Navigating the Storm
summary
Falco uses kernel system calls via eBPF to detect runtime threats and the demo shows FalcoSidekick streaming those alerts into a live FalcoSidekick UI dashboard. The demo triggers a privileged pod, an interactive shell into a container, and a crypto‑miner connection that Falco flags and tags with MITRE ATT&CK IDs. FalcoSidekick lists about 65 integrations, extracts IPs/commands/container metadata, and the UI displays real‑time alerts and priorities so detection and basic automated response are visibly working.
AI-written summary · about
chapters (18)
- 0:00Welcome
- 1:10Runtime security and Falco
- 3:19Falco’s CNCF graduation
- 5:01Kernel probes vs eBPF
- 6:48Falco architecture
- 7:51Falco rules and macros
- 10:02Falco Sidekick
- 12:29Simple Falco rule
- 16:21Out-of-the-box rules
- 19:09Sidekick integrations
- 21:37Demo setup and UI
- 22:41Live demo: privileged container
- 26:56Detecting terminal shell into a container
- 29:45Crypto mining detection
- 33:22Data exfiltration via control plane
- 37:35Analyzing events with UI
- 38:38Falco Talon future
- 39:21Q&A
related talks
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
23mRuntime K8s Security: Threat Detection with Falcosidekick
42mFalco & Falcosidekick
25mUse Falco and eBPF to protect your applications
54mResponding to security events on Kubernetes, let's build a Security..
36mIntro: Falco
27mFalco meets MITRE - Run any Falco Installation against Atomic Red
27mIntro: Falco