falco

What it does

How to write it

falco [-r RULES_FILE] [-o key=value] [--list] [-U]
systemctl status falco-modern-bpf

Main parts

Rule file parts

rule / desc / condition / output / priority

One detection.

macro

Reusable condition part.

list

Reusable list of values (binaries, paths).

append / override

Change default rules without editing them.

priority EMERGENCY…DEBUG

Severity of the rule.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Install on Kubernetes with Helm

   $helm repo add falcosecurity https://falcosecurity.github.io/charts
   $helm install falco falcosecurity/falco -n falco --create-namespace --set driver.kind=modern_ebpf --set tty=true
   $kubectl -n falco logs -l app.kubernetes.io/name=falco -f

2. 2Trigger a test alert

   $kubectl exec -it deploy/shop -n shop -- sh -c "cat /etc/shadow"
   $kubectl -n falco logs -l app.kubernetes.io/name=falco | grep -i shadow
   Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow ... container_name=shop k8s_ns=shop k8s_pod=shop-7c9d6b8f5-x2k4p)

3. 3Install on RHEL as a service

   #rpm --import https://falco.org/repo/falcosecurity-packages.asc
   #curl -s -o /etc/yum.repos.d/falcosecurity.repo https://falco.org/repo/falcosecurity-rpm.repo
   #dnf install -y falco
   #systemctl enable --now falco-modern-bpf

4. 4Write your own rule

   #cat /etc/falco/rules.d/shop.yaml
   - rule: Shell in shop container
     desc: Someone started a shell in a shop pod
     condition: spawned_process and container and k8s.ns.name = "shop" and proc.name in (sh, bash, ash)
     output: "Shell in shop pod (user=%user.name pod=%k8s.pod.name cmd=%proc.cmdline)"
     priority: WARNING

5. 5Validate rules before restart

   #falco -V /etc/falco/rules.d/shop.yaml
   #systemctl restart falco-modern-bpf

6. 6Add allowed programs to a default rule (no edit of the original)

   #cat /etc/falco/rules.d/exceptions.yaml
   - list: user_known_package_manager_in_container
     items: [apk]
     override:
       items: append

7. 7Find the fields you can use

   #falco --list | grep -E "^k8s\.|^container\." | head

8. 8Send alerts to Slack with Falcosidekick

   $helm upgrade falco falcosecurity/falco -n falco --reuse-values --set falcosidekick.enabled=true --set falcosidekick.config.slack.webhookurl=https://hooks.slack.com/services/T000/B000/XXXX

9. 9JSON output for SIEMs

   #cat /etc/falco/config.d/json.yaml
   json_output: true
   file_output: { enabled: true, filename: /var/log/falco/events.json }

10. 10See which rules are loaded

    #falco -L | head -40

Nothing matches this filter.

Files

/etc/falco/falco.yaml

Main config.

/etc/falco/falco_rules.yaml

Default rules (do not edit).

/etc/falco/rules.d/

Your rules and overrides.

Exit codes