Container Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
summary
Demonstrates a working open source evidence pipeline: Falco 0.42 writes scap files (continuous syscall capture) that Falco Talon previously provided, StratoShark replays and filters syscall timelines, and the Kubernetes Checkpoint API freezes container runtime with memory (CRI-O had issues; runC/CRun works on Kubernetes 1.30+). Demo shows root compromise, token exfiltration and passwd modification recovered from scap and checkpoint; captures are large (GBs), storage/retention and multi‑pod correlation remain manual work.
AI-written summary · about
chapters (11)
- 0:00Container forensics intro
- 1:04Core challenge today
- 2:31Detective and trickster analogy
- 6:46Frost forensic guardian tools
- 9:58Live demo forensic pipeline
- 14:34Attack analysis evidence capture
- 17:22Solving investigation gap
- 18:47Tools state and limits
- 21:13Forensic pipeline with open source
- 22:14Key takeaways and future
- 23:19Q&A
related talks
37mCSI Forensics: Unraveling Kubernetes Crime Scenes
34mContainer Forensics: What to Do When Your Cluster is a Cluster
39mCSI Container: Can You DFIR It?
42mForensic container checkpointing and analysis - Adrian Reber
32mForensic container checkpointing and analysis
38mOpen Source Security Tools for Kubernetes Applications
32mForensic Container Checkpointing
23mRuntime K8s Security: Threat Detection with Falcosidekick