Falco Conquering Cloud Security
summary
Falco extends its host runtime security to cloud-wide, real-time telemetry by ingesting logs through CloudTrail and GitHub plugins and running its boolean rule engine before long-term storage to reduce alert latency to immediate. The project (80 million downloads) claims support for tens of millions of events per second, demos a GitHub plugin that detects secrets and a malicious GitHub Actions crypto miner, and integrates with Falcosidekick to notify or terminate containers in real time.
AI-written summary · about
chapters (11)
- 0:00Cloud security context
- 2:20Falco runtime security
- 9:24Linux kernel event listening
- 13:38Falco components and policy engine
- 17:58Rule grammar and policy customization
- 19:46Falco cloud-native evolution
- 23:40Cloud security importance
- 25:46Building Falco plugins
- 30:04Live demo: Falco with GitHub plugin
- 37:51Advanced use cases and limits
- 40:22Q&A
related talks
29mDetecting cloud and container threats
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
09mKeynote: Detecting Threats in GitHub with Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
28mSecurity In the Cloud With Falco: Overview And Project Updates
10mHow to Use CNCF’s Falco to Protect Yourself from the New SCARLETEEL Attack!
01h 33mCloud Native Runtime Security with Falco
38mDeep Dive: Falco