Project Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
Lightningat KubeCon + CloudNativeCon Europe 2025 · on Tuesday, 2025-04-01· at 14:15· Platinum Suite | Level 3·
summary
Falco is a CNCF-graduated runtime security tool that inspects syscall-based rules at the kernel level and emits text alerts that include Kubernetes and cloud context. It ingests events from clusters, cloud accounts and other sources, outputs to SIEMs, queues and dashboards, and ships a response engine plus plugins for forwarding or automated remediation. Users report finding unexpected node activity, customizing rules to reduce noise, and building bespoke plugins when integrations weren’t available; Falco runs in production and the ecosystem actively evolves.
AI-written summary · about
related talks
53mResponding in time to threats in Kubernetes with Falco
29mDetecting cloud and container threats
54mResponding to security events on Kubernetes, let's build a Security..
36mIntro: Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
47mFalco Conquering Cloud Security
45mRemediate Cloud-Native Threats in Real-Time with Talon
39mKubernetes proactive threat detection with Falco and Prometheus