![Falco Rules
- rule: Terminal shell in container
desc: A shell was used as the entrypoint/exec point into a container with an
attached terminal.
condition: >
spawned_process and container
and shell_procs and proc.tty != 0
and container_entrypoint
output: >
A shell was spawned in a container with an attached terminal
(user=%user.name %container.info shell=%proc.name parent=%proc.pname
cmdline=%proc.cmdline terminal=%proc.tty)
priority: NOTICE
tags: [container, shell]
falco.org/docs/rules/default-custom/](https://image.slidesharecdn.com/david-containersecuritywithfalco-190614163846/85/David-container-security-with_falco-25-320.jpg)
![Falco Rules
# Detect any new pod created in the kube-system namespace
- rule: Pod Created in Kube Namespace
desc: Detect any attempt to create a pod in the kube-system
or kube-public namespaces
condition: kevt and pod and kcreate and ka.target.namespace in
(kube-system, kube-public)
output: Pod created in kube namespace
(user=%ka.user.name pod=%ka.resp.name ns=%ka.target.namespace
image=%ka.req.container.image)
priority: WARNING
source: k8s_audit
tags: [k8s]
Container Metadata and Kubernetes Audit Events](https://image.slidesharecdn.com/david-containersecuritywithfalco-190614163846/85/David-container-security-with_falco-31-320.jpg)
David container security-with_falco
- 1. Container Security with Falco Lorenzo David, Senior Software Engineer at Sysdig Torino
- 2. • What Security problems does Falco solve? • Falco Architecture and Design • Falco in Action ! Agenda
- 3. What Security problem Falco solves?
- 6. Prevention Enforcing security policies Infrastructure Activities Allowed Non Authorized Detection Spotting anormal behaviours Suspicious
- 9. Falco Docker and Kubernetes aware CNCF Sandbox Project Open Source Runtime Behavioral Activity Monitor Container Native Infrastructure and other…
- 10. What does Falco actually do?
- 11. Form Factor Linux Container $ docker run falcosecurity/falco Linux Program $ apt-get install -y falco falco.org/docs/installation
- 13. How Falco does that?
- 14. It all started with Sysdig…
- 16. Single host Kernel Userspace nginx (container) mongo (container) Java Virtual Machine POSIX interface cassandra Bare-metal or Virtual Machine
- 17. Sysdig Kernel Instrumentation Kernel Userspace Host nginx (container) myapp (container) JVM Linux Kernel Module cassandra Programs and Containers System Calls tracepoint system call
- 18. Sysdig User Space Filtering Kernel Userspace Host nginx (container) myapp (container) JVM Linux Kernel Module cassandra … System call Collector Complex filtering engine … Filtering tracepoint system call
- 19. Sysdig Support for ebpf Kernel Userspace Host nginx (container) myapp (container) JVM ebpf cassandra … System call Collector … Filtering tracepoint system call February 27, 2019 - sysdig.com/blog/sysdig-and-falco-now-powered-by-ebpf
- 23. Back to Falco
- 24. Falco Filtering Detection workflow Host nginx (container) myapp (container) JVM interface cassandra Rule engine Falco Ruleset ALERT ! ebpf clone + exec shell A shell was used as the entrypoint/exec point into a container with an attached terminal. condition: > spawned_process and container and shell_procs and proc.tty != 0 and container_entrypoint …… System call Collector
- 25. Falco Rules - rule: Terminal shell in container desc: A shell was used as the entrypoint/exec point into a container with an attached terminal. condition: > spawned_process and container and shell_procs and proc.tty != 0 and container_entrypoint output: > A shell was spawned in a container with an attached terminal (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty) priority: NOTICE tags: [container, shell] falco.org/docs/rules/default-custom/
- 27. Kubernetes Host Host Host SVC (1) SVC (2) SVC (3)
- 28. Falco Daemonset Host Host Host SVC (1) SVC (2) SVC (3) Falco Falco Falco Falco Daemonset github.com/falcosecurity/falco/tree/dev/integrations/k8s-using-daemonset
- 29. Orchestrator Metadata nginx (container) myapp (container) Orchestrator metadata Kubernetes API Server dev prodFalco ebpf … System call Collector … Filtering Rule engine Falco Ruleset ClusterName: demo-kubeaws KubernetesNodeName: ip-10-1.ec2.internal Deployment: example-demo-app
- 30. Kubernetes Audit Events nginx (container) myapp (container) Kubernetes API Server Falco ebpf … System call Collector Webhook k8s audit Delete Pod myapp Kubernetes Audit Events (json stream) Filtering Rule engine ALERT ! Falco Ruleset November 12, 2018 - sysdig.com/blog/falco-0-13-released-kubernetes-audit-support/
- 31. Falco Rules # Detect any new pod created in the kube-system namespace - rule: Pod Created in Kube Namespace desc: Detect any attempt to create a pod in the kube-system or kube-public namespaces condition: kevt and pod and kcreate and ka.target.namespace in (kube-system, kube-public) output: Pod created in kube namespace (user=%ka.user.name pod=%ka.resp.name ns=%ka.target.namespace image=%ka.req.container.image) priority: WARNING source: k8s_audit tags: [k8s] Container Metadata and Kubernetes Audit Events
- 32. Falco as building block
- 33. Falco Elasticsearch, Fluentd and Kibana Stdout Syslog File Shell Alerting Kibana ElasticSearch Fluentd Filtering Rule engine …… System call Collector sysdig.com/blog/kubernetes-security-logging-fluentd-falco
- 35. • What Security problems does Falco solve? • Falco Architecture and Design • Falco in Action ! Thank you!
- 36. We’re hiring.
- 37. Github • https://github.com/falcosecurity/falco Documentation • https://github.com/falcosecurity/falco/wiki Docker Hub • https://hub.docker.com/r/falcosecurity/falco/ Join the community. Website https://falco.org Public Slack http://slack.sysdig.com/ https://sysdig.slack.com/messages/falco Blog https://sysdig.com/blog/tag/falco/