domains / families / security / detecting-container-runtime-threats-with-falco

detecting-container-runtime-threats-with-falco

separate

Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detects container escape, namespace abuse, privileged mounts, and anomalous syscalls. Use when standing Falco up on a cluster, choosing between the eBPF and kernel-module drivers, routing Falco alerts into a SIEM or Falcosidekick, or upgrading an existing deployment. Keywords: Falco, modern_ebpf, kernel module, Helm, Falcosidekick, runtime security, syscall. Do not use for authoring individual escape rules - use detecting-container-escape-with-falco-rules.

When to use

• Building runtime detections for a Kubernetes or Docker environment
• Validating that container-escape and lateral-movement attempts generate alerts (purple-team)
• Adding coverage for a newly disclosed runtime CVE
• Hardening a SOC's container telemetry pipeline (Falco -> Falcosidekick -> SIEM)

When not to use

• authoring individual escape rules

Skill page

Source