Deep Dive: Falco
summary
Falco now ingests non-syscall events by running an embedded Kubernetes audit webhook that feeds a generic event interface into the rules engine, extracting fields with JSON pointers so rules can reference jevent.value. A configmap-driven daemonset deploys Falco using either a kernel module or eBPF probe for syscall capture; demo shows alerts firing for privileged containers, spawned shells and configmap uploads containing credentials, and a response pipeline can auto-delete offending pods — implementation works end-to-end as shown.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:26About me
- 1:07Falco workshop
- 2:02Falco team
- 2:46Falco roadmap
- 4:35C and Lua
- 5:13Falco recap
- 6:31Falco demo
- 12:04How Falco works
- 15:09Extending Falco
- 16:08Kubernetes Audit Events
- 17:50Falco Audit Events
- 18:36Falco Web Server
- 19:42Generic Event Interface
- 20:37JSON Pointer
- 22:47Example
- 25:58Demo
- 28:03kernel module
- 28:47config map
- 29:51event markers
- 33:49Running Falco without route rights
related talks
38mDeep Dive: Falco
27mIntro: Falco
54mResponding to security events on Kubernetes, let's build a Security..
25mContainer Runtime Security with Falco
01h 33mCloud Native Runtime Security with Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
25mUse Falco and eBPF to protect your applications
38mIntro: Falco