Questions tagged [falco]
Falco is an anomaly detection engine for cloud native
28
questions
0
votes
0
answers
19
views
Falco pod not connecting to specified HTTP URL
I'm new to kubernetes and falco, and I'm faced with a problem I'm not sure how to fix.
I have an API running on my machine (on http://127.0.0.1:8000, created using FastAPI) that I know is working, and ...
0
votes
0
answers
12
views
Falco pod initcontainer is not working. curl: (22) The requested URL returned error: 404
I am trying to install falco on my kubernetes cluster with helm chart. I am deploying as Deamonset and using ebpf but getting error on my init containers. What should I do?
enter image description ...
1
vote
2
answers
47
views
How to define a rule to capture alerts when any manual command gets executed inside the container on Falco
Installed Falco drivers on the host.
Able to capture alerts for specific conditions like when there is a process spawned or if any script is getting executed inside the container. But the requirement ...
0
votes
1
answer
21
views
How to catch an ouppuit of a process or a command
I'm trying to write a rule where the condition depends on the output of a script.sh. I had tried several approaches, but I did not have success.
Searching in your documentation but didn´t find ...
0
votes
1
answer
68
views
Falco - Readiness probe failed: Get "http://10.62.94.129:8765/healthz": dial tcp 10.62.94.129:8765: connect: connection refused
I have a falco image that is crashing because of readiness proble failed
I have this set
Liveness: http-get http://:8765/healthz delay=60s timeout=5s period=15s #success=1 #failure=3
...
0
votes
0
answers
12
views
Falco not writing to logs about a file being edited
I have deployed falco as a side car to my work load in EKS/Fargate. Falco is able to execute the script that is defined in the image but not able to monitor workload container in runtime, meaning if I ...
0
votes
0
answers
21
views
Falco jq and curl packages not found problem
I tried to deploy Falco via Helm.
And I set program_output for sending messages to slack channel but the problem is falco image doesnt have curl and jq packages.
How can I fix this problem?
My program ...
0
votes
0
answers
11
views
falco docker containers monitoring
Can any one of you please tell me where I can find the way to monitor docker images with falco? Now I'm using Ubuntu for testing purposes, but in the end I want to use it in AWS Fargate environment.
...
1
vote
2
answers
191
views
Issue installing Falco on K3s (PopOS)
I am trying to install Falco on my home lab (K3s v1.23.6+k3s1 on Pop!_OS v20.04). For work I need to create a response engine, for that I have chosen FalcoSidekick and OpenFAAS - before taking this to ...
0
votes
1
answer
155
views
Falco: couldn't get in datasource k8s-audit in Falcosidekick UI after deploy falco with k8saudit plugin
my test environment:
kubernetes: 1.20.15
falco: 0.32.1
falco helm chart: falco-2.0.17
my deployment process.
deploy falco with helm, with k8saudit plugin
$helm repo add falcosecurity https://...
0
votes
1
answer
188
views
Falco pod is not working init:ImagePullBackOff
I'm using helm chart of falco and here are the commands
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
helm install falco falcosecurity/falco
Here's the output
...
0
votes
1
answer
37
views
Falco node info
How do we get the node information from falco threats events response. According to current supported fields for conditions we do not get any information regarding the node name as such.
https://falco....
0
votes
0
answers
62
views
Falco returning multiple alerts for a rule
I have installed falco through helm charts, but I am getting 7 alerts for the rule 'Terminal shell in container'. Is anyone facing the same issue and is there a way to fix this. The timestamp is also ...
1
vote
0
answers
97
views
Falco k8s, when add an exception, some fields become null
If I add an exception to the rule 'The docker client is executed in a container' like:
exceptions:
- name: kube_mon
fields: [container.image.repository, k8s.ns.name, k8s.pod.name]
comps: [=, ...
0
votes
1
answer
104
views
Falco deployment in namespace
How do we deploy falco in adifferent namespace as it is deployed in the default namespace? How do we specify on which namespace to install falco charts?
2
votes
0
answers
316
views
Falco installation on Digital Ocean Kubernetes
While installing falco on Digital Ocean managed kubernetes. I am getting the following error
Runtime error: can't open BPF probe '/root/.falco/falco-bpf.o': Errno 2. Exiting. I know this is caused ...
1
vote
0
answers
90
views
What is causing rules to fire repeatedly?
I have created a local test environment using minikube to test custom falco rules.
The goal is to search for keywords in the namespace and pod names and set an Info priority on them so they can be ...
1
vote
2
answers
115
views
Falco output aws instance metadata
I run falco and falcosidekick with docker compose, without k8s.
I need to retrive aws instance metadata to falco rules output.
I've found the jevt field class but I encountered an error on falco ...
1
vote
1
answer
321
views
Falco security and falcosidekick on docker compose
I'm trying to run falco and falcosikick container in a docker compose.
version: "3.9"
services:
falco:
image: falcosecurity/falco:latest
privileged: true
volumes:
- /var/...
0
votes
1
answer
141
views
Enabling audit rules in falco
I had installed falco using helm in my minikube cluster(v1.22.0 kubernetes v1.17.17). The falco is working good and showing logs for default rules in falco-rules.yaml but when it comes comes to k8s ...
1
vote
0
answers
204
views
Falco audit rules is not showing any alerts
I trying to enable falco audit rules.
[https://sysdig.com/blog/kubernetes-audit-log-falco/][1]
Iam following this blog to get enable k8s audit rules in falco .
Iam using minikube v1.22.0 Kubernetes v1....
0
votes
1
answer
420
views
no matches for kind "Config" in version "v1"
I tried to run a config file to set Falco as my backend webhook. Iam getting this error on trying to run my config file
revaa@revaa-Lenovo-E41-25:~/opa$ kubectl apply -f conflc.yaml
error: unable to ...
0
votes
0
answers
36
views
Volume mount on SCC as requirement for running Falco
Is it possible to run falco with removing several volume value on scc ? for example just putting hostpath only as value on falco SCC because on the environment (OCP & k8s) only permitted to access ...
0
votes
2
answers
537
views
Falco output formation
I am using runtime detection tool Falco to analyse the container behavior for at least 40 seconds, using filters that detect newly spawning and executing processes store the incident file art /opt/...
1
vote
1
answer
99
views
How to identify commands ran by Ansible on a remote host in Falco context?
I would like to know if someone has an idea about how to identify commands ran by Ansible within a remote host.
To give you more context I'm gonna describe my workflow in-depth:
I have a scheduled ...
6
votes
1
answer
1k
views
Logs not getting sent to AWS Cloudwatch when docker in detached or foreground
When I run the docker script in interactive mode it works. I can see the logs in the console and also in AWS CloudWatch Logs. The below docker script runs in interactive mode and I have added the ...
0
votes
1
answer
440
views
Falco crashes in aws ECS
I am trying to run the docker container in ECS when I do that I get the following error.
the task definitions https://github.com/sysdiglabs/falco-aws-firelens-integration/blob/master/ecs/falco/task-...
2
votes
0
answers
1k
views
Loop crashes with Falco
I'm currently experimenting with Falco (a runtime monitoring solution for container).
I'm working locally on a Mac (Catalina v10.15.3), have Helm (v3.1.2) installed, Docker (version 2.2.0.5 (43884)) ...