Welcome to Cloud Native Live, where we dive into the code behind Cloud Native. I'm your host today. My name is Whitney Lee, and I'm a CNCF Ambassador and the Developer Advocate at VMware Tonsil. Every week, we bring new presenters to showcase how to work with Cloud Native technologies. We will build things, we will break things, and we will answer your questions. Today, we have Melissa Kilby and Pablo Muzza here with us to deliver a presentation called Falco, a peek into the people and the latest features. Now, this is an official live stream of the CNCF, and as such, it is subject to the CNCF code of conduct. Please do not add anything to the chat with that would be in violation of that code of conduct. So basically, be respectful of your fellow chatters of the presenters, and please respect me too. I'm last place there. Friends who are joining us live, please say hello in the chat and tell us where you're tuning in from. If you have questions during the presentation, please do post them in the chat. So with that, I'll hand it over to Melissa and Pablo to introduce themselves. Hi, Melissa and Pablo. Welcome so much. Welcome so much. I'm so excited you're here. I'm Melissa Gilby and I work in the Apple Service Engineering security team. Amazing. Hi, everyone. My name is Pablo. I'm from Brazil, but I actually live in Amsterdam for a while now. I'm a developer advocate at CISDig and a focal contributor for the last year and a half, and I'm delighted to be here. Thank you very much for having us. Impressive. What cool guess. I'm so excited for today's show. It's going to be a blast. One thing that I'm super excited about is, we're kicking this show off a little differently. We're going to do an interview with Melissa because Melissa is super cool, and let's find out more about that. Melissa, can you tell us about yourself in the beginning of your tech career? Yeah, big surprise. My university studies did not initially evolve a tech-related field. Instead, I focused on sports science and had a strong passion for gymnastics. Later on during my PhD, I discovered my new passion for computer programming, and my entry into cybersecurity began with my initial role supporting cyber research projects for the US government. I also taught applied data science at Placat and around five years ago, I joined Apple where I initially applied AI and ML and big data to threat detection. Later on, I transitioned into a new role that involved developing low-level Linux kernel monitoring tools and performing threat detection at scale using Falcon. Lastly, a fun fact about me is that I also had the opportunity to internet NASA and contribute to their space-suit engineering program. Wow. How cool is that? How did you start then with open-source in particular? Last year, I made my first open-source contribution ever to the Falcon project. It's so exciting. I started participating in a project by upstreaming patches and despite having no prior experience in C, C++ or EVPF, I gained proficiency through the project as I contributed a lot and I also had patients along the way. That's amazing. Tell us about your process.  Tell us about your process for becoming a maintainer. I definitely knew that to become more involved in a project, I needed to learn more about the project and make myself a known entity and contribute to do that. I started with easier patches. This approach allowed me to build trust with the maintainers and gradually familiarize myself with the codebase by tackling simpler tasks initially. I also gained confidence and deep understanding in the projects, intricacies. I also help reviewing PRs and triaging issues and provide guidance and expertise to the community. Additionally, I assisted in creating patches that others needed to effectively utilize Falcon. In summary, I just aim to be helpful and contribute positively to the community in various ways. One important thing is being comfortable with feeling uncomfortable and not knowing all the answers right away. All of us, all the maintainers, we're constantly learning and evolving, so I'm praising this mindset is very crucial. Being comfortable with being uncomfortable is amazing. I want to take a second and say, we have so much great chat right now, and I'm excited to dig into some of your questions especially about Falcon but we're going to do that a little later alongside the demo. Then we do have a lovely comment, this amazing achievements, Melissa, which I totally agree and being comfortable, being uncomfortable is a huge part of that I think.  How does being a maintainer help in your career generally? That's a really great question. In addition to gaining more technical skills, you also gain technical leadership skills that you cannot gain in an equivalent way through more traditional training, I would say, engaging with individuals beyond my immediate internal network. I can help hardening the project through a diverse user base and their experiences with the project. That gives us all, all of us maintainers, the opportunity to look ahead at the technology landscape and better prepare the project for what is to come. I also learned that acknowledging diversity and other styles makes me a stronger, more well-rounded and transparent engineer. I can focus on the actual goal that we're trying to accomplish and often or maybe even all the time it's a combination of everyone's input that creates our success. Furthermore, having joined a project with years of experience of working in a large company, I've also noticed similarities. Working with open source requires basically the same skills as working in a large organization where you collaborate with various teams and departments, and you need to understand their needs and concerns and developing effective communication skills is of utmost importance, I would say. In summary, by being available to offer support and assistance and becoming a dependable expert, you not only gain personal and career value, but also gain insight into the challenges faced by other companies. Cool. Why is it important then to be involved in upstream Falco? We at Apple definitely stand out as one of the distinct adopters due to the scale we operate at. The scale allows us to bring valuable insights and assert that certain approaches may not be suitable for large-scale production. We can identify more efficient alternatives that can benefit not only ourselves, but also other adopters like us that are facing similar challenges. Our objective is to enhance the robustness and strength of Falco. We prioritize stability, safety, and integrity alongside the addition of features. Lastly, it is generally exciting to not only announce the availability of a particular feature, but also to proudly declare that we contributed to building it. Amazing. Then one more question. How has your perspective changed since you became a maintainer on the project? That's a really great question. I recall that initially I wondered, how come some PRs are open for such a long time? Now we understand the reasons behind it. I definitely gained a deeper understanding of the complexities involved in managing and contributing to the entire Falco project. Now I also personally experienced the challenges and overhead of context switching, especially when it comes to providing high-quality code reviews and contributions across different aspects of Falco. These areas include Falco rules, documentation, user experience, as well as obviously low-level kernel and user space coding alongside with troubleshooting assistance. I think navigating and excelling in all these areas simultaneously can be challenging. I think Pablo, now it's time to talk about some new and cool Falco features. Yeah. Are you ready for me to share your screen, Pablo? Yeah, absolutely. Let's do it. If we can find it. Yeah. Great. Before we talk about 0.35 release, which we did about a month ago, just an intro to Falco for people that don't know the project that well. Falco is an open-source runtime security solution for threat detection across Kubernetes, containers, host, and the Cloud. It's a CNCF incubation-level project and we applied for graduation back in November 2022, and hopefully we get it graduated soon. It's getting more and more traction over time, which is great, and here's an overview of how Falco works. The whole idea of Falco is being this string agent that's collecting data from Udpo inputs and sending alerts if something suspicious happens. The different inputs we can have, we can talk about system calls where we can look with either the kernel module or using eBPF probes or we are talking about plugins like just collecting data from GitHub, CloudTrail, Kubernetes audit logs. Then we have a set of rules which we run those events against, and if there is a match, it means this is weird behavior, this is suspicious, and then we send an alert to whatever the output you configure to. A little bit more on eBPF, I guess most of you heard eBPF before, it's been a bus for a few years now. It stands for Extended Berkeley Packet Future, but the name is basically history, so don't worry too much about it. In a nutshell, it extends the kernel capabilities safely and efficiently without changing kernel source code or without loading kernel modules. The way I really like to think about it is basically kernel instrumentation made simple. So that's my intro to Falco, and now we're going to talk about a very cool feature that's the modern eBPF Pro, and I think Melissa is going to be able to tell you a lot about it. Thanks Pablo. In the following slides, I will present the modern eBPF implementation of Falco, as Pablo already said, focusing on the concepts of one kernel buffers, the eBPF ring buffer, and the compile runs run everywhere core e features, the btf, bpf by type format tracing programs. Next slide please. The modern bpf driver feels good for adopters as it eliminates the need to worry about many underlying complexities. For example, if you are a Go or Java developer, you are accustomed to easily compiling and running applications on various operating systems, such as Linux, Mac OS, and Windows, as well as different architectures like x86 or ARM64. This ease of portability is possible because many of the underlying considerations are abstracted away from you. And everyone loves easy DevOps, easy testing and better performance. Next slide please. In a nutshell, what our kernel drivers do, all of them, they primarily read kernel data structure fields. As shown on the left side of the slide, the old bpf instrumentation requires performing successive kernel reads when traversing through kernel structs. And this is due to the fact that memory is read directly to the stack. And to successfully navigate these structures, you have to know the exact substructs and field names. This process is not only tedious, but also fragile because the Linux kernel does not provide