Keynote: Detecting Threats in GitHub with Falco
summary
Falco extends runtime security to GitHub via a GitHub plugin that creates a webhook and listens for events in real time, detecting pushed secrets (shows file and line), abused Actions running xmrig miners, and accidental repo publishing. Demonstration runs locally against a test repo and reliably emits alerts with file and line within seconds. Rules are plain YAML, user-editable, and Falco is CNCF open source, usable immediately to block or notify on specific GitHub behaviors.
AI-written summary · about
chapters (5)
related talks
47mFalco Conquering Cloud Security
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
29mDetecting cloud and container threats
39mKubernetes proactive threat detection with Falco and Prometheus
53mResponding in time to threats in Kubernetes with Falco
54mResponding to security events on Kubernetes, let's build a Security..
49mProtect Your Code with GitHub Security Features
41mBake Security into your workflow with GitHub Advanced Security and AI