Keynote: Why Wait? Find Cloud Risks and Threats in Real Time with Stream Detection
summary
Falco now ingests CloudTrail as a live stream so cloud logs never need to be copied to a SIEM for detection, using an open source Falco CloudTrail plugin plus eBPF/kernel collection for syscall and metadata enrichment. Rules detect things like console access without MFA, public S3 bucket changes, and data exfil in seconds, with thousands of deployments reporting low CPU and minimal storage overhead. The system is scalable, works at edge and runtime, and avoids indexing and costly data movement with real-time stream detection.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:16Detecting Threats in the Cloud
- 1:10What Happens Next?
- 2:19Falco Principles
- 3:04Container-Oriented Detections
- 3:39The Falco Sensor
- 4:07Example: AWS Cloudtrail Rule
- 4:59Get Real Time Visibility with Falco
- 5:30Stream Detection Advantages
related talks
47mFalco Conquering Cloud Security
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
29mDetecting cloud and container threats
05mSponsored Keynote: Cloud Security’s Hidden Force: Threat Detection
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
01h 33mCloud Native Runtime Security with Falco
10mHow to Use CNCF’s Falco to Protect Yourself from the New SCARLETEEL Attack!
32mThreat Hunting at Scale: Auditing Thousands of Clusters With Falco + F...