Intro: Falco
summary
Falco is presented as a CNCF Sandbox project for container runtime security, with concrete coverage of runtime security vs. other Kubernetes security layers. The talk demonstrates enabling syscall abnormality detection via Falco’s eBPF integration and detecting abnormal behavior in the Kubernetes API server, and explains how to get started writing Falco rules and contributing to the project.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:59About me.
- 2:11Falco Team
- 2:28Help Wanted
- 6:02Falco: a CNCF sandbox project.
- 8:00Falco internal architecture.
- 9:55Additional event sources.
- 13:15Kubernetes audit events.
- 19:09Supporting K8s audit events.
- 19:41JSON pointers.
- 20:37Accessing K8s audit events.
- 22:44K8s audit rule example
- 33:21Join the community.
related talks
38mIntro: Falco
36mIntro: Falco
25mContainer Runtime Security with Falco
27mIntro: Falco
54mResponding to security events on Kubernetes, let's build a Security..
53mResponding in time to threats in Kubernetes with Falco
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
39mDeep Dive: Falco