Kubernetes proactive threat detection with Falco and Prometheus
summary
A working observability stack for Kubernetes that detects runtime threats using Falco and Prometheus. Falco captures syscalls with auto-updating Falco rules, Falco Sidekick posts real-time webhooks to Microsoft Teams (examples: root creating files under /root or opening a shell inside a container) and can invoke serverless functions for automated response. Prometheus scrapes node_exporter, Postgres exporter and Falco Sidekick metrics, and Prometheus+Alertmanager plus a prom-ms-teams proxy send prioritized alerts; the entire setup runs on a single observability node and demos complete end-to-end.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:05Kubernetes runtime security
- 3:32Three phases of proactive security
- 7:45Prometheus metrics and alerts
- 13:08Falco runtime intrusion detection
- 16:20Integrated monitoring architecture
- 20:14Real-time notifications
- 23:04Application monitoring rules
- 27:18Open source stack benefits
- 30:28Quick config and deployment
- 33:58Automated Falco actions
- 35:21Resources and conclusion
related talks
54mResponding to security events on Kubernetes, let's build a Security..
53mResponding in time to threats in Kubernetes with Falco
23mAutomatic Threat Response Engine for Kubernetes
36mIntro: Falco
23mRuntime K8s Security: Threat Detection with Falcosidekick
27mIntro: Falco
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
29mDetecting cloud and container threats