Intro: Falco
summary
Falco is a CNCF Sandbox runtime security engine that watches kernel system calls (via eBPF-based syscall capture or the Sysdig kernel module), ingests Kubernetes audit events, and evaluates human-readable rules to detect anomalies. Alerts go to EFK or a message broker like NATS, and a functions framework (Kubeless/Lambda) can automatically delete pods, isolate nodes, or capture syscall traces; demo shows an immediate pod-delete on a detected shell. Detection is fast, response time depends on downstream services, and complex rules raise CPU cost.
AI-written summary · about
chapters (21)
- 0:00Start
- 1:34Falco: a CNCF sandbox project.
- 1:57Falco & Google Summer of Code
- 2:22Home security analogy
- 4:21Anomaly detection
- 5:00Use cases.
- 5:42A bit of history.
- 6:52Instrumentation.
- 7:07Falco architecture.
- 7:48Syscalls for observability?
- 8:40Falco rules.
- 10:11Quick examples.
- 11:05A custom Falco rule.
- 13:16K8s audit log rule example.
- 15:07Installing Falco.
- 15:20Installing Falco on kubernetes.
- 16:14Response engine & security playbooks.
- 18:12Response engine on Kubernetes.
- 18:57Response engine on AWS.
- 19:07Response engine on Google Cloud.
- 19:18SIEM with EFK