a guarantee of backwards compatibility or stable APIs across different releases. Now let's shift our focus to the right side of the slide, where we explore a better approach known as the Core eWay that we adopt in our modern bpf drivers. Here's how it works. First, with the Core eWay approach, you can read the desired fields in a single operation, regardless of the number of structs you need to traverse. You only require one bpf core read. Furthermore, even if there are slight variations in the kernel data structures, the new bpf core read helper can adapt without requiring modifications to the read operation. That's pretty cool. And this is achieved through the use of kernel debug info, the btf I mentioned earlier that we have, yeah, and btf automatically identifies the new location of kernel structure fields. That sounds amazing. Unfortunately, nothing is ever perfect, especially not in a Linux kernel. This approach will not work in cases where there are significant structural changes in common kernel structures, or let's say when the meaning of a field undergoes a complete radical transformation. Next slide, please. In addition, in the old eBpf driver, we required the exact kernel header files to compile the bpf object code with the modern bpf approach where the driver is compiled generically and not specific to a particular kernel release. We faced the question of where to obtain kernel data structure definitions from. And I must admit that there is no plaque magic involved in this process. To address this, you need to maintain a VM Linux header file in your project, which contains all the necessary kernel data structure definitions. Additionally, if your program relies on macros or functions typically found in system header files, you will also need to redefine them. Returning to the scenario I just described, when encountering incompatible types between different distributions or kernel releases, you introduce flavor header files. In the example on this slide, you can observe that we defined an auto task infrastructure specifically for CentOS. Okay, lastly, because of the core eApproach in Falco's modern bpf driver, we can now bundle the driver with the final user space, Falco binary, during the linking process. And as a result, you have a single binary to run, providing a seamless experience and the perception of a kernel driverless solution that feels good. We have a quick comment from chat. So say, oh, yeah, enabling debug on production kernel. This is the kernel setting. Next slide, Pablo. Okay, switching gears a little bit, let's dive deeper into the concept of kernel buffers. Initially, when eBPF was introduced, there was only a perf buffer available, see the diagram on the left. And it was necessary to allocate one buffer for each CPU. For instance, let's say on a server with 96 CPUs, you would need 96 buffers, with each buffer typically having a size of eight or 16 megabytes. Let's consider a real-world example with the older perf buffer. Imagine you have very busy servers where kernel side drops are occurring. You keep increasing the size of the buffer, but your problems do not go away. This is because the challenges often revolve around bursts of events. So what now? The eBPF community has introduced a promising new type of buffer called the ring buffer. In our modern BPF kernel driver, we utilized the new BPF ring buffer. These buffers, however, have fundamental design differences that we had to learn through experience. The new ring buffer maps memory twice, contiguously back-to-back in the virtual memory, to make working with records that wrap around simple and efficient. While it turns out the new ring buffer implementation does not exactly duplicate memory, it was confirmed by the kernel memory management expert that currently there is no way to avoid wrong double accounting of memory reserved, but not used by the BPF ring buffers. So please keep this in mind when using the new modern BPF probe. To account for the different memory footprint and to handle event bursts better, the best approach is to leverage the capability of the ring buffer to be utilized across multiple CPUs, what you see on the right side of the slide. This not only helps in managing the memory effectively, but also has another beneficial side effect with the larger shared buffer. You may experience fewer or no event drops as the buffer can better handle temporary spikes in the volume of events. And Pablo, I think you now have a demo for us around the core E feature. Yes, absolutely. So one of the cool things about open source is like every time we work on something new, we like to write about it and put a blog out there, right? And then you have other people from the community, they're just talking to each other and just having putting together. So here's the modern BPF blog post. You can read about everything Melissa said and more. You're gonna probably see that some of the diagrams actually come from here. And at the end, you're actually gonna see a try it out with the link. This is the link that I'm gonna use to basically show you a quick demo on the modern BPF. So what I'm gonna do here is basically compare the classic BPF probe that we use to have with the modern one, with all the features that Melissa talked about, but mainly focusing on the core, like compile once, run everywhere to show how easy it is for you to just update or upgrade your kernel without having to think about Falco or anything that's actually using EVPR. So getting started into one of the comments, enabling debug on production kernel. So it's not really debugging, but it's more about increasing our visibility into what is happening, right? That's what we want to achieve with Falco in order to set using BPF. So what I'm gonna do is first, I have this Linux machine, just simple configuration, and I have Falco installed. And I have the... Sorry to interrupt, Papa. Will you make it bigger, please? Oh, absolutely. Yeah, thank you. I completely forgot. Yeah. So this is the straight environment that we use and where we like to put labs like this. I have Falco installed here and I'm just gonna run it with the BPF probe. And you can basically see here that, yeah, it's running. It's using the BPF probe and this is where the BPF probe is configured. Again, this is the classic BPF that we used to have before. And just to show how Falco works, I'm gonna do something that could be considered suspicious, which is basically trying to find some keys and Falco is gonna learn basically saying, oh, warning, there is a grab private keys or password activities found and it's gonna give you a lot of information about it because we're just running it on the host, not in a container or in a Kubernetes cluster. We don't have container information or the image, but otherwise we would. So this is the probe running. I'm now gonna do the same thing but using the modern BPF. So notice that to use the modern BPF with plain Falco installation, you just do dash, dash, modern BPF. And what you're gonna see here is, yeah, Falco started. We are looking into syscalls using the modern BPF. And more than that, we have one ring buffer for every two CPUs, which is what Melissa just described. I'm gonna do the same thing, suspicious activity and hopefully Falco is just gonna let me know. Hey, folks, this doesn't look really good. You might wanna take a look. I'm using standard output here, but we could easily set up Falco to send this to a CM in your backend, right? Or even our Slack notification if something is actually critical. Good, so that's Falco just running and working. What I'm gonna do next is I'm gonna go to the next challenge. I'm going to update the Linux kernel, which is something that you don't do every day but it needs to be done from time to time. So here we have the 1030 and I'm just gonna update it. This might take some time. I think it's gonna take less than a minute and if there is any question. Yeah, there's a question. I'm happy to take it. Yeah, what's the prerequisite for a person to know to understand all the technical nuances for this session? What's some background knowledge that would be helpful? That's a good question. I think understanding a little bit of how processes relate to the kernel and basically what CIS calls mean. It's an important aspect. So every process that's running in a computer whenever they need resources like memory, CPU, files they need to go through the kernel, right? And they do that through system calls in order to do it. So the whole idea is that if you basically have visibility and you instrument the kernel you have visibility into all the processes that are running. So it doesn't matter if they are containers it doesn't matter if they are within Kubernetes cluster within pods, like everything goes at the end of the day through the kernel. And because we're instrumenting the kernel itself we have full visibility there. So I guess that's kind of the gist. Public opinion to that. The question is probably the background for the session today could be considered a question what is the background I need to get started with Falco and it really depends what level you want to get into because Falco's cut across so many different domains including kernel programming, red teaming, offensive security, data science, big data, data pipelines. Today we dive more into the traverse. So the background you need is traditional kernel programming understanding that what I mentioned before for traditional kernel modules or the old eBPF driver you need to have the kernel header files for the exact kernel you want to deploy your tool to in order to compile the eBPF bytecode for. And then eBPF as a new technology there is so many great tutorials and I would just start reading and maybe then rewatch what we said today just as a suggestion. That's great. So I updated the kernel from 1030 to 1034. What I'm going to do now is I'm just going to oops, not this one. I'm just going to reboot the machine so we can start with the new kernel. Yeah, this is going to be inactive for a few seconds and I'm just going to wait. So if there are any questions in the meantime I can also try to answer those. There's a comment that maybe you can speak to. That's actually config trace points not debug but I don't, it's outside of my knowledge area. Yeah, it goes into the enabling debug on production kernel which is you're not enabling debug we're just hooking into trace points to get better visibility. And one important thing about Falco is we only do detection. So we're literally only looking into things. We're not actually changing the behavior of anything. So kernel is updated. There it is. And now I'm going to go for the last part of this specific demo. We have another one later that is running again the same thing that I just did. So I'm going to run the classic BPF row and then I'm going to run the modern BPF and we're just