Responding in time to threats in Kubernetes with Falco
summary
Explains using Falco and its ecosystem to detect and respond to security threats in Kubernetes clusters. Covers deploying Falco, integrating it with tools for alerting and automated response, and how to react in time to incidents within cluster environments.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 2:08Runtime security in Kubernetes
- 3:14Introducing Falco
- 6:49System calls and kernel security
- 7:53BPF and its impact on Falco
- 11:00Falco architecture
- 13:07Event enrichment libraries
- 15:55Rule engine and syntax
- 18:43Default and custom rules
- 20:30Alert example and output
- 23:21Plugins and multi-source integration
- 27:07Falcoctl and rule management
- 28:32Falcosidekick and notifications
- 32:44Alert response and engine
- 35:53Talon automated threat response
- 43:20Falco and Talon demo
- 51:04Q&A
related talks
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
23mAutomatic Threat Response Engine for Kubernetes
54mResponding to security events on Kubernetes, let's build a Security..
39mKubernetes proactive threat detection with Falco and Prometheus
25mContainer Runtime Security with Falco
38mIntro: Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
36mIntro: Falco