Cloud Native Runtime Security with Falco
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 14:25· Room 31ABC - San Diego Convention Center, Upper Level·
summary
Falco captures kernel syscalls via an eBPF probe (with a kernel‑module fallback), enriches each event with container and Kubernetes metadata, and runs as a daemonset deployment that emits alerts over gRPC, webhooks or stdout. Frame.io consumes raw Falco events into a serverless pipeline (S3 → Lambda → Elasticsearch) called Driftwood and routes alerts through Bobby; this setup processes about 240–250 million events/day, supports centralized rules, whitelisting and throttling, and runs in production.
AI-written summary · about
chapters (22)
- 0:00Intro
- 6:00Kris Nova
- 14:23Falco History
- 15:38The Linux Kernel
- 19:31Falco
- 21:48Runtime Security
- 23:48LD Preload
- 27:07Summary
- 31:10How EBPF Works
- 32:50Banana Experiment
- 34:50Using Falco
- 37:15Falco output
- 39:04Falco auditing
- 40:52Klogs
- 42:36Container ID
- 43:55Questions
- 49:05Platform overview
- 50:42Container metrics
- 53:53What is Falco
- 54:55Requirements
- 57:04Soft Requirements
- 57:58Serverless Technology
related talks
36mIntro: Falco
25mContainer Runtime Security with Falco
39mDeep Dive: Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
54mResponding to security events on Kubernetes, let's build a Security..
29mDetecting cloud and container threats
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
38mDeep Dive: Falco