Eline @eliine.dev · Nov 3

There’s also a third system that is in alpha called Falco Talon. This system allows you to react to events immediately based on rules. For example you could say that a set of rules would terminate the container immediately! Or it could run a script, do a tcpdump, cordon a node or many other things 💫

1 likes 1 replies

?

Replies

Eline · Nov 3

Falco ships with a set of default rules that cover a large set of security events like credential exfiltration and executing shells. I’m somewhat doubtful that they cover most cases though, so I envision it will be some work maintaining a custom rules library.