going to see what happens. So trying to run the classic one it's trying to use the BPF and basically says an error occurred here forcing termination. And if you look into the error it's like BPF probe is compiled for a different kernel but you're running this one. So we can't do anything. You need to recompile your classic BPF probe so we can actually work. On the other side if we just go for the modern BPF voila Falco is running. Why? Because of the compile ones run everywhere that's embedded into the modern BPF. So Falco itself already has everything compiled. And if we just move ahead and just run the same suspicious command you're going to get the same warning here as before. Looking here it seems like, okay but it's easy to compile like Falco in this scenario here. Yes it is. But if you're thinking about a hundred thousand nodes running it and now you need to think about Falco and everything else like that's one last thing to worry about plus all the performance improvements that we added into it like ring buffers and others. So yeah, I'll just click next. Again, this is available if you just look for Falco modern BPF blog you're going to have the blog and you can try it by yourself and just try to play with Falco. Yeah, so moving on I think we can now talk about another amazing feature at 0.25 which is adaptives is called selection. And I'm sure this is close to Melissa's heart since she really worked a lot on this feature and I really love this feature by the way. So go for it. Thanks Pablo. Yes, if you have been using Falco and believe that it only monitored the system calls defined in your rules I unfortunately must inform you that this was not the case for two Falco 0.35. However, I have good news starting from this Falco release 0.35 the statement holds true albeit with some caveates that I will explain in detail now. We modernized Falco from the crowned up really from the crowned up and introduced this new feature called adaptive syscalls monitoring. It empowers end users to tell Falco which system calls to monitor. Also previously Falco was limited to monitoring in narrow set of syscalls which was a drawback since its underlying libraries and kernel drivers were capable of monitoring a wider range of syscalls. So we also addressed this gap and this milestone allowing access to a notable range of syscalls not all syscalls but I think over 350 represents another significant advancement in threat detection. In summary, as an end user the benefits you gain from this new release and these updates include full control over the selection of system calls to monitor and this flexibility allows you to adjust your monitoring approach over time based on your cost budget and threat model. You have the freedom to tailor your monitoring strategy according to your specific needs and make adjustments is necessary and I think this was pretty cool. Next slide please. Now let's just guess the reasons why adaptive syscall selection was not available earlier. One of the primary reasons is that certain events involve multiple syscalls. For instance, spawning a new process typically involves a combination of syscalls like fork followed by exact VE. Additionally, in certain scenarios such as establishing a network connection, monitoring system calls like socket or bind is also necessary along with this specific syscall of interests such as connect or accept. To add to the complexity, Falco maintains a process cache table that stores state information and this state allows for real-time traversal of parent process lineages enabling features like parent-child relationship tracking that everyone truly loves about Falco. The combination of these factors made it challenging to provide adaptive syscall selections in earlier versions of Falco. However, with the recent advancements and modernization efforts we have successfully overcome all these complexities to offer this valuable feature. I have to say this advancement brings really great excitement to a variety of end users. Researchers can now monitor all system calls while adopters in production settings can customize their monitoring scope to align with their cost budget and again, their specific requirements. This flexibility enables efficient resource allocation and effective threat detection. Okay, in the upcoming slides, I will provide some explanations, not all of the explanations about the inner workings of Falco. Next slide, please. The key takeaway from this slide is that in order to effectively monitor system calls, it is essential to know their system call IDs. System calls are defined in the Linux headers. Here we go again with the headers files. And each syscall is associated with a specific number to support multiple architectures. Internally, Falco employs a mapping mechanism using a custom enumeration. Again, this mapping is necessary because the number associated with a system call can vary across different architectures, such as x86 or arm64. By utilizing this mapping mechanism, Falco's libraries can uniquely identify and handle each supported syscall in a consistent and uniform manner. Another key point to highlight is that syscalls have both an enter event and an exit event. To facilitate a structured approach in the parsing process, Falco introduces an additional mapping or enumeration shown on the right of the slide. This mapping is essential for organizing the parsing and handling of events, as Falco not only deals with syscall events, but also incorporates non-syscall events, such as container events. Next slide, please. The last two slides provide an overview of the adaptive syscall selection flow. We begin with the Falco rules. Falco traverses the abstract syntax tree of each rules filter and extracts the syscall strings. It then maps the string to the corresponding syscall IDs and the internal event IDs within Falco. This process involves not only syscalls defined in the Falco rules, but also the syscalls required for Falco's internal prane or stage that we already discussed. Next, to transfer this information to the kernel, we employ a dedicated EBPF map in the case of BPF drivers or an internal bit mask using the IACTL API in the case of a kernel module. This allows us to inject the relevant information into the sysenter and sysexit trace points within the driver. Next slide, please. Important to understand is that due to the triggering of the sysenter and sysexit kernel trace points for literally every syscall, our pushdown filter is designed to efficiently exclude unnecessary syscalls that we're not interested in before any data field extraction occurs in our kernel drivers. This filter optimizes the monitoring process by discarding irrelevant syscalls early on, the earliest possible basically. Once again, Falco operates as a passive monitor of syscalls and does not exert any influence or modify the behavior of the syscalls being monitored. Additionally, the purpose of kernel site filtering is to minimize the number of events that must be transferred from the kernel to user space through the buffer we already talked about as well. In addition, the goal is to reduce the number of events processed and evaluated against Falco rules in user space. By implementing this modernized filtering mechanism, we can achieve these efficiencies without compromising visibility at all. This is because the ignored syscalls are not utilized in Falco rules and also not utilized for the state, ensuring that only the events necessary for Falco state and rules are served up to user space. In summary, the kernel site filtering approach allows us to optimize event handling while still providing all of the relevant information required by Falco. I think we're ready for the next demo Pablo. Absolutely, thank you very much. Yeah, so again, for the adaptive syscalls is the same thing. We sat down together, we wrote a blog. Thank you, Melissa, Roberto, and Frederico for that. And we tried to explain here what's going on, what's the new feature, and there is way more information than what Melissa described. And at some part here that I'm failing to find, there is also a link for you to try another lab if you want. So the idea of this lab, okay. Sorry for that, I was expecting it to just run. I'll have to talk for a minute while it's just loading. Yeah, I have a question for you. There's one in the chat that was from earlier. How can I start contributing with a project like Falco? I would, my experience is that if you want, there's various ways. First of all, it must not be just code. You can also help on Slack answering questions about Falco or help triaging issues and just be helpful in general. If you want to contribute code, I would recommend to start with smaller, easier patches to build trust with us over time. And that's kind of my recommendation I would give you. Do you have a follow-up question? Yeah, I think even since you have like the different events that I've been joining, like people have been talking more and more about contributing without having to contribute code, there are many ways to contribute to a project. You can just help people. You can just look into the documentation. You can help with blogs. You can just connect folks to talk about the same thing or host an event or something like that. So if you're scared about all the technical part that Melissa talked about, which I don't understand everything to be honest, it's really complicated to me as well, but I do my best. There are many different ways that you can still contribute to the project. Yep, so going back to my demo, what I'm gonna try to do here is basically show you adaptives as call selection. So this idea that Falco has a defined set of system calls that should be monitored so you basically can guarantee that we have a good visibility into what's going on and important data is not missing, right? So we will start by basically showing you like if we run Falco, there are a few settings that you can add just to see like some logs, like log level debug. Make the text bigger please. That's great, thank you. And then you have the standard error here to true and you have the dry run. That's not gonna really collect events, but just do a dry run on Falco. And with that, we can clearly see like the sys calls here that they were added because they are in the rules, 31 system calls. And then you can see the other 43 system calls that were basically added to make sure that state engine of Falco has everything it needs to have all the data, which is a total of 74 system calls that is monitoring, right? So it's not all the, I don't know how many there are like more than 300, but we are just looking to those 74. So if I go to the next part and what I'm gonna do now is basically I'm gonna have one simple rule. So for us to really play, I'm gonna narrow the scope and then we're gonna see what Falco is actually doing. So for those of you not familiar with