Intro: Falco
summary
Falco monitors Linux syscalls and Kubernetes API metadata to detect runtime anomalies, running as a kernel hook (eBPF or module) plus user‑space engine and shipping with ready rules. Examples include a rule that flags any process reading mounted Secrets more than five seconds after start, detecting interactive shells or binaries being overwritten, and correlating events with Kubernetes namespaces. Integrations include alerts to EFK (Elasticsearch/Fluentd/Kibana), captures syscalls via eBPF/kernel module, and triggers functions (Kubeless, SNS/Lambda) to kill or isolate Pods.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:25Layers of container security
- 0:52Infrastructure security
- 1:21Build security
- 2:40Runtime security
- 4:45An opportunity for anomaly detection
- 5:48Anomaly detection use-cases
- 7:59Falco: a CNCF Sandbox project
- 10:02System calls for observability?
- 11:15Container runtime tools
- 13:14Home security analogy
- 14:18Falco architecture
- 15:11Out of the box Falco rules
- 15:40Creating Falco rules
- 16:17Conditions and filters
- 16:37Quick examples
- 17:24A custom Falco rule
- 18:51Kubernetes Audit log events
- 19:32Kubernetes Audit Falco support
- 19:57Kubernetes Audit Falco fields
- 20:44Kubernetes security response
- 21:21Implementing oss response engine
- 21:51Cloud Native response engine
- 22:21AWS response engine
- 22:33Security playbooks using Faas
- 23:45SIEM with EFK
related talks
36mIntro: Falco
39mDeep Dive: Falco
25mUse Falco and eBPF to protect your applications
54mResponding to security events on Kubernetes, let's build a Security..
23mRuntime K8s Security: Threat Detection with Falcosidekick
38mIntro: Falco
38mIntro: Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter