will only focus on his speed and he will apply the same knowledge every time. For example, he thinks that he should increase his speed a little bit and if I go at a speed of 1 kilometer, then I will slow down a little bit and then I will take more paths. So this is called useful knowledge. In your area, in your farming, if you are farming, then talk about the relevant part of farming. If you are making apps, then talk about the relevant part of the app. If you are making things, then talk about the relevant part of the things that are the subjects of your life. If you have filled your life's jug with countless anchors, then your priority stones are not being adjusted in it. This is what he is saying. He enables man for the first time to render productive people of the different skill and knowledge working together in an organization is an innovation of this century. Thank you very much.


Hello, everyone. Welcome to Cloud Native Live, where we dive into the code behind Cloud Native. I am Annie Tavasto, and I am a CNCF ambassador, and I lead marketing as Vision, and I will be your host tonight. So, every week, we bring a new set of presenters to showcase how to work with cloud-native technologies. They will build things, they will break things, and they will answer all of your questions. So, you can join us every Wednesday to watch live. So, this week, we have Jesus and the Center here with us to talk about Prometheus plus Falco, the Swiss Army knife for SREs. Excited for this. So, as always, this is an official live stream of the CNCF, and as such, it is subject to the CNCF Code of Conduct. So, please do not add anything in the chat or questions that would be in violation of that Code of Conduct. So, basically, please be respectful of all of your fellow participants as well as presenters. But with that done, I'll hand it over to our speakers to kick off today's presentation. Well, hi everyone. Thanks for joining us today. And in this session, we are going to show you how we like to bring Falco into Prometheus, to have Falco insights in our Prometheus metrics. And we are going to start almost from scratch. So, this session will be easy for almost everyone. So, well, we've already introduced, so let's get ready for the agenda. Vicente, can you start showing us what's Falco? Why are we here? Yeah, we are going to talk about Falco. Falco is a threat detection engine. And what it does is, it listens to all the activity that happens in your system. And it has a set of rules enabled. So, those rules are basically a set of conditions that are going to be matched. And when something triggers anomalous behavior, Falco is going to send it out. So, that's what Falco does in an art show. It does a lot more. But we are going to go into more detail in a second. So, can you move to the next tab? Sure. Thank you. So, what does Falco do? That's exactly where it's cracked, right? So, it's basically listen to system calls. And system calls are necessary to let the processes talk to each other. So, everything has to go through the kernel. Then it matches all the information that comes from those system calls and compares them against a set of rules. So, the moment that rule is violated, let's say someone is trying to open a file that shouldn't be accessed, then it triggers an alert. We are going to see the process throughout this session. And we are going to see how that integrates with Prometheus. So, Falco is able to check for privilege escalation, for name spaces, access for access to read or write into files or directory that it shouldn't, and so on and so forth. So, you can see a list of all those conditions in the website you have right in front of you. You can access that through Falco.org. That's the documentation website. And we are going to see now what those rules look like. Very, very simple, very easy. Can you go to the next tab? Sure. So, I ESO you are sharing the link. That's great. Thank you. So, those basic elements of a Falco rule are unidentified. That's the rule ID. We have a description just to tell the maintainer what that rule is doing and the important bit, the condition. So, in this case, we have a system call called XPE, which basically starts a new process. We compare whether it's coming from the calling the call or from the return of the call, then we compare that that happened in a container. Falco can work in traditional servers, but it has very good features when it comes to containers. So, we can tell you in this node, in this container, something anomalous happened. You don't need that if you don't have containers, but if you have them, it's absolutely amazing. And finally, we compare what kind of process we started. So, in this specific rule, what we did is to observe that the shell was started in a container. Something that, well, it could happen. So, we could filter those rules out, but issue them. So, that's a very, very typical rule that we monitor using Falco. There are many more. And we are going to see a couple more in a few minutes. What happens when a rule is triggered? Well, we need to advise anyone. We need to tell