Falco, basically what Falco does is looking to this system calls that are happening, the ones that it decides to monitor and it compares that those events against rules, right? There's a default set of rules that for system calls by default has more than 80. I'm just gonna say, forget about all of those, just use this single rule here, which is a very simple and dummy rule to be honest. I'm just looking to, okay, is there an uncommon process execution? And by uncommon here is any process that's not bash, s, h, l, s or m. So I'm basically monitoring anything that's execv or execv yet in an exit system call. Good, now I'm gonna run Falco. I'm gonna use the same log level, standard error, and I'm just gonna load this single rule file. And what we can see now is there were only two rules found in, sorry, only two system calls found in the rules, execv and execv yet. And because of that, to keep consistency, Falco had to add another 56 sys calls that are gonna be monitored as well with a total of 78. So that's less than we had before, which was 70 something. And in this case, we actually have more before we had 43, now we have 56. So because we have less sys calls in the rules, Falco had to balance to make sure that it keeps its days consistent and increase the number of Falco, sorry, of system calls that are actually monitored. This is just an Ubuntu license check happening in here. Great, so now I'm gonna run some commands just with the script and we're gonna see what Falco gets. So there are a few warnings in here. Basically, I'm looking to what was the process. So we have the script itself. Oh, sorry, let me, I hope it doesn't get in the way again. There was the touch, there was an MCaDIR, another touch. So just a few Linux comments that I executed. The important part here is the path, because that's the example that I'm gonna explore. You can see that, okay, this is a root slash folder. That's exactly where the process touch was executed from in this case with everything set up correctly. So I'm gonna go to the next one and what I'm gonna do now is actually use what Melissa described and I'm gonna select the specific system calls that Falco should monitor. Not more, not less. I'm gonna add just two of them and that's gonna be it. And from there, we're gonna see that actually information is gonna be missing because we don't have enough context to do the right thing. And I'm gonna edit Falco. Feel free to stop me if there is anything in chat. I can see it right now. There is a question. Are these labs you're doing publicly available? I do believe that they are. I saw you navigate them. Absolutely, yeah. If you go to the blog, Adaptives is called Selection. It's just in the blog. I can share the links later as well. There is a slide with the references and the plan is to share the slides later on. Excellent. So, oh, oh no. So, I'm basically editing the configuration file for exactly and exactly that. And I'm saying, okay, so instead of using the default base set of Falco, that's just gonna make sure that we have everything. I'm forcing Falco to just look at those two system calls. There's nothing else, right? So I'm gonna save. I'm gonna run Falco again. And now we can see we got two system calls from the rules. We got an extra two that was basically from the basis call. And this is an override because I'm basically adding the same two that I have in the rules or nothing else. And then what you're gonna see that the total, it's actually gonna be three. There is the exact V, the exact V yet, and the proc exit. Proc exit is a safeguard that was added and hard coded in there just to make sure things don't derail. Good, so I have it running right now. I'm gonna run the same commands again. And what I want to show you is that right now, basically the path is not there anymore. Why is the path not there anymore? Because we don't have the system calls that we need to actually be able to have this information in there. So be very careful when playing with this. Don't do that in production. And if you actually look at the blog, there are some best practices with regards, I think it's over here. To the type of events that you have, that you're like the rules that you have, what are the system calls that you must include in there? And just to finalize my demo, what I'm gonna do now is I'm gonna use the last setting. Go on, sorry. There's a question in chat that is a ring buffer. I have a question on ring buffer. Now, are you using ring buffer across CPU? Does that mean there's a lock between CPU on system call execution and performance cost around it? Okay, that. Can we take this question after the demo? Because it's unrooted to the adaptive system call selection. Perfect. Absolutely. Yeah. So what I'm gonna do now is just set repair to true. And this setting is amazing. I love it. It's basically saying, okay, this is what I'm interesting in. But you know what? I'm not sure what I'm doing and I might be breaking stuff. So please just repair stuff for me if, and now when I run, I still have the two CIS calls and the two CIS calls are overriding with the configuration, with the basis call setting that I had before. But now Falco is adding 16 repaired system calls. There what Falco believes is the real minimal set of CIS calls that we can have to keep state consistent and still give you the output. I'm too free to correct me here, Melissa, if I'm saying something that I shouldn't. No. But just to finalize, now I'm running it again and you're gonna see that the path is here. And that's probably because the CHDR was just added there which is me changing directories and that's what I'm printing in here. So that was a quick explanation of the new adaptive system call selection feature. Sorry, demo, not necessarily an explanation. And you can just try yourself, just break it, use the same example or just go for your own example. And it's just super cool that you can see, edit there, break things and try again and have an environment to just do that. Let me share the links with you for the labs, so. The second one I was able to find and put on the screen. So we just need the first one. Yeah, the first one. The first one is here. The more an AVPF and you don't want it. All right, great. Thank you, I'll put that up now. And Pablo, I can probably add to point one second, the difference between the default state enforcement is that by default, Falco turns on any system calls that could potentially modify any state and the difference here and the repair option is that Falco now carefully analyzes the actual rules you provide and then activates only the necessary assist calls to avoid breaking Falco's functionality. That's where the benefits come in. That's really cool. It looks like you got it from like 78 system calls down to 18, is that what I saw? Yeah, pretty cool. Good, so shall we take the question now or shall we just stay around with the roadmap and then go back to the question? I can take the ring buffer question in the old BFF driver. I mentioned there was a per buffer and you had to allocate one of these buffers for each CPU only with the new ring buffer we introduced and we do use this ring buffer and then modern BFF driver. You can basically use four, six, eight CPUs and just allocate one buffer to all of these CPUs and increase the size of the buffer and we had a conversation with the kernel mailing list because of the different memory footprint and we also found out that there should not be any contention and again, our monitoring process is passive so you do not influence or modify assist calls or lock anything for that matter. Do we have more questions or that's our roadmap slide basically? There is another question. How do you recommend that folks pitch Falco to their organizations? What benefits and how? That's the elevator pitch question and I think if you had to choose just one threat detection tool, doing operating system level, kernel inspection probably covers most of the attacks. So that's basically where I would recommend people to get the most investment out if you can only deploy one tool. One downside is that you have to deploy this tool across your entire environment. Could be different backend servers like Kubernetes, your worker nodes, then you have your control nodes, maybe you have bare metal hosts and so you would need to deploy Falco everywhere and there's a small subset of attacks that Falco cannot detect. If you think about higher up in the application stack, for example, authentication bypasses, you would still need application logs and there's also the Kubernetes control plane, Kubernetes audit logs, Falco has a plugin for it but it's not Cisco's data. Pablo, you probably have more to add to this. Yeah, I think security must be seen as layers, right? Like it's a fact. And if you look into the cloud native environment, you have like many different acronyms. We're talking about KM, we're talking about CWPP and other CSPM. So you basically need to make sure that you understand what Falco proposal is, which is the last line of defense. So after you have all those layers in place, there's still like the zero vulnerability, right? Like log for shell was discovered almost nine years later. Like what was happening throughout those nine years and how could you have visibility into that if no one actually knew what was going on? And after people discovered until we had a patch, what happens in this gap? What happens in this gap is if you have a tool that's the last line of defense and that's monitoring at runtime what's happening, that's what Falco is, you can be alerted in real time if something fishy or suspicious is happening. So I would say to convince is to make sure that people understand the problem that it doesn't matter how many layers of security you have, you're still vulnerable out there. And this is the extra layer and I would say like the last line of defense that's how we usually like to call it. Yes, and really thinking about your cost budget is very important. For example, perhaps your servers are really, really busy and you have a very low cost budget. Now with these new features we presented today, you can do very targeted monitoring. Maybe you just wanna look at newly spawned processes because that's all you can afford to monitor but it's still better than nothing. Yeah. Shall we move on to the roadmap and the feature? Yes, please. Yes, so there is an exciting prospect for the next Falco release, 0.36. Most notably, we are developing a rules maturity framework. This framework aims to facilitate the onboarding process for new adopters of Falco and maybe also help with the sales pitch and guide adopters in implementing threat detection effectively, we will identify approximately 20 to 35 rules that are tagged as stable and highly relevant for addressing the top cyber threats. These rules will serve as a starting point for adopters to implement