Re: Upcoming Sysdig Falco TOC Presentation

alexis richardson

thanks! posting this was a great idea, and Sets A Precedent imho

On Thu, Jul 5, 2018 at 7:59 PM, Michael Ducy <michael.ducy@...> wrote:
During the next TOC meeting Loris Degioanni and myself are presenting on
Sysdig's open source security project, Falco. I wanted to provide a summary
of info that can be used to learn more about Falco ahead of that

What it is: Falco detects abnormal behavior inside containers and container
hosts. This includes reading/writing files, network connections, ports
listening, process spawned, and more.

Why you need it: Falco can detect abnormal behavior, or attacks, inside a
Cloud Native platform, and trigger action such as killing the offending
container, marking a node as tainted, etc.

TOC Sponsor: Ken Owens

Proposed Level: Sandbox


TOC Presentation:

TOC Proposal:

Community Presentations:

- Kubernetes Runtime Security: What Happens if a Container Goes Bad? - Jen
Tong & Maya Kaczorowski:
Jen and Maya do an excellent job of explaining the problem of runtime

- Avoiding Tainted Tenant Apps with Staging Gates and Electric Fences - Bret
Mogilefsky, 18F explains how they use Falco to evict Cloud Foundry applications
that are compromised.

Blog Posts:

Using Falco with an Elasticsearch, Fluentd, Kibana (EFK) stack to collect
security events -

Using Falco with NATS and Kubeless to react to security events -

Deploying Falco with Helm -

Integrate Falco with Google Cloud Security Command Center -

Default Falco rule sets for common applications -

I'm happy to answer anyone's questions about Falco and where we want to take
the project. We look forward to presenting in a few weeks.


Join { to automatically receive all group messages.