anyone, hey, this rule has been triggered, and we need to decide how we want to do it. So, Falco has different channels to do that. If we go to Falco Alerts, we can see that we can send it to the standard output. That's good for monitoring, but not very, very useful if we are doing an automated monitoring. We could send it to a file, which is like, yeah, I'll keep them here, and later I can observe them. But the interesting bit is when we send it to somewhere else, we can send it to an endpoint like Falco Sidekick. It's a project. We are going to talk about it in a moment. Or we could send it to another program that does something else. That's up to you. You can choose what you want to do with those alerts. I'm going to show you very, very simply how to configure the HTTPS endpoint. So, if we go to Alert Channels, here you can see that we have the standard output I was mentioning before. We scroll down. We have the file output. If we keep scrolling, Azuz, can you do that for me? Sure. Thank you. So, the syslog is also a traditional way to put those alerts. Keep scrolling, please. I just want to reach the HTTPS endpoint to show them how we are going to configure in this case to use Falco Sidekick. There we are. Very, very simple. We just indicated we want a JSON output because that's going to be enriched, and that we want to send it to HTTPS endpoint. This endpoint is going to be, in our case, a Falco Sidekick binary that's going to be deployed with the same instructions that will deploy our Falco infrastructure. And that's simple. We only enable that, and we set the URL to the endpoint. Very, very easy to follow. Just a bit more information. If we open the Falco security, yeah, that's the Falco repository. We have access to all the repos here. You can see the contributors on the right. There are many, many projects. We are going to talk about a couple of them. The more important for this session. So, in the next one, we can see we have the charts which are used for deployment. And the last one, we are going to skip the middle one for a moment. Yeah, that's going to be Falco Sidekick. That's going to be also automatically deployed through the charts, right? So, the last chart, the last tab I wanted to show, the Falco rules, contains all the rules that we can monitor with Falco by default. That doesn't mean we are limited to it. That means that we offer already like 80 rules, and you can customize them. We are going to do that through the session. You can extend them. You can delete them. You can disable them. So, there is a lot of flexibility here. Rules are basically macros, lists, conditions. We put them together. We try to make it as easy as possible. And we are going to have a few interesting cases here. So, for the moment, we are going to stop here. Jesus is going to talk about Prometheus. And then we will talk how integrate them together. Okay. Well, I'm sure most of you know already Prometheus. Prometheus is an open source project that allows us to monitor whatever we want to monitor, actually. It's actually the standard for monitoring Kubernetes, but you can use it for monitoring anything you want. But today we are going to use it to monitor Kubernetes. There is a very basic thing that everyone should know about Prometheus, that instead of sending metrics to Prometheus from our applications, just like we did with traditional strategies, what we do is we tell Prometheus where our metrics are. So, it goes to those endpoints to ingest, to script those metrics. So, that's the main difference. So, the first thing we need to know when we started using Prometheus is where, or how, are we going to expose those metrics? So, Prometheus has... I'm sorry. I didn't... Sure, this... Okay. Thanks. Thanks, Vicente. As a quick note, I see a few people asking about the links to the chat. I unfortunately can't send them to the LinkedIn side, but they're in the YouTube side, and that's why you can see them on the screen occasionally for your side. And then someone precious is asking, how can we get the recording? You can find the recording for this session, for example, from the CNC of YouTube. Immediately after the session from the live stream tabs. So, no worries. You can get every second of this goodness later on as well. So, tune in there. Okay. So, as I was saying, applications needs to be properly instrumented to send, to expose those metrics. So, Prometheus Community has an SDK so you can instrument your application in different languages and it's pretty... Not easy, but it's not an impossible task to address. The thing is a lot of traditional, very mature applications aren't instrumented yet. So, in the meantime, the community has created what's called an exporter. So, an exporter is an application that runs along with the application you want to instrument and it gets those metrics. For example, NGINX has an exporter, I don't know, Redis has an exporter, etc. So, the first thing you need to decide when you start monitoring with Prometheus is where I'm going to get those metrics from. So, at Cystic, we have this open source project that you