monitoring and alerting in their environments. And once these initial rules have been successfully implemented with an acceptable noise level because every environment is different, you have to deploy and see how they work. Adopters can then progress to exploring rules and attack with a lower maturity level and so on. I think this will really help drive adoption of Falco even further. Then we're also continuously striving to enhance the efficiency and robustness of the Falco source. The upcoming developments in threat detection capabilities include, for example, SimLink resolution of executable files as well as a redesigned DNS resolution mechanism. Additionally, there will be a wealth of new guides available to further improve the adoption process for users. Furthermore, we believe there is never a wrong time to embark on ambitious endeavors. As such, we're currently in the design phase for providing anomaly detection capabilities directly on the host. We're actively working on this exciting moonshot project. I think that's all we have to not steal all the thunder from future talks. Amazing. I think, is that a wrap for today? I think we've got all the questions covered in chat. Thank you so much for all the wonderful questions today, chat. And is there anything else I will share this? Okay, I'm gonna share a link to the slides right now. So you all have that. And I'm also gonna put it on the screen for a little bit. So, and slides, you basically have the references. So you can see like the two blogs that I talked about. One of the things that, if you like this, we have been doing a lot of different events. So if you just go to our virtual page, we have been going around with three workshops that are like two hour long or even four hour long. And you can just check if there is anything close to your city or virtual one that you wanna join to learn more about Falco. And my last one is, oops, wrong click. There is also the book. I read the book twice. It's actually a really nice book to understand a little bit more about cloud native and security. And it's for free. You've been just downloaded and have fun. This is also in the slide deck.  They would be happy. And we do have another question for you all. Do you consider Falco a DevSecOps tool? It's a runtime threat detection tool for Linux operating systems. That's what the primary use case is. Yeah, I would expand on that. And I would say yes. I've seen DevSecOps people using. I've seen like in for people using. So you have a lot of different teams that you have a single team that provides the infrastructure to the rest of the company. And people are just using Kubernetes cluster and whatnot. And Falco is a way of actually getting visibility into what people are doing within their clusters, right? So our people opening shells into production containers like this is not what you want people to be doing. So it's also a way for you to understand how people are using an infrastructure that your team provides, for example. So yeah, I've seen DevSecOps people interested in this too as well. And compliance people. Aligning with the rules maturity framework, we will also tag rules to their specific compliance use case if applicable. That's also very exciting. Amazing. Well, I think that's a wrap today. For instance, do you have any closing statements before I do my closing statements? Go for it. All right. Thank you, everyone. Thanks so much for joining today's episode of Cloud Native Live. It was great to have Melissa Kilby and Pavla Moussa here to teaching us about Falco. We learned about the latest features and we learned about the community and how to get involved. That was super cool. Chat, as always, you were amazing. Thank you for the interaction and the questions. And here at Cloud Native Live, we bring you the latest Cloud Native Code on Tuesdays and Wednesdays now. So we have another episode tomorrow at noon Eastern. So thank you for joining us today. Thanks to those who watched the recording and I'll see you again tomorrow, actually. So have a wonderful, wonderful day, everyone. Good.


So, welcome back to another episode, Dr. Ray, or how are you? I'm doing fine. Thank you for inviting me. This time around, we're going to be speaking about a very fascinating body of work, what are usually termed the Homeric hymns. The Homeric hymns are very interesting in the sense that they're ridden over a very large body of time, right? So I guess my first question is, they can't all have been related or ridden by Homer, could they? Yeah. So, they're Homeric, because they're like Homer's work, in that they're in epic poetry, which is the meter is a dactylic hexameter, so every line in the Homeric hymns is in that same meter of Homer's Iliad and Odyssey, and Hesiod's Theogony, and Works and Days, so it's the same meter. And they're also oral, like Homer's poems would have been. So they have qualities of orality there too. So they're Homeric in that sense, and they're hymns in that they're celebrations of Greek gods. And some of them are composed from the time of Homer, so mid eighth century BC, and all the way down to second century Hellenistic poetry. So after the death of Alexander the Great, plus one that seems to be quite a bit later in addition to the god Aerys. So the subject matter is whatever best celebrates the attributes or an epiphany of that particular god. So some of them are birth stories, or how they obtain or exercise their power. For example, the hymn to Apollo starts with his birth, the hymn to Demeter is the earliest version of the Demeter and Persephone and Haiti story. It's also one of the most beautiful poems in Greek literature. For me, it was the reason, well, I had two reasons for translating the Homeric hymns. One was that I just love the hymn to Demeter, it's one of my very favorite.  And when her daughter is finally returned, the gifts that she gives to humans, both physical and spiritual, I mean, that's just so amazing. The other reason, more pedestrian reason I translated the Homeric hymns is because I was teaching mythology as a professor at Grand Valley State University. Every time I would teach mythology, I was using different translations. And then I'd have to explain so much. Well, the Greek actually says, or this is what's really going on. And finally I just decided, oh, I'll just do it myself. So then it was really fun because I had all these students who would ask questions. So I'd try out drafts of my translations and every question they asked, no matter what, I would either incorporate into the translation or put in the notes or introduction. And sometimes there were really good insights that I also included. And then the student's name is in there too. So it was like I was able to test out everything with my classes before it was published. And so that's how I ended up testing it and translating it. But it's just such good stories. And you can't really understand Greek mythology or Greek religion without reading the Homeric hymns. So it's just a really seminal work. The Homeric hymns, like you mentioned, they're not made by Homer, but they're in the same kind of poetic meter. You mentioned Hesiod and his theogony. Hesiod and Homer are doing the same thing you find in these hymns. They're invoking a god to tell a song because music is sacred. And because they're so stretched out in time, what would be some of the occasions that these works would have been performed? They all were performed, and a lot of them probably would be performed in competitions because the Greeks are very competitive. We know about the Olympics, but there were poetry contests, there were dancing contests. There's drama contests. So a lot would have been performed in competitions. And we actually know that because the hymns say so. For example, in number six, a short hymn to Aphrodite, it says, farewell, sweet gentle goddess with dancing eyes. Grant me victory in this contest. Ready my song. And so it's very clear that some of these were in competitions. And so we have four really long ones. And those perhaps also were preludes because people were used to sitting around and listening to long poetry in this oral culture. But they might have been done separately too. And we can picture different possibilities for the big ones, the longer ones. For example, Apollo, because it's his birth story, and specifically talks about Delos, where he was born. It talks about Delphi. And so perhaps it was performed at one or both of those places. So it would have been in more of a sacred context. The hymn to Demeter, perhaps it was performed with something having to do with the Ellusinian Mysteries, which at the end of her hymn, it talks about her giving the gifts of the Ellusinian Mysteries. So those were perhaps in more religious contexts. Aphrodite, the hymn, sounds very much like a song that could have been performed at a banquet. So for example, in the Odyssey, it talks about the bards that sing tales of Troy and other things. And we can picture at a banquet a bard, the Stitcher of Songs, being asked to perform this and singing about the goddess Aphrodite and her powers. Hermes is interesting because based on the subject matter and the humor, and it talks about young men, perhaps it was performed at a symposium where you'd have young men and people singing on the lyre with funny tales. And so when Hermes is talking about inventing the stringed instrument, the lyre from the tortoise shell, perhaps it's a bunch of men hanging out and singing these various songs. And Hermes would be quite appropriate there. So we don't have just like one occasion, just lots of different possibilities, even when they're like funny, like the Homeric hymn to Hermes, where he's a trickster and a thief and a traveler and a boundary crosser. And there's fart jokes in it. And I mean, really, in the Greek, there are fart jokes. So yeah, I love that one. I was actually going to mention that one in contrast to something like him to Demeter, you know, you have this very serious, forlorn, beautiful story with a very clueless patriarch. Zeus is like, I have no idea why she's so angry. Well, you just gave her daughter up. You know, in a way, that one kind of reminds me of a Cupid and Psyche from Appalachus' Golden Ass. There's the same kind of concept of a mother and a daughter coming to terms and in a world of arranged marriages, they are technically being just kidnapped and taken away. When Pades comes up out of the ground, it's terrifying. Oh, yeah. We're Persephone. She's completely freaked out. It's kind of like when Psyche is in the palace that Cupid has her stowed away. And it's the same thing. Like when he comes to her at night, she's terrified. So I just think of it from the perspective of like a young woman.  