Remediate Cloud-Native Threats in Real-Time with Talon
summary
A live demo shows Falco Talon tying Falco detections to YAML reaction rules that run without code: ten built‑in actioners (terminate pod, label pod, create Calico/Kubernetes NetworkPolicy, run scripts, fetch logs) execute sequentially and deduplicate events. Falco uses an eBPF probe for syscall visibility and ships 60+ detection rules; Sidekick handles notifications and routing. The demo terminates a compromised pod and applies a network policy in under a millisecond while capturing pre‑termination logs.
AI-written summary · about
chapters (23)
- 0:00Runtime security with Falco
- 1:52What is runtime security?
- 3:15Falco monitors system calls
- 5:01Falco rules and logic
- 7:48Enriching Falco alerts
- 8:51Falco architecture and plugins
- 10:35Falco detection and alerts
- 10:55Falco Sidekick notifications
- 13:25Need for automated response
- 16:34Introducing Falco Talon
- 17:16Falco Talon events and actions
- 20:30Falco Talon rule example
- 22:58Talon sequential actions
- 23:59Demo: Falco Talon in action
- 28:36Kubernetes security primitives
- 35:40Q&A: Falco vs SIMs
- 37:24Q&A: Plugins and rules
- 38:06Q&A: In-memory detection
- 38:28Q&A: Talon permissions
- 39:30Q&A: Packet capture
- 40:59Q&A: Forwarding to SIEMs
- 42:06Q&A: Storage and UI
- 43:53Closing
related talks
54mResponding to security events on Kubernetes, let's build a Security..
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
36mIntro: Falco
23mRuntime K8s Security: Threat Detection with Falcosidekick
42mFalco & Falcosidekick
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
53mResponding in time to threats in Kubernetes with Falco
29mDetecting cloud and container threats