can visit. It's from cat.io and you can search for the application you want to monitor and it will tell you if the application is already instrumented or if you need an exporter, it will give you the home file or the repo to download exporter or the configurations and also alerts, well, the setup guide for example, in this case it's already instrumented, some dashboards, some Grafana dashboards and also some alerts. So, this could be the easy way for getting started with Prometheus. And also in this presentation, we are visualizing all the metrics and the dashboards and the panels are in Grafana. So, we will see that in a minute. So, yes, we set the basis, right Vicente? So, in this QR, you can go to the GitHub repository where we created the demo. I don't know if I can share, sorry, yes, this is the, as Vicente was pointing, Prometheus.io is open source so anyone can use this exporter. So, they are completely open source and no matter that you are not a Cystic customer, you can use them right away in your Prometheus open source infrastructure. So, don't worry about that. Okay. So, in the demo has, I think, it has like two main parts. We are going to install and configure Falco, Prometheus, Grafana, exporters, everything that we need to have in order to do the troubleshooting use cases scenario and then we are going to have this, we are going to have like a scenario to troubleshoot and to learn how we can use Falco and Prometheus together. Okay. So, I'm sorry. Okay. I hope everyone can, I hope the font size is enough. It looks good. Okay. So, we are going to use Homefile, which is a way of orchestrating home commands to have everything in one file. So, we can start as easy as we are doing here. So, we are going to use two charts, which are the Falco security and the Prometheus community charts. So, Vicente, do you want to explain what? Sure. Okay. So, as Jesus said, we are using HelloFile because when we have to deploy several applications at once, that's the easiest way of doing it. We don't have to run one helm installed after each other. So, in this release, in this Falco release, what we are doing is we are using the standard Falco security Falco chart. This is supported by the community and the values we are passing are basically two. One is the TTY, that means that we want the alerts as soon as they happen. Otherwise, they might get buffered. People usually complain, well, I don't get the alert the moment it happens, yes, because you are not monitoring the tool by itself. And Falco side cake in here is the one that forwards those alerts to Prometheus. So, we are going to use two parameters. One to enable that. And the other one is to access the web UI. Falco side cake is based on two projects. One is the forwarder. And otherwise, it's a very nice UI that shows what rules were recognized by Falco side cake UI. And you can filter by tags, you can filter by labels, you can filter by when they happen and so on. Great. There's an audience question. Suppose that I want to monitor my pods on a Kubernetes cluster. Is there no exporter or pod exporter directly usable? Yeah, that's going to be for Jesus. Yes, well, it depends. If you install Prometheus with a Kube Prometheus stack, it's already configured with the node exporter and Kube state metrics, so you're good to go. In other scenarios, maybe you might have to auto the jobs independently. But if you use this chart, you just need to add the Falco endpoint. So, just adding to the question in the Falco chart, we are deploying Falco side cake, which also offers the exporters. So, there is a possibility to monitor Falco with exporters directly, but if you use Falco side cake, they are included. So, it's just a matter of how you want to deploy the tool and what you feel more comfortable using. Falco side cake offers more possibilities than just a simple exporter. And Jesus, I'll let you describe... Yes. Well, this is very easy. You just need to use this chart. This is the home chart that is the target is a Kubernetes cluster. So, you just... It deploys the Prometheus operator, so everything will be running automatically. You will have the node exporter, KSM, the Kube state metrics, and also Grafana and all the tools we are going to use. So, I'm using... We created a vanilla cluster, Kubernetes cluster, and we deployed this chart. So, you are going to see exactly what we are describing here. So, in this case, the only thing we need to add to the chart is an additional scrape config. So, we just need to have a name, the scripting interval, the script amount, where's the matrix path, and the endpoint, which is the service and the port that Vicente just showed us. Yeah. So, basically, what it does is it connects to the service that we have deployed already with the Falco chart, and it access the metrics route. It's going to do it every 30 seconds, and then you will see all that information on our lovely Prometheus. So, we can take a look now. As I was saying, sorry, that wasn't a spoiler. So, now we have Prometheus, and we have metrics from Falco. And also, as I was saying, you can see that we have