And then processing this very insane system where basically one day your daughter is just given away and taken away. And you have like him for with Hermes. And I almost look at that one as like an proto kind of infancy gospel. If you've ever read the infancy gospel of Thomas, baby Jesus doing the same kind of things. He's very petulant and a trickster.  Right. This is a baby Hermes saying you're doing all this, stealing these cattle. I was going over it and it was just like, yeah, there's the fart jokes. And then there's the buddy comedy at the end, the team up. Hermes really is in a way of playing both sides. He feigns ignorance with Apollo.  Why are you talking to me like I'm a kid? Like, I know I'm getting us out of here. But when Apollo comes, he's like, I'm just a baby. I don't even know what cows are. I don't know cattle. So the hymn to demeanor, as I mentioned, is one of my all time favorites in Greek literature. But what you had mentioned about the arranged marriage and the kidnap and all of that, let me read you the beginning because I try to be very precise in my language. What does it mean to give away in marriage? What does it mean to kidnap? OK, the Greek has it. I sing of the revered goddess Richard Demeter and her slim ankle daughter, whom Haiti snatched, far seen, thundering Zeus gave her away. So those are just the first three lines. And in that, we have that there's a singer. There's the goddess that the song is being sung about. There's epithets, right, about the goddess. And these are signs of oral poetry where you have Richard Demeter, right, slim ankle daughter. So those are little descriptive things about the gods and goddesses. Just like in Homeric epic with swift footed Achilles, that kind of thing. But it says, whom Haiti snatched. And the Greek word there is harposto, where we get harpies. Right. It's snatching. There is nothing. Oh, he's marrying her. He's wooing her. It's courtship. It's even marriage. He snatches her like in the claws of the harpy. But it says far seen, thundering Zeus gave her away. The Greek word dido me for give. He gave her away in marriage. So Zeus agreed to this match and he gave her to Hades. Didn't bother telling the mother or the daughter. And then Hades opens up the earth and grabs her. So the gender and specifics here are really important. And the language about Demeter is all in terms of flowers. She's called the blossoming girl who is picking flowers when she was snatched. And so it's like the flower who's picking flowers is plucked. And so there's that imagery in it. And you mentioned how horrible it is for her because it says snatching the unwilling girl.  So obviously a little irony here. She's screaming for her father to help her who gave her away. But this is not a gentle thing. Right. And when we see Demeter next, we have the mountain peaks and sea depths echoed with her eternal cry and her goddess mother heard her. Sharp grief seized her heart with both hands. She tore the veil from her ambrosial hair through a black cloak over her shoulders and sped like a bird over the nourishing land and sea searching. But none of the immortal gods or mortal folk would tell her the truth. And so we have this like hugely powerful story of this mother searching the earth, trying to figure out what happened to her daughter, who she heard scream before she disappeared. When I read that, that's actually a line that I highlighted with both hands. She tore the veil for her ambrosial hair. It really emphasizes that for lack of a better term, she's freaking out. She does. Oh, yeah, these are goddesses and gods. And even in these texts, like later when she meets the daughters, they're like, well, human beings have things to suffer that gods don't have to. But Demeter is obviously suffering the same thing that a mortal woman would go through, you know, sped like a bird frantically racing. It was like getting punched in the gut when I read that. I love the role that Hecate plays in this. Yes. She's like almost offering moral supports. Yeah, she is. She's the female companion who gives support to the mourning mother. And I like that you mentioned the human realm, because what this story has that none of the later stories about Demeter and Persephone and Hades have is there's this whole center part of the hymn that directly focuses on human life. So this royal family takes her in and she tries to make the queen's son, the infant boy, her own. And then when the mother sees her putting the baby into the fire, as she's trying to make him immortal and screams, I mean, what mother wouldn't. Right. She took on this nanny with no references. And then she sees her putting her baby in the fire and Demeter's reaction is as a goddess.  But I think it's her time with human beings that allows her at the end when she regains her daughter to not just give back fertility and life on earth, right? Since she's the grain goddess. But she also then gives the Ellucinian mysteries because I think it was her time with human beings where she was this is important and there's mothers too. And they took her in. So she gives something that gives them a hope of a happier afterlife. So she takes care of them with food when they're above and Persephone is queen of the underworld when they're below. But she gives them this blessing. And I think it's because of her time. Getting back to your point about how the subject matter of the poem for him, too, it almost seems to be doing two different things.  But it's also about the establishment of the Ellucinian mysteries. Right. So there's kind of like a conflict there. And that's what I find most Homeric about this poem in particular, because it kind of goes back to what Homer does in his own work. Homer has a story on the face of it just about war, right?  But like at the same time, Homer's putting in very existential, emotional pathos and depth into his work with these traditional materials. And I see the same thing going on with this him and especially comes out in your translation, Demeter acts how a goddess would act when her honor has been affronted, when the mother's like freaked out that her kids in the fire.  Her heart feared terribly. It shows that these two are missing each other on a very visceral level. Yeah, they run and hug each other and hold.  And Persephone's, he shoved it in my mouth. It was by force, you know?   Of course, it's humans. So of course, the gods are in our image, right? And this combination of the mysteries and the gifts that Demeter gives and the story. And as you put it at the beginning, the story about the patriarchy, where it's a male world and Demeter has to do what she can to assert her rights and her power. You know, hey, I'm the grain goddess. I'm going on strike. I'm not going to provide any life until you give me what I want. But then the strike doesn't continue. She doesn't try to change the power structure or the patriarchy. She goes, OK, I've got my daughter back. And now I will return fertility to the earth. And in addition, I will give this extra blessing. Right, of the Ellusinian Mysteries in honor of my daughter and me. And my time with the humans. And so it's very much a story of life and community. And that's what I see is so powerful when I talk to you before about Sappho.  I can see maybe not Sappho, but somebody like Sappho composing this hymn. It's just strangely enough, I look at it and there's no way that they're putting this in for no reason. Oh, yeah, obviously they have a traditional story to tell. But there's a reason why they're putting in these emotional moments, these moments of despair, of joy. Like you say, we all make the gods in our image just as much as, you know, the other way around. I just see a very interesting person writing this. I know. Well, we can assume that in general, the bards were male and that it would have been something passed down from father to son.  And because they're all anonymous and we don't know who wrote them, who composed them originally, I mean, it's certainly possible. And Anne Sutter makes a good argument. Other people have as well that because this focuses so much from Demeter's perspective. That that's possible. And of course, no way knowing. I almost see it as like, I don't know if you're familiar with the original Carter family, but Sarah Carter, who was basically I would argue the brains behind all those songs. And AP bought the songs from people in the countryside, the folk songs that became those songs. But Sarah still had to create those songs at the end of the day with her guitar and her voice. So it's the same kind of thing here. So, Diane, thank you so much once again for joining us. I'd like to end with what's the end of most of the Homeric hymns because they do have this ritual pattern. I will remember you and the rest of the song. Thank you.


Representative McClendon just completed her ninth term up at the Texas Capitol and she sits on two communities that are so incredibly powerful and important. The Appropriations Committee and the Transportation Committee. She also chairs other committees. There's just a few of her duties. She has been an incredible advocate for those who have been wrongfully imprisoned and for economic prosperity to local communities. Representative Virial has been up at the state capitals since 1999 and one thing that really struck me as I read his bio was you always hear every vote counts. In his case when he first came into the house he won by one vote so that's the power of voting and that was just amazing to me. He has been a very outspoken voice and has focused so much attention on public education and he sits on that very important committee. He also chairs the Investments Committee which is very crucial. Senator Vandeput we have Sarah Clemens with her office today and as you know she was in the house for many years and then she's actually been in the Senate since 1999 and she chairs that very important veteran affairs and military installation committee. So you are very well represented up at the Capitol and so what we are going to do quickly is talk a little bit about the 83rd session and these are some of the bills that pass that will really shape as we go into next session and some of these obviously have been talked about in great extent already. The only one I'll mention is the flexible response which is really going to redo CPS's ability to how they process those neglect cases and that is going to be really interesting as they get that rolled out or roll out in November starting in Webb County and they've got a staggered rollout on that and that's going to really shape next session but I'd like to turn it to our panel and ask them what they felt were some of their greatest accomplishments and disappointments from this last legislative session. Representative McClendon start with you. The greatest legislative accomplishment for children during the 83rd session was that I was involved with I was able to pass HB 2862 which updated some of the legislation needed for the juvenile Justice Department. As many of you know I served for 17 years at the Bear County juvenile probation department and I left there and went to City Council and served there for almost four years and so I've had a lot of contact with children and with dysfunctional families and it's important that we realize and understand what we can do in order to help these families. I don't want I just answer the question. Okay thank you thank you. Representative Ria? Thank you. Can I borrow that mic? All right. Here you can have this one. It's a pleasure to be here and that's a that's a great question.  