Container Runtime Security with Falco
summary
Explains extending Falco to perform container runtime and cluster-level intrusion detection by ingesting event streams beyond host system calls, specifically Kubernetes audit events and application-level events. Describes how Falco was implemented to accept and configure Kubernetes audit events, how to write Falco rules to detect behaviors in those streams, and how to add additional custom event sources using Falco’s generic event ingestion architecture.
AI-written summary · about
chapters (10)
- 0:00Start
- 3:10How to do security?
- 6:47How containers changed the game?
- 11:39Detect intrusion in containers
- 18:09Falco extended architecture
- 19:27Deployment
- 20:39Syscalls for observability?
- 20:49Falco rules
- 21:24securityhub.dev
- 22:42Response engine on Kubernetes