also the QVest state metrics and the exporter, et cetera. So, right now, we have this and Falco Sidekick UI that gives you a nice overview of the things events triggered by Falco, right, Vicente? Do you want to... I don't know. Walk everyone through this. Yeah. The thing is Falco Sidekick UI is not only... Well, Falco Sidekick is not only for order, it also gathers the information of Falco Sidekick UI. And here, we can filter by the origin of those trigger rules. The priorities, which are the classical severities from a syslog scheme, we have the host names in case they come from a node or from different pods. We have the rules that were triggered. So, those rules were little tests that we were doing. And we also have tags. So, if your rule is affected or is included in the mid-tree scheme, then we can filter by those. Yeah, that's basically what you obtained from this dashboard. But if you go to events, I think we shouldn't show much here, otherwise it's going to spoil the demo, right? Okay, but if you go to events, you'll get a list of events triggered by... It's going to be a list of events with all the information we saw. We can filter there as well. We don't see a graphic. Yes, a list of those. Okay. So, let's go forward. So, in the first version of this home file, we saw that we didn't add anything, any custom rule for Falco, but that will change in a second. So, let's see life. A rule triggered by Falco. Okay. So, we can go to... I don't know. And to next problem. But if I open a shell here, I can go to the rules and I can go here, maybe in the events rules. It's just loading. Maybe we have a lot of things, but... Oh, maybe we just lost the port forward. Give it a second. What's up? Okay. Oh, okay. So, terminal is in container. And I want that alert. Okay. Okay. This is like right now, we had the terminal in the container that I just run in canine. So, that rule is automatically like it's out of the box, right? It's activated by default. Is it correct, isn't it? Yeah. If you look at the time, you can see it's been triggered a few seconds ago. And the source basically says syscalls. Falco is able to detect not only syscalls, but also events from other sources like audit logs, from cloud trade, from cloud watch. In this case, we are keeping it simple. We are monitoring syscalls only. The host name is... I can see the font. Can you just move the mouse on it? It's because of the color. I think the contrast is... Yeah, it tastes... Yeah, well, kind of. It tastes Falco anyway. So, is the container where this happened? And if you look at the outputs, well, that's basically what we had at the end of the rule. We can use parameters here. We can add text. We can add as much information as we want. In this case, it says that the command sh was executed. The container id is in there. The Kubernetes pod is called ngnext exporter. That's the one SUSE connected to. And it even says the PID in the host, in the system, not the PID in the container. That wouldn't be that useful, probably. We could add the information to it if we wanted. And finally, this is also interesting. The image, the container is based on it. Because then when we set rules and exceptions, we would say, I trust those images. I trust those binaries. I trust those hosts. We can combine them as we want. So, that would be the output of an automatically trigger rule like the one I was showing in the documentation. Okay, now we are going to show something similar, but not exactly the same. So, let me... Okay. So, what we are going to do right now is to start a VCbox pod. And then we are going to access it. But instead of doing just an SH, we are going to do VCbox SH. So, okay, now we are inside the... Inside the VCbox. And the thing is you need to trust us on this now, but this won't trigger any alert. Why is that behind it? Well, it won't trigger any alert by default. And the reason is that the shell that we are comparing it to, it belongs to a list and comparisonals like KSH, CSH, Bash, the classical SH. But it doesn't compare with VCbox. So, what we have done is we have extended the previous health file that you saw before, and we have added a new rule. That's the only difference. We created a new rule. We trigger a synchronization of the health file. And this is how the rule looks like. So, if we look at the condition, basically it uses a couple of macros that says we have started up. Yep. Maybe we should... So, what we did for creating this new rule was copying and pasting an existing rule from the Falco GitHub that we showed earlier, and then tweaking it, right, to fit our needs. Okay. Yeah. If you want to open the rules repository, you can find the rule very easily. Just look for the word terminal. I think that will bring us there in a moment. And in that rule, we are comparing with that list of shells. Since we wanted to show this specific case, we have changed that part. So, here, again, it compares that a new process has been started. It happens inside a container. And this is where it changes. We compared that the process name is VCbox. One thing to take into account is