Raise your hand if you're with a nonprofit organization. Yeah. Oh keep it keep them up keep them up. Okay I see some hands that aren't raised. How about if you're with a public institution in elected office or serving is as a public administrator right? That's just about everybody else. Thank you for your service. You know in this these times that we live in basketball players get recognition you know investment bankers fancy lawyers but there are many of us who have chosen a life of public service and helping others and that's important. Our community is as strong as it is today because of you. So thank you for your time and your efforts. It is a reward that that is so much bigger than we get recognized for. So thank you for your efforts. Last legislative session there are two bills that I passed that I'm very proud of. I didn't do it alone. It was with other people's help that that is the way the legislature works right. There's 181 of us hundred and fifty in the house the rest in the Senate and you got to make friends and sit down with people and figure out how to win support from a diverse set of actors from across the state. We passed legislation that decrease the number of standardized exams that high school students have to take to pass and graduate. That was a big achievement. We cut the number from fifteen down to five and we removed an option for students that should have never been an option. The minimum graduation program was a road to nowhere. If you graduated from high school on the minimum graduation program you could not qualify to enter a community college. Should have never been an option. We got rid of that. We also gave students more flexibility and choosing their electives. It's very important. Too often our high school students are eager to be on their own and and they want to get a job. They want to have a taste of independence. Those 4 years we have them in high school when they're not worrying about paying rent or utilities. If they want to immediately enter the workforce we need to make sure those 4 years are an opportunity for them to learn about what jobs are in demand in their local economy and what certifications that they can and highly valued skills they can acquire during that period so that they can land a great job after high school if that's what they want to do. We need to make sure they have choices and meaningful choices. That legislation did all of these things. Very important. The second bill that I passed with the help of many others including Ruth and members of our local delegation, Leticia in the Senate sponsored the bill. We passed legislation. Initially it was a very strong bill that said there will be a task force that redesigns how we do how we intervene with truance in Bear County. After sitting down with school districts who actually are very strong in the legislature. They know how to kill bills and stop them. We decided that truly what we what needed to happen if anything was going to happen in Bear County and this was a Bear County specific piece of legislation. If anything meaningful was going to change then all the actors all the stakeholders that are involved in the issue of truancy needs to be voluntarily at the table. And so we ended up making the recommendations that were required to come out of this task force to be voluntary. There's no teeth in this bill. But let me tell you it was the smartest thing we did. We passed this legislation. It required the mayor and the county judge to bring together people from our court system. I want to recognize Judge Jarrett who serves on this task force with me today. A number of other judges. Laura Parker is Laura here. There she is. And leaders in our public schools, Brian Woods, Superintendent of Moreside ISD. Is Brian here? His fan club is here. That's great. Judge Bull. Anybody want to clap for Judge Bull? No? Okay. We have a few takers. Ray Saldania chairs a committee. I'm on the committee and so is Leticia. So we have gone together and over the course of a number of months have analyzed this problem that we have. And the problem basically is young people are falling through the cracks. Can you get that? I'm just playing with you. So in truancy, the way it has historically been done, it's a punitive system that creates a pipeline for kids into the criminal justice system. It was designed as a criminal public safety kind of intervention where students and their families were fined when they were brought to court. We have changed that by creating a new step before the courts get involved. A caseworker will get involved. So we've changed the model to be more about a social worker intervening, sitting down with a student and his parents at their campus. We don't want to bring them downtown to a courtroom. We want to keep it in their school community. And we want to intervene at the earliest ages. And we know from the day that we studied that the kids who start missing classes in first grade are the ones that build up a pattern we have trouble with later on because they and their parents did not acquire the routines and the habits of getting to school on time and living up to the requirements of our schools. And so early intervention with a caseworker in the school community, figuring out what's happening behind the scenes. What can we do to stabilize that family to help that student stay in school is the new system that's in place. And school districts are now have all agreed all 15 of them in Bear County have come to an agreement on what the research based interventions are that they should practice. And we are wanting to design a data system to then test those assumptions of what interventions work for our community here. And so this is a really big deal for Bear County because Bear County for the is the first county in the entire state of Texas to say we're going to put a dent in the pipeline from schools to jails. We're going to work with our kids at the earliest ages and we're going to try to help their families in the root problems that result in truancy. So that those are two things that came out of last legislative session that I'm proud of. Did you ask what was the disappointment? We can just focus on the positive if you want. Well, I'll just say one more in two words. We Medicaid expansion didn't happen.  We need to fix that next session. Hi, everyone. I am a far less veteran public speaker than everyone else on this panel. So please forgive me for that. And I think representative Vira hit a lot of the very important points.  So I think two of her biggest achievements this past legislative session were HB eight, which was authored by representative Sifronia Thompson. She sponsored it in sponsored it in the Senate, and it increased the penalties for those who compel prostitution, particularly for minors, which is a really big deal because it made it a first degree felony, which means that it can be up to 99 years in prison. So the huge deterrent. And if you try, which is not nearly long enough, but at least we're getting there. And then also SB 92, which created a minor juvenile diversion program for those who are victims of human trafficking. So when they're picked up and charged with prostitution instead of going into juvenile detention, they're put through programs that allow them to be rehabilitated and given the services they need. Next, and there's not going to be a test on this, so we are not going to go into these numbers. This is CPS budget line item by line item. And what you really just really look at the far right column, we had increases in every line item since the session before overall 11.5 percent increase. We had an increase in the case workers that child protective services got. We had an increase in prevention. The D FPS prevention division went up 43.3 percent. But if we add in what we have over at HHSC, we're all our home visiting and nestled. We had a 45 percent increase. So very good news from that last session. And as we look towards next session, starting with the budget, we see that, you know, a lot of people were really proud when Commissioner Specia came in and he asked for a lot of money. And he got $164 million in exceptional items last session. People were a little worried that he wasn't going to ask again. But guess what? He is asking for 252 million this time. So hopefully we will get a good increase in D FPS budget. This next legislative session. As you all are very well aware, the legislative climate is changing dramatically of all those big state office holders. They're all going to change with the exception of Speaker Strauss. And that's going to really bring a lot of change with regards to key committees, a lot of shuffling, a lot of retiring. The finance committee, the appropriations committee, those folks are leaving. So a lot of change, but with change comes some really good things with regards to opportunities for progress. And so let's turn it back to our speakers on our panels and talk about what you see this session, this upcoming session of how it's going to play in with the change of leadership and with the new people coming in. It's going to be interesting. That's a good word. It is. It really is. Last session, many of us were very disappointed because we did not anticipate the deep cuts that occurred. We did not anticipate the rejection that we would get from a lot of the, how can I say this, in a very nice way, the people who don't think like we think. And it was a uphill battle trying to get things done. And you had to be very strong minded and committed in order to not get discouraged. This session, I don't see it getting any better. In fact, I think it's going to be worse. And the only way you can change that is the public has to come in and talk to the individual legislators, the House members and the senators to get them to understand the needs of the citizens of this great state of Texas. And unless that happens, it's going to be much like it was last session. And it's really not, it's really not a good report. As Alex Prasino used to tell me, I used to go to him and tell him that I needed this and I needed that and I needed that for my district too. And he would say, this is not a good report, Ruth. Well, what I will tell you, I don't have good news for you for the session, except for the fact that the strength of our state lies with the people. And when the people stand up, the state rises. And these advocacy groups that are here today have been so good and famously great in getting the word across.  