How to Use CNCF’s Falco to Protect Yourself from the New SCARLETEEL Attack!
summary
Falco is a CNCF runtime detector that uses eBPF probes and a rule engine to spot each step of the SCARLETEEL path: unexpected inbound container activity, calls to the AWS instance metadata server, and unusual binary downloads or AWS CLI use for lateral movement. Project claims ~100 million downloads and ~48% recent adoption; a new plugin architecture and a universal eBPF adapter let Falco ingest cloud audit logs, Kubernetes events and custom streams and emit real‑time alerts to SIEMs or Slack, enabling detection at every stage.
AI-written summary · about
related talks
25mUse Falco and eBPF to protect your applications
36mIntro: Falco
38mIntro: Falco
47mFalco Conquering Cloud Security
38mIntro: Falco
29mDetecting cloud and container threats
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter