Deep Dive: Falco
summary
Falco now ingests Kubernetes audit events via an embedded web endpoint and treats them as a second event stream alongside kernel syscalls, using JSON pointer filtering and reusable macros to write rules. Demo runs against Minikube (Kubernetes 1.11) with an audit policy and an SSH tunnel to an unencrypted Falco endpoint and shows alerts firing for configmaps containing credentials, for namespace and serviceaccount creation, and for detects exec/attach attempts even when the actions fail. Helm chart and tighter auth are in progress.
AI-written summary · about
chapters (4)
related talks
39mDeep Dive: Falco
54mResponding to security events on Kubernetes, let's build a Security..
36mIntro: Falco
25mContainer Runtime Security with Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
01h 33mCloud Native Runtime Security with Falco
30mIn the Eye of Falco: Transforming Your View of Linux Kernel Security
32mThreat Hunting at Scale: Auditing Thousands of Clusters With Falco + F...