FIND, FOCUS, and FIX the Container and Cloud Threats that Matter
summary
Open-source Falco runs as a DaemonSet or host service, captures syscalls via eBPF kernel modules, and matches events against custom Falco rules (demo shows a rule watching /tmp) to emit contextual alerts including container ID, process and exec info; a live demo triggers two alerts for a kubectl exec plus file creation. Falco Sidekick visualizes alerts and forwards to webhooks/SIEMs; integrations include Kubernetes audit, AWS CloudTrail, Docker and Okta. Suitable if wanting concrete detection + automation hooks.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker intro
- 1:11Kubernetes success and hidden threats
- 5:23Cloud native security approach needed
- 6:05Falco as open source security standard
- 9:57Real-world use case and demo setup
- 12:47Technical deep dive into Falco rules
- 16:43Live attack simulation and alerts
- 19:33Falco Sidekick for alerts and automation
- 21:41Mitigating the troubled ops scenario
- 23:46How Falco helps the company recover
- 24:07Getting started with Falco
- 26:58Q&A and closing remarks
related talks
29mDetecting cloud and container threats
41mNavigating the Storm
23mRuntime K8s Security: Threat Detection with Falcosidekick
54mResponding to security events on Kubernetes, let's build a Security..
36mIntro: Falco
39mDeep Dive: Falco
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
27mIntro: Falco