that's not going to compare VCbox SH. That's going to compare VCbox. So, every command that comes with VCbox, and for those that don't know VCbox yet, VCbox is actually a Swiss knife. It contains a lot of commands, and it's like a rubber. You call VCbox SH, VCbox FDs, VCbox LS, and it will execute that section of its code. So, it compares that the process name is VCbox, compares that we are doing something interactively. This is important because if the shell is started non-interactively, it will have a different configuration. And, well, in this case, a few more parameters. And, at the end, we have an output that we have customized as well. So, VCbox instance was spoiled. So, how we add this rule? Basically, we have it just scroll a little bit up. Yes. This font is huge. Sorry, I can't do this. No, it's perfect. So, custom rules is a value that we are going to pass to the home chart, and we are going to create a small file called custom VCbox rule.jamo. That file will be created on a config map, will be mounted on the Falco pod, and will be read by Falco. Yes. In the GitHub repository that we shared earlier, you have all the steps that we are going to show. I mean, I'm opening the same repository code. So, you can go there to have the configurations. All right. So, once we are done with the configuration, we should, yes, synchronize the whole file, and it will automatically start. Yes. So, now, we should see that in the here. Yes. Terminal VCbox instance, and that happened a few minutes ago, three minutes ago, and this is exactly the new rule that we created. In that rule, you can change almost everything that it says here. Okay. So, we created a new rule. Now, we had this annoying event that we didn't want to appear in the events that was something related with Prometheus. So, what we did was creating an exception, right? That's the next thing we created. So, we can go to step three. Right. So, we have another file. Yes. Another exception, which basically reuses the same rule ID that we had before. Contact Kubernetes API server from container. That rule already existed. What we are going to do is to extend the conditions to trigger the alert, because we don't want it to trigger when we use a specific image. This is an image we trust. So, you can see the exceptions is a list. The name is the ID of that first exception, and we are comparing three fields. One is the name space where this event happens. The second one is the pod name, and the third one is the image we are using. One thing to remember when we write rules is that if we are very generic, we are going to have a lot of noise. So, we have to be very specific. And if we are too specific, the rule is not going to be triggered and we might be having false negatives. So, in here, we have the three fields, then we have the comparators. The first one has to be the name of the name space exactly. The second one is going to match the beginning of the pod name. Prometheus Grafana, I don't know the rest. And the third one, we use the starts with comparison, right? Exactly. It starts with Prometheus Grafana would be like a prefix. And the third one, the container image repository we are using the in operator, which is an operator that looks for instances in a list. This is why we created a list inside that list. And the image we are going to filter is kibbit grid, kubernetes sidecar. So, the moment this event happens, with those specific conditions, it's going to it's going to ignore the rule. It's not going to trigger it.  So, now let's go to the next part, which is a more or less real use case. So, imagine we have this cluster that we are running things. And we saw that something's happening. If you take a look here, you can see that the CPU utilization has increased dramatically in the last hours. So, we don't know what's happening here. So, we can do some troubleshooting. And, well, it says that something's happening in the default in the default name space. So, what we can do here is having the traditional approach, that approach would be something like going to enemy spaces. So, we have these five pots and something's happening with them. Something's happening with them. They are requesting to some awkward endpoints and calculating stuff. And so, we can do this and we can try to shoot this situation using KSM and going through all this information to end up knowing that this is because of a crypto miner. Okay. We had someone that started a crypto, five crypto miner posts. So, what we could have done instead is using Falco to detect these kind of threats. How? By creating a new rule that detects crypto miners. So, how can we do this? Actually, the rule already exists is in the default rule set. The thing is the rule is disabled by default. That's right. Because, well, maybe people don't want to enable that by default. And if we look at the rules, I know you're looking for it. Yes, I'm in it. A bit lower, scroll down. Keep going, keep going. It's not very long because we use macros. I think it's more or less a bit higher. Yeah, a bit detected bound connections. The first one. So, if you