Because you need to, you need to to that the legislators know that, you know, this is serious. We're talking about our children. This is serious. We're going to have a new governor. We're going to have a new lieutenant governor. Hopefully, it'll be somebody that representative Billy L and I will be able to have a working relationship with. And if not, we have to be able to create one.  But we can work hard at it. And what have to happen is that you, all of you will have to come to Austin to work with us in order to change minds. And then I can say this, because these the new people, the ones that I want. And that's many of us in this room. We don't have to train them. They come to the stone building already trained. They come knowing the concerns of the people. But there are those who don't come already trained. And it's gonna be incumbent upon us. Because Mike is not gonna come in back. And I'm gonna be there by myself. Along with other members who have like us. And so we're going to have to have the help of a lot of outside when I say outside, I mean, people who are not a part of the legislative process, and not in the legislature, not the staff, and not the legislators to come and speak with members and let them know your concerns. Thank you. Well, I think Ruth's point is well taken. We all need to be a part of the legislative process. And with these new openings, this is our chance to have new leadership and impress upon them what we believe are the priorities for prosperous Texas, and that those priorities begin with investing in our children's welfare. And so I think this is actually an important opportunity. We have seen the priorities of the folks who were there before. And they weren't exactly in line with what we're trying to accomplish. So we have some new people and and that represents an opportunity to try to influence and shape what their agenda is going to be. I know next legislative session, we're going to enter in January with a surplus of revenue, a surplus larger than we have seen in my 15 years in the legislature, mainly driven by oil and gas. And so I see smiling faces that you should be smiling that is a chance to help Commissioner Specia get his priorities accomplished next legislative session, because that dollar figure that very large dollar figure in exemption items, exceptional items. What was the figure 200 and 52 52 million more dollars above a baseline in special items? Isn't a reality yet? That's what he's asking for. So the Appropriations Committee and the Finance Committee needed to liberate and decide what will be the real number with your voices in the room, they will make a better decision. And Commissioner Specia will get what he's asking for. So I really encourage you, there is power in numbers. And this organization is a great organizing advocacy group to belong to. The second point I want to make is that while we are being advocates at the state level, it's important to recognize the state is not going to save the day for our hometown community here. We need to continue pushing forward on the City of San Antonio and Bear County Commissioners Court and our local government agencies who have a direct hand in improving the quality of life for children and families. And that is hugely important. Ultimately, this is where we have more discretion, because in San Antonio, we have shared values here. We have a moral compass in our community that is unique. And it begins and ends with compassion for those in need, I believe. There is a heart of generosity here that's unique. We find shelter for the homeless. We welcome those who are storm battered. Our children are our treasure here. And so there is a lot that we can do right here at home. Ruth mentioned I will not be returning to the legislature after 15 years. I'm going to miss that building and that process. But I'm very happy to share with you that I am running to be your next Mayor of San Antonio. I love you too. And I can't wait to roll my sleeves and get to work with you as a partner. Thank you. The rest of the slides are what has been going on in the interim in terms of Department of Family and Protective Services, a lot of stuff. When you look at the presentation, if you have any questions, please email me. Give me a call and I can walk you through some of those things that will impact what happens next session. But I'd rather us spend the last few minutes that we have with our guest really talking about their priorities for children and families this next legislative session. So, Representative Clinton, if you can lead us off with what your priorities are going to be this next session. You know, I have so many priorities that my list is very long. Well, let me just say this. I have the greatest confidence in Judge Specia because he is the right person for DSPS Commissioner in the right place at the right time who can write the ship. And the ship needs to be writing. I made that word up. I have really appreciated his expertise and his dedication to doing what's right for the Texas children ever since I worked with him when I was a juvenile probation officer and he was a judge. He's always had the concerns of the children as the utmost and primary thing that we should be concerned about. And I was hoping that when he got to Austin that he would have that same concern and he does. So we can rest assured that Judge Specia is in the right place at the right time. I think we must realize that the department has been underfunded and this has led to a shortage of case workers on the state level and an overload of cases to be managed. Case loads need to be adjusted effectively to allow for the complexity of the case. The time and distance of any travel associated with the case loads and the experience level of the case worker. And you may not know how important it is to have a case worker who has a background integrity to be able to sit down with dysfunctional families and explain to them why that daughter, their son is acting out and what needs to be done in order to correct that. So you know, it's a complicated process and we need case workers who have the experience level to be able to work with these families. We deal with parents who do not have the capabilities to even assist their children with the homework. We have children who could care less about studying. And it's not because they don't want to study. They never did learn how to study. So we have a lot of issues that we need to deal with. And I say that because for child protective services to be on the forefront of people who care about children, they need to have a person like Judge Specia at the head. And so we're very fortunate. Besides, he's from San Antonio. Yep. And represent Vial, I know you won't be returning to the pink dome, but somehow I think I have some opinions about this priority is known. Yeah. And real quick, I'll make it short. We need to fully fund pre K in Texas. Another example of our values here in San Antonio, we dedicate our own dollars to help expand quality pre K in our hometown with pre K for essay that needs to continue and be strengthened. The rest of the state needs to learn from us. The second thing is Commissioner Specia's budget request needs to be met inside of that is a whole lot of good that will go toward preventing abuse and neglect for children. We need to decrease standardized testing further that over emphasis of it. I mentioned what we did at the high school level that needs to continue down to the lower grades. And I just looked over to my left and recognize one of the staff members of Jimmy Don Acock, the chairman of public ed, who worked with all of the committee members to pass House Bill five. And that's Belinda White Putzka, who is now the ED at Sunshine Cottage is now living in our community. Thank you for all your work in getting House Bill five passed. And so those are my three objectives that I hope will be carried on. I'm going to give them to you. And Sarah, can you tell us a little bit about Senator Vanipute? Sure. So Senator Vanipute is incredibly concerned about prevention of abuse and neglect, but also not just for people who have been through the CPS system, but in general, things like evidence based parenting classes being offered statewide is something that's very important to her, as well as any other. And but just in general, no matter what happens at the top of the ballot, we're facing a very divisive political climate. So what her main focus has been in all areas is trying to find really smart strategic ways to get around and navigate that system. It's really important that CPS get fully funded that they get the funding they need for prevention and everything like that. But it's also important that we do things like find a Texas solution for Medicaid expansion that everyone can be happy with and to find ways to improve education all the way through higher education for our future generation. Thank you. And the good news is that regardless what happens in the November election for Lieutenant Governor, Senator Vanipute will be coming back in some capacity next legislative session. And I just really want to thank our great panel that we've had today. Kathy, this conference is incredible. The voices that you have assembled are incredible. I can tell you for tax protects, our number one funding priority that we will be fighting very hard for is increased funding for prevention services. And if you need any additional information, please feel free to contact me or go to our website and sign up for alerts. And once again, if we have some parting comments from our panelists, and then we'll have lunch. Ruth, any parting words as represented here? Well, let's keep growing this gathering. Really, it really is as simple as there's power in numbers. And next year when I return as mayor, I want to see us outgrow this space. So, you know, we're going to all bring a friend and we're going to extend the message and the movement of making our community the greatest place to raise children healthy and ready for the future. Ditto to Mike and I would just like to challenge each and every person here to get out and talk to folks about the issue that you are most concerned about. And the voices of children. It's amazing. It's just think about just think about what that means.  And that's the way we're going to be able to change the state. And that's the way we're going to be able to influence the appropriations that come out of the legislature for our cities, our counties. And so I know that we have the commitment here in this room. And I just don't want you to underestimate the power that each of you has in order to make changes. Thank you very much. Thank y'all very much. And with that, I believe Kathy is going to try.