Runtime K8s Security: Threat Detection with Falcosidekick
summary
Falco (kernel eBPF or module) captures syscalls and Falcosidekick fans out alerts to 60+ destinations while the Falcosidekick UI shows rule, severity and tags in real time. Lab uses Kubernetes Goat, Metasploit and Atomic Red Team atomics: Falco flags an interactive exec into container, records a container contacting the API server, and reports when Metasploit created pod on host after exploiting a permissive service account token. Falco Talon is recommended for automated responses like labeling or terminating pods.
AI-written summary · about
chapters (9)
- 0:00Welcome and Introduction
- 0:49Speaker Background and Experience
- 2:05Importance of Cloud and Kubernetes
- 3:22Introduction to Falco and Threat Detection
- 8:25Hands-On Lab Setup
- 9:14Kubernetes Goat and Practical Scenarios
- 13:19Falco Sidekick UI Demonstration
- 18:36Metasploit and Atomic Red Team Tests
- 21:43Conclusion and Next Steps
related talks
42mFalco & Falcosidekick
54mResponding to security events on Kubernetes, let's build a Security..
36mIntro: Falco
25mUse Falco and eBPF to protect your applications
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
27mIntro: Falco
27mFalco meets MITRE - Run any Falco Installation against Atomic Red
29mDetecting cloud and container threats