look at the enable field, you are going to see that the rule is disabled. What this rule does is it compares the connections we are doing with a specific list of domains and a set of ports and basically ignores a set of images because, well, those images might be requesting something legit from those domains, right? So, the only thing we need to do to enable that is to reuse the rule ID and change the enable field to true. So, if we look at now at our latest modification on the help file, you can see the rule ID and the enable true. That would be also a way of extending the rule functionality, but we don't use append like in the beginning. We use only the enable field because we are not adding conditions or exceptions. So, that those three lines are the ones that are going to start our rules. And because of how the cryptominer is working, it's going to start triggering a lot of alerts. Okay, so now if we go to the Falco Sidekick UI, which is here, now we can, okay. So, we have like a lot of events. Okay. Detecting this cryptominer. So, now that we have that alert, how can we see it in Prometheus? So, how can we integrate this knowledge, this metric, this information in our troubleshooting dashboards and flow? So, now that we have this, that we have this over here, the first thing we can do is, okay, let's have a look at the events of our clusters. So, we created this dashboard, which is called Falco Events. And in this dashboard, you can see that something's happening. Okay. So, we already know the namespace that is having this CPU utilization increase. So, we can filter here and say, okay, this is in default. So, what we see here is that we are triggering 1.5 events per second of Falco Events per second. And there's only one event, which is this one. Detect outbound connections to common minor pull parts. So, in one simple step, we detected it just by adding Falco metrics into Prometheus and created this Grafana dashboard, which is very simple. But you can see that these events have increased. If you can select all the new spaces, and maybe instead of five minutes, you can last 12 hours. So, you can see that the only detection that we have right now, I don't know why, is this rule, but we should have more, I mean, there would be one line per detection. And also, we have here this table that shows us a workload overview. So, if we go back to the default namespace, we can see right from this dashboard that what are the pods related with this event. So, we can see right away that something that we don't recognize these pod names, this workload, and that would be the cost of our CPU increase. So, now apart from being reactive, we can also be proactive and we can configure some alerts, right Vicente? Let's see how we can do it with Falco first, and then we can do it with Prometheus. You mean configure alerts with Falco side kick? Yes. All right. So, we can go here. Yeah, I would need the deployment for Falco side kick. Okay. So, Falco side kick has a very wide set of options or possibilities. Can you open the Falco side kick repository for a moment? Oh, sure. Yes. Yes. No. So, if you scroll down, you are going to see that Falco side kick supports different chat applications like Slack or Discord or Telegram is supported only in the code branch, but it's going to come out in a few days. It also supports Prometheus. That's one thing that we are using at the moment. It also supports alert manager, page at duty, or you could send it to different logs aggregators like elastic, Splunk and so on and so forth. So, to configure either of those, you would basically give some parameters. So, if you keep scrolling, you are going to see a set a bit lower, more and more. Yeah, a bit more. So, in the Falco configuration, this would be the Falco Jamal configuration file. So, how to tell Falco that we are sending those events to Falco side kick. This is the information I was showing before. And if you keep scrolling down, I just want to go to the environment variables that we use. Keep kick going. Oh, this is the Jamal file, what we would pass to the Helm chart. That's very, very, very large, I can tell you. Or we use the environment variables. That's the one I use for this example. So, yes, when this file ends, because it's really, really big, here we have environment variables like this Slack web hook URL. This URL basically is a web hook configured for Slack. And every time there's a new alert that has a severity higher than the one we define, it's going to send a message to the Slack channel. So, if we go now to the deployment, you will see that the configuration for that is actually very, very simple. We set here the environment variable Slack web hook URL. And then the web hook is based on a Slack workspace that I just created anonymously. And the Slack minimum priority, I set it to alert. Because if you set it to something lower now, you are going to have like, I don't know, 500 alerts from this crypto miner. Yeah, it's going to float your channel. I can show, I can show that, actually. We almost did the DOS Slack earlier. That was fun, too. Yeah, it was