Forensics With Falco
summary
Falco now records captured activity on rule triggers to timestamped files and integrates with StratoShark for packet‑style investigation; the demo replays a pipe-based SSH key exfiltration. Capture is off by default and needs enable true plus a path prefix (default /tmp/falco), and stop conditions are currently a millisecond duration (future options: event count or file size). Enabling read and write system calls raises overhead and risks an observer effect, so deploy cautiously.
AI-written summary · about
related talks
47mFalco Conquering Cloud Security
38mDeep Dive: Falco
39mDeep Dive: Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
27mIntro: Falco
36mIntro: Falco
34mThe Eye of Falco: You Can Escape but Not Hide
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…