Intro: Falco
summary
Falco (a CNCF Sandbox project) and its role in container runtime security for Kubernetes are explained, distinguishing runtime security from other security layers. The talk covers using Falco’s eBPF integration to detect abnormal system calls, detecting anomalous behavior in the Kubernetes API server, and getting started writing Falco rules and contributing to the project.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:59About me.
- 2:11Falco Team
- 2:28Help Wanted
- 6:02Falco: a CNCF sandbox project.
- 8:00Falco internal architecture.
- 9:55Additional event sources.
- 13:15Kubernetes audit events.
- 19:09Supporting K8s audit events.
- 19:41JSON pointers.
- 20:37Accessing K8s audit events.
- 22:44K8s audit rule example
- 33:21Join the community.
related talks
38mIntro: Falco
36mIntro: Falco
25mContainer Runtime Security with Falco
27mIntro: Falco
53mResponding in time to threats in Kubernetes with Falco
54mResponding to security events on Kubernetes, let's build a Security..
01h 33mCloud Native Runtime Security with Falco
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco