Automatic Threat Response Engine for Kubernetes
summary
Demonstrates an automated threat-response system for Kubernetes that uses Falco, Falco SideKick and Falco Thalon to detect and mitigate attacks in real time. Explains combining multiple data sources for detection and automating responses to save operator time and strengthen Kubernetes security posture.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:05Kubernetes security challenges
- 2:08What is Falco
- 3:51Falco threat detection
- 8:27Falco architecture
- 10:15Creating Falco rules
- 11:18Falco default rules
- 12:41AWS event detection
- 13:44Falco installation
- 15:52Alert visualization
- 17:18Extending outputs
- 17:59Detection and response layers
- 18:41Talon project
- 20:26Talon response rules
- 21:50Falco ecosystem
related talks
53mResponding in time to threats in Kubernetes with Falco
39mKubernetes proactive threat detection with Falco and Prometheus
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
23mRuntime K8s Security: Threat Detection with Falcosidekick
54mResponding to security events on Kubernetes, let's build a Security..
45mRemediate Cloud-Native Threats in Real-Time with Talon
27mFalco meets MITRE - Run any Falco Installation against Atomic Red
42mFalco & Falcosidekick