fun. Yeah, so that would be a way of configuring FalkoSite gig to send alerts. So, I said, you can use different methods. And what Jesus is going to show is how we use Grafana and... Yeah, in case you already use other manager Grafana and Prometheus, you can also use the other manager to do this. You can see it in the repo, but you can... Okay, we have an alert manager config here. So, you can deploy the other manager with this configuration. Basically, you just need to make the group by and then configure the receiver. This is a disposable email that we created here. And the alert itself, I'm sorry, alert. And this is the alert that we want to use. So, we are going to use this metric, FalkoEvents. And I want to have all the events that have to attack the label priority set to critical. And then I want to have this information for it. It's one of the events. So, if for one minute, I keep getting these events in Falko, then I will be notified in other manager. And the summary is that this critical route triggered and we can use the labels as variables for the message. So, if everything is okay now, okay, we can go here. Okay, I just deleted.  And then I can see that there is critical rule triggered. And if we configure our alert group to send to Slack, Telegram, email, whatever, you'll see that this was sent to the group. And the value, the same value we saw in Grafana. One event and a half per second was being triggered for this, for the critical priority. So, this was everything we wanted to show you guys. This was how we integrated the Falko metrics inside Prometheus and how we used it in a pretty common use case. Perfect. So, I guess now it's starting to be time for Q&A. Good. All right. So, I saw a question that Falko has a rule engine. How does the rules work? Well, basically what Falko does is it captures the information from either source from the syscalls, from the audit logs, from whatever, and it creates a structure, right? That structure is something we can parse, something we can use to filter. And those rules are basically indicating which filters we want to, which fields we want to filter. So, in the case of a syscall, we could say a file has been opened. The name of the file was la, la, la. The process that opened the file was li, li, li. And the moment all that matches, then we have, we have a trigger, right? And we have to be careful how we write the rules because the moment our rule is triggered, then it's not going to continue looking. Otherwise, we could have like 20 rules triggered by this event. Basically, it goes from more specific to more generic. And that applies to anything we want. So, if we have an application that generates logs, we could create a plugin that translates those fields or those strings into fields that we could filter. And we could write rules that don't exist yet for those events, for those logs. And this is what we call Falko plugins. It's a relatively new technology. It's been with Falko for a few releases. And we invite everyone to see how it works, bring their ideas, bring their plugins and, well, bring that value to the community. I think my route has a second question, a bit more interesting. How do we address the never-ending process of writing the rules? That's a difficult question because we have an endless set of sources, applications that we could be filtering. And, of course, the kernel has more syscalls. The Kubernetes audit logs adds more information. So, that's something that's not going to end. We have to be watching our rules. We have to remove false positives. We have to be careful with false negatives. And the latest release of Falko has added a new functionality, which is a way of distributing the rules as an OCI artifact. What is that? Well, an OCI artifact could be a container image. Well, we use the same technology. We put the rules files inside something that looks like a container image, and we store them in a container registry. Falko CTL is a binary that comes with Falko and is able to observe when there is a new version of the set of rules and downloads the rules automatically. Falko is going to realize of that, and it's going to reload those rules. We expect that more people are going to start distributing rules by now, and we hope that it helps to have a more varied set of rules. We don't have a specific case at the moment, but that's going to open a new wall of possibilities. Great. There was a few other questions as well. I think Internet Guidance asks, do you have a multi-window, multi-burn board like Loth provides? Jesus, do you know anything about it? No. I don't know about that. I guess you are referring to having multiple views, different troubleshooting views in a dashboard. I think Grafana doesn't allow that, as far as I know. What you can do instead is creating link panels to go from one panel to another. The other thing we did here is as I usually are going to need some overview on the workloads, I created this panel over here. This dashboard is in the GitHub repo. Just for your information, here you have the JSON that you can import into Grafana