Eline @eliine.dev · Nov 3 The Falco agent is installed on a cluster where it will start listening to kernel syscalls with eBPF. This enables it to pick up filesystem events, network calls and pretty much anything. With this info we can write rules that will generate events that we can use to detect suspicious behaviour.
2 likes 1 replies
?
Replies
An example rule can be one that detects a shell being executed in a container, like this video. Here I am executing into a container and getting the /etc/shadow file, which then generates an event in the Falco log.