Detecting cloud and container threats
summary
Runtime detection uses Falco to watch Linux syscalls via kernel probes or eBPF, applies a rule engine (default rules flag container escape, kubectl exec/attach, crypto miners) and ships JSON events to collectors. Falco runs as a DaemonSet on nodes, has Falco Sidekick to aggregate and forward to Slack, Teams, SIEMs or CloudWatch, and supports plugins for AWS CloudTrail, Azure and GCP. Project stats: 7K GitHub stars and 50M downloads. Detection only, remediation requires external tooling.
AI-written summary · about
chapters (4)
related talks
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
47mFalco Conquering Cloud Security
23mRuntime K8s Security: Threat Detection with Falcosidekick
01h 33mCloud Native Runtime Security with Falco
39mKubernetes proactive threat detection with Falco and Prometheus
25mContainer Runtime Security with Falco
27mIntro: Falco