installation. I wrote this query to have all the information I needed, the pods and the workloads and the enemy spaces. With this variable over here, so with just one click, I can change the scope of the dashboard. As far as I know, you can have multiple dashboards in one view. Yeah. Then Ricardo asked, is there a base set of rules out of the box to use for determining security posture or Kubernetes cluster? Very interesting question. There is a set of default rules, but we have to take into account that Falco does runtime detection. It's not going to give you the secure posture of your cluster. That's not something that you find out when you execute your workloads. What Falco does is it goes to one step later, after you have already scanned your images and hardened your system, everything is running, but something could happen. Your workloads could be attacked. Your image could have been compromised, and the scanner didn't realize. In random security, what we do is we monitor what happens during the execution. This is why we wouldn't use Falco for secure posture. The set of default rules as Boniface said, the Internet Guidance, it's there. We receive a lot of new rules every year. The community is contributing. It takes time to vet them. If you want to contribute as well, feel free to join to review the rules with us. We are really, really welcoming people to do that. Great. Then there was a question from Boniface who asked, what is the advantage of using Falco instead of Elasticsearch? Elasticsearch is an aggregator of logs. It gathers everything that is sent to it, and then we have the possibility of searching. The problem that it has according to Falco technology is that you have to gather the data first, and then you can start looking for patterns. It's very good to keep track and look for what happened after it happened. However, Falco, as I said, it's random security. It detects the action when it happens. If you want to keep that information, want to send it to Elastic, perfect. That's a great idea. But what we do is we detect as soon as it happens, and we call that stream detection.  This is something you wouldn't be able to do with Elastic. In Elastic, you have a record of the events of the logs, but with Falco, you have instant action. Great. I don't see any questions other than these so far. We have a few minutes left, so if anyone is typing away and trying to get a question in, do you so fast? This is the last call for questions. While we see if anyone is typing away, do you have any final words, anything you want to add? I think I already said that we are a CNC project. As most of the CNC projects, we are constantly looking for contributors. It's a project for everyone. I think everyone can use it in a very useful way. If you guys like this technology or you find it useful, just come to the Slack channel or attend a community call or ping us. Any mean, just go to falco.org slash community, and you can find a lot of means to connect to us. We are always welcoming people. Either they could be the commutation contributors or they just want to know more, they just need support, whatever. They are always welcome. Perfect. I think those were really, really important call to action. Everyone should go ahead and join in. While that important reminder was happening, internet guidance asked, I think pretty much the final question of this at this time. They asked, does it work with EVPF? Very good question. We haven't mentioned anything about the driver technology. I said we capture system calls. Originally, we were using a kernel module, but we also supported EVPF. The problem with those two technologies is that you have to compile them for each kernel version. First of all, we support EVPF. And second, with the newest Falco release, we are going to release something we call a modern EVPF driver, which is basically a core EVPF driver. Compile ones run everywhere. That's going to make it much easier to deploy Falco, and we hope that increase the adoption. Perfect. Great note to end today's stream. So, oh, final question. It always pops in at the last minute. We have time for it. Falco works on Windows kernel also as Krishna? No, not at the moment. What we could eventually see is a plugin to translate Falco, sorry, Windows events into Falco events. So, as I said, we have those Falco plugins that could be used for that. But I don't know of any Windows Falco plugin at the moment. Yeah, and great. And no worries, Krishna, you said sorry in the chat. This is exactly why we're here to answer questions, so perfect for asking one. But that's starting to be it for today. Thank you, everyone, for joining the latest episode of Cloud Native Live. It was great to have a session about Prometheus plus Falco, the Swiss Army knife for our series. And we also really love the audience interaction and questions. Always happy to see those. And we bring you the latest Cloud Native code every Wednesday. So, in the coming weeks, we have more great sessions coming up. So, thank you for joining us today. And we'll see you next week. Thank you for having us. Thank you.