Use Falco and eBPF to protect your applications
summary
Demo shows Falco + eBPF probe capturing syscalls and immediately alerting on executed shells, curl, API access and file overwrites in a Kubernetes pod. Architecture details list libscap and libsinsp, plugins for EKS/GitLab/Docker, and one Falco per node because probes run in kernel space. Defaults include about 70 rules for common attacker techniques; alerts flow to Falcosidekick and UIs, and the demo proves real-time detection and contextual fields (user, pod, namespace, command).
AI-written summary · about
chapters (21)
- 0:00intro
- 0:21preface
- 0:55runtime security?
- 1:38syscalls
- 2:42falco what's that?
- 3:00ebpf...
- 4:10the hooks
- 4:44the verification
- 5:40falco's architecture
- 7:07libscap aka library for system capture
- 7:30libsinsp aka library for system inspection
- 8:17falco: the rule engine
- 11:23falco: the default ruleset
- 13:21connect falco: falcosidekick
- 15:15react to events
- 15:57falcosidekick ui
- 16:31the evolution: the plugins
- 18:58falco's current architecture
- 19:14demo
- 24:22getting started
- 24:56how to contribute
