Falco & Falcosidekick
summary
Demonstrates a closed-loop security workflow using Falco for kernel-level detection, Falcosidekick to enrich and route alerts, and a serverless function that auto-creates a Kubernetes NetworkPolicy to isolate a pod. The demo reproduces an outbound-connection rule, sends alerts to Loki/Prometheus/Slack, and shows the automatic remediation successfully blocks further egress.
AI-written summary · about
chapters (8)
- 0:00Start
- 3:52DISCLAIMER
- 12:43A POSSIBLE TECHNOLOGICAL PATH: FALCO
- 15:29INTERESTING... AND HOW DOES FALCO WORK?
- 16:31WHAT DOES FALCO PRECISELY LOOK FOR?
- 17:48BENEFITS OF USING FALCO
- 22:22ANATOMY OF THE FALCO RULE CUSTOM
- 24:55SERVERLESS FUNCTION
related talks
23mRuntime K8s Security: Threat Detection with Falcosidekick
54mResponding to security events on Kubernetes, let's build a Security..
36mIntro: Falco
41mNavigating the Storm
25mUse Falco and eBPF to protect your applications
39mKubernetes proactive threat detection with Falco and Prometheus
38mDeep Dive: Falco
45mRemediate Cloud-Native Threats in Real-Time with Talon