Falco lets you set the rules for Kubernetes security
Falco is a CNCF Incubating project
It was the first runtime security project under CNCF
Falco operates at the Linux kernel level
At the core of Falco is a list of rules
These rules govern all events in a Kubernetes cluster
Falco sends out alerts when a rule is violated
Here are some example events Falco checks
Container running in privileged mode
Server processes that create a new child process
Any resource that reads a sensitive file
The starting of a new privileged pod
These are all potentially major security vulnerabilities
Falco can monitor these events and apply rules against them
Falco’s rules are defined in a YAML file
If any rule in Falco is violated, it triggers an alert
Falco also has macros which are reusable mini-rules
Macros are used to quickly and predictably create macros
Falco enables you to track all changes to a K8s cluster
You can turn K8s pod security policies into Falco rules
Falco is the most important CNCF security project
Include it in your tool K8s stack
To know more about Falco and related topics, please visit www.TwainTaylor.com