Threat Hunting at Scale: Auditing Thousands of Clusters With Falco + F...
summary
Trendyol builds an Audit Monitoring System that ingests Kubernetes audit logs and kernel events, enriches them via Falco and Fluent Bit deployed as a daemonset, and indexes them to Loki with Grafana dashboards. The pipeline processes roughly 300k audits per second across thousands of clusters, peaks at ~400k audits and about 8k events scanned by Falco per second, and produces tuned Falco rules, team-level alerts and real-time dashboards that the team reports as working in production.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:35Presentation Overview
- 13:50Falco Overview
- 15:10Falco Data Pipeline
- 18:20Why Falco with Log Processor
- 19:15Monitoring
- 19:50Log Query
- 20:35Log Organization
- 21:50Metric Queries
- 22:25Challenges
- 23:45Specs
- 24:25Dashboards
- 25:40Demo
- 29:45Bonus
related talks
38mDeep Dive: Falco
39mKubernetes proactive threat detection with Falco and Prometheus
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
53mResponding in time to threats in Kubernetes with Falco
54mResponding to security events on Kubernetes, let's build a Security..
25mContainer Runtime Security with Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
36mIntro: Falco