Responding to security events on Kubernetes, let's build a Security..
summary
Shows Falco deployed via Helm using either a kernel module or eBPF probe, with ~100 detection rules and Falco Sidekick forwarding alerts to Loki. Demonstrates an OpenFaaS function that parses Falco JSON alerts, checks namespace/pod whitelists, and issues Kubernetes API deletes to remove compromised pods; demo triggers on reading /etc/shadow and the pod terminates successfully. Includes helm one-liner installs, logfile/GRPC outputs, and real-time automated remediation.
AI-written summary · about
chapters (13)
- 0:00Introduction to talk
- 3:22Installing Falco on Kubernetes
- 8:48First demo detecting shell spawn
- 10:14Introducing Falco Sidekicks
- 13:11How Falco detects suspicious activity
- 16:21Falco installation methods
- 21:19Why Kubernetes security matters
- 27:59Falco architecture and benefits
- 31:51Second demo sending logs to Loki
- 38:00Building a response engine
- 41:55Third demo auto-terminating pods
- 51:32Real-time event response summary
- 52:12Conclusion and future of Falco
