Falco is an open source runtime security monitor for containers that detects anomalous activity using rules. It builds on Sysdig by instrumenting the kernel and collecting system calls and events. Falco rules define suspicious behaviors and integrate signals from the kernel, containers, and Kubernetes. Falco detects threats by matching patterns in real time and alerts on suspicious activity, helping operators enforce policies and spot abnormal behavior.

1. Container Security
with Falco
Lorenzo David, Senior Software Engineer at Sysdig
Torino

2. • What Security problems does Falco solve?
• Falco Architecture and Design
• Falco in Action !
Agenda

3. What Security problem
Falco solves?

4. Infrastructure Activities
Allowed
Non
Authorized

5. Infrastructure Activities
Allowed
Non
Authorized
Suspicious

6.
Prevention
Enforcing security policies
Infrastructure Activities
Allowed
Non
Authorized
Detection
Spotting anormal behaviours
Suspicious

7. Detection
Forensic Runtime Forcast
Falco

8. What is Falco?

9. Falco
Docker and Kubernetes
aware
CNCF
Sandbox Project
Open Source Runtime Behavioral Activity Monitor
Container Native Infrastructure
and other…

10. What does Falco
actually do?

11. Form Factor
Linux Container
$ docker run falcosecurity/falco
Linux Program
$ apt-get install -y falco
falco.org/docs/installation

12. In a nutshel…
1)
2)

13. How Falco does that?

14. It all started with Sysdig…

15. Sysdig
Falco
github.com/draios/sysdig
github.com/falcosecurity/falco

16. Single host
Kernel
Userspace
nginx
(container)
mongo
(container)
Java Virtual Machine
POSIX interface
cassandra
Bare-metal or Virtual Machine

17. Sysdig
Kernel Instrumentation
Kernel
Userspace
Host
nginx
(container)
myapp
(container)
JVM
Linux Kernel
Module
cassandra
Programs and Containers System Calls
tracepoint
system call

18. Sysdig
User Space Filtering
Kernel
Userspace
Host
nginx
(container)
myapp
(container)
JVM
Linux Kernel
Module
cassandra
…
System
call
Collector
Complex filtering engine
…
Filtering
tracepoint
system call

19. Sysdig
Support for ebpf
Kernel
Userspace
Host
nginx
(container)
myapp
(container)
JVM
ebpf
cassandra
…
System
call
Collector
…
Filtering
tracepoint
system call
February 27, 2019 - sysdig.com/blog/sysdig-and-falco-now-powered-by-ebpf

20. Beyond System Call

21. Sysdig
Instrumentation
Host
nginx
(container)
myapp
(container)
JVM
ebpf
cassandra
…
Statsd metrics
Statsd
metric
Collector
Filtering
statsd
System
call
Collector

22. Sysdig
Instrumentation
Host
nginx
(container)
myapp
(container)
JVM
ebpf
cassandra
JMX
metric
Collector
JMX metrics
…
Filtering
JMX
System
call
Collector

23. Back to Falco

24. Falco
Filtering
Detection workflow
Host
nginx
(container)
myapp
(container)
JVM
interface
cassandra
Rule engine
Falco Ruleset
ALERT
!
ebpf
clone + exec shell
A shell was used as the entrypoint/exec point into a
container with an attached terminal.
condition: >
spawned_process and container
and shell_procs and proc.tty != 0
and container_entrypoint
……
System
call
Collector

25. Falco Rules
- rule: Terminal shell in container
desc: A shell was used as the entrypoint/exec point into a container with an
attached terminal.
condition: >
spawned_process and container
and shell_procs and proc.tty != 0
and container_entrypoint
output: >
A shell was spawned in a container with an attached terminal
(user=%user.name %container.info shell=%proc.name parent=%proc.pname
cmdline=%proc.cmdline terminal=%proc.tty)
priority: NOTICE
tags: [container, shell]
falco.org/docs/rules/default-custom/

26. Falco and Kubernetes

27. Kubernetes
Host Host Host
SVC (1)
SVC (2)
SVC (3)

28. Falco Daemonset
Host Host Host
SVC (1)
SVC (2)
SVC (3)
Falco Falco Falco
Falco
Daemonset
github.com/falcosecurity/falco/tree/dev/integrations/k8s-using-daemonset

29. Orchestrator Metadata
nginx
(container)
myapp
(container)
Orchestrator
metadata
Kubernetes
API
Server
dev prodFalco
ebpf
…
System
call
Collector
…
Filtering
Rule engine
Falco Ruleset
ClusterName: demo-kubeaws
KubernetesNodeName: ip-10-1.ec2.internal
Deployment: example-demo-app

30. Kubernetes Audit Events
nginx
(container)
myapp
(container)
Kubernetes
API
Server
Falco
ebpf
…
System
call
Collector
Webhook
k8s audit
Delete Pod
myapp
Kubernetes Audit
Events
(json stream)
Filtering
Rule engine
ALERT
!
Falco Ruleset
November 12, 2018 - sysdig.com/blog/falco-0-13-released-kubernetes-audit-support/

31. Falco Rules
# Detect any new pod created in the kube-system namespace
- rule: Pod Created in Kube Namespace
desc: Detect any attempt to create a pod in the kube-system
or kube-public namespaces
condition: kevt and pod and kcreate and ka.target.namespace in
(kube-system, kube-public)
output: Pod created in kube namespace
(user=%ka.user.name pod=%ka.resp.name ns=%ka.target.namespace
image=%ka.req.container.image)
priority: WARNING
source: k8s_audit
tags: [k8s]
Container Metadata and Kubernetes Audit Events

32. Falco as building block

33. Falco
Elasticsearch, Fluentd and Kibana
Stdout
Syslog
File
Shell
Alerting
Kibana
ElasticSearch
Fluentd
Filtering
Rule engine
……
System
call
Collector
sysdig.com/blog/kubernetes-security-logging-fluentd-falco

34. EFK Falco
sysdig.com/blog/kubernetes-security-logging-fluentd-falco

35. • What Security problems does Falco solve?
• Falco Architecture and Design
• Falco in Action !
Thank you!

36. We’re hiring.

37. Github
• https://github.com/falcosecurity/falco
Documentation
• https://github.com/falcosecurity/falco/wiki
Docker Hub
• https://hub.docker.com/r/falcosecurity/falco/
Join the community.
Website
https://falco.org
Public Slack
http://slack.sysdig.com/
https://sysdig.slack.com/messages/falco
Blog
https://sysdig.com/blog/tag/falco/