Think eBPF for Kernel Security Monitoring
summary
Apple describes deploying Falco eBPF probe to collect syscall metadata, using libbpf and BTF for compile once run anywhere, and adding kernel-space file-descriptor capture so Falco logs show opens, execs and dup/socket steps that reveal LFI→RCE and container package-manager misuse. Built tooling includes bpf tool for introspection and per-host profiling; results show meaningful detections within one day, acceptable CPU/memory cost, and ongoing needs: better eBPF perf analysis, signed programs, and richer metadata to solve intent attribution because syscalls never lie.
AI-written summary · about
chapters (8)
- 0:00Start
- 5:38Linux Runtime Security Monitoring
- 5:58Linux System Call Auditing - Security Relevance
- 6:49High-Value System Calls for Security Monitoring
- 12:06High-Value Kernel Signals (Directory Traversal Example)
- 16:53Falco - Kernel Security Monitoring at Scale
- 17:37eBPF Kernel Driver Possibilities for Security Monitoring Focused Extensions
- 18:47What if I didn't pay attention? How to start using Falco
related talks
36meBPF for Runtime Security
40mExploring Runtime Security and Forensic using eBPF
32mReal Time Security - eBPF for Preventing attacks
16mWhy Everyone Should Care About eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
32meBPF: The Next Power Tool of SREs
53mGetting Started with BPF Security Observability