Questions tagged [falco]

Falco is an anomaly detection engine for cloud native

Filter by
Sorted by
Tagged with
0 votes
1 answer
133 views

Falco k8s audit plugin usage

I am using Azure AKS cluster. Have deployed the falco helm chart with the k8s-audit plugin. But I am not getting any events for k8s-audit in the falco log.Following is the falco configuration. falco: ...
Ajinkya16's user avatar
  • 255
0 votes
1 answer
19 views

Why I do not see the file path in a simple falco rule output concerning the cat command?

Here is my rule: - rule: My test rule desc: Alert when cat is executed condition: spawned_process and proc.name = cat output: TEST_RULE_ALERT (command=%proc.cmdline pid=%proc.pid file=%fd.name ...
mark's user avatar
  • 59.7k
1 vote
1 answer
40 views

Combining two different CMakefiles (gRPC and libsinsp) into a same program

I need to create a consolidated program with Libsinsp and gRPC. How the program works? Collects the syscall data with Libsinsp Transfer the data with gRPC I have created both programs, and would ...
Jeremy Chong's user avatar
1 vote
0 answers
62 views

In /etc/falco i can't see falco_rules.yaml [closed]

In /etc/falco i can only see falco_rules.yaml . I can't see falco_rules.local.yaml or rules.d directory. I am installing through official helm chart How to load local falco rule file with own set of ...
Abhishek Kumar's user avatar
0 votes
0 answers
97 views

Falco Installation failure due to GPG key

I am trying to install Falco on OCI instance but it is failing with the following error: Following this blog: https://blogs.oracle.com/cloud-infrastructure/post/monitor-oke-cluster-using-falco?source=:...
Lizzie's user avatar
  • 343
0 votes
1 answer
241 views

Falco pod initcontainer is not working. curl: (22) The requested URL returned error: 404

I am trying to install falco on my kubernetes cluster with helm chart. I am deploying as Deamonset and using ebpf but getting error on my init containers. What should I do? This is my values yaml
Pablo's user avatar
  • 1
1 vote
2 answers
263 views

How to define a rule to capture alerts when any manual command gets executed inside the container on Falco

Installed Falco drivers on the host. Able to capture alerts for specific conditions like when there is a process spawned or if any script is getting executed inside the container. But the requirement ...
Harika's user avatar
  • 11
0 votes
1 answer
29 views

How to catch an ouppuit of a process or a command

I'm trying to write a rule where the condition depends on the output of a script.sh. I had tried several approaches, but I did not have success. Searching in your documentation but didn´t find ...
RAUL RODRIGUEX's user avatar
0 votes
1 answer
240 views

Falco - Readiness probe failed: Get "http://10.62.94.129:8765/healthz": dial tcp 10.62.94.129:8765: connect: connection refused

I have a falco image that is crashing because of readiness proble failed I have this set Liveness: http-get http://:8765/healthz delay=60s timeout=5s period=15s #success=1 #failure=3 ...
jlamenza's user avatar
0 votes
1 answer
46 views

falco docker containers monitoring

Can any one of you please tell me where I can find the way to monitor docker images with falco? Now I'm using Ubuntu for testing purposes, but in the end I want to use it in AWS Fargate environment. ...
RAUL RODRIGUEX's user avatar
1 vote
2 answers
440 views

Issue installing Falco on K3s (PopOS)

I am trying to install Falco on my home lab (K3s v1.23.6+k3s1 on Pop!_OS v20.04). For work I need to create a response engine, for that I have chosen FalcoSidekick and OpenFAAS - before taking this to ...
user1314147's user avatar
0 votes
1 answer
469 views

Falco: couldn't get in datasource k8s-audit in Falcosidekick UI after deploy falco with k8saudit plugin

my test environment: kubernetes: 1.20.15 falco: 0.32.1 falco helm chart: falco-2.0.17 my deployment process. deploy falco with helm, with k8saudit plugin $helm repo add falcosecurity https://...
lizi's user avatar
  • 1
0 votes
1 answer
461 views

Falco pod is not working init:ImagePullBackOff

I'm using helm chart of falco and here are the commands helm repo add falcosecurity https://falcosecurity.github.io/charts helm repo update helm install falco falcosecurity/falco Here's the output ...
ssi_knowledge's user avatar
0 votes
1 answer
84 views

Falco node info

How do we get the node information from falco threats events response. According to current supported fields for conditions we do not get any information regarding the node name as such. https://falco....
Ajinkya16's user avatar
  • 255
1 vote
0 answers
184 views

Falco k8s, when add an exception, some fields become null

If I add an exception to the rule 'The docker client is executed in a container' like: exceptions: - name: kube_mon fields: [container.image.repository, k8s.ns.name, k8s.pod.name] comps: [=, ...
OlehR's user avatar
  • 11
0 votes
2 answers
210 views

Falco deployment in namespace

How do we deploy falco in adifferent namespace as it is deployed in the default namespace? How do we specify on which namespace to install falco charts?
Ajinkya16's user avatar
  • 255
2 votes
0 answers
454 views

Falco installation on Digital Ocean Kubernetes

While installing falco on Digital Ocean managed kubernetes. I am getting the following error Runtime error: can't open BPF probe '/root/.falco/falco-bpf.o': Errno 2. Exiting. I know this is caused ...
Ajinkya16's user avatar
  • 255
1 vote
0 answers
148 views

What is causing rules to fire repeatedly?

I have created a local test environment using minikube to test custom falco rules. The goal is to search for keywords in the namespace and pod names and set an Info priority on them so they can be ...
CastleCorp's user avatar
1 vote
2 answers
159 views

Falco output aws instance metadata

I run falco and falcosidekick with docker compose, without k8s. I need to retrive aws instance metadata to falco rules output. I've found the jevt field class but I encountered an error on falco ...
Daniele's user avatar
  • 568
1 vote
1 answer
552 views

Falco security and falcosidekick on docker compose

I'm trying to run falco and falcosikick container in a docker compose. version: "3.9" services: falco: image: falcosecurity/falco:latest privileged: true volumes: - /var/...
Daniele's user avatar
  • 568
0 votes
1 answer
190 views

Enabling audit rules in falco

I had installed falco using helm in my minikube cluster(v1.22.0 kubernetes v1.17.17). The falco is working good and showing logs for default rules in falco-rules.yaml but when it comes comes to k8s ...
Sathya's user avatar
  • 69
1 vote
0 answers
358 views

Falco audit rules is not showing any alerts

I trying to enable falco audit rules. [https://sysdig.com/blog/kubernetes-audit-log-falco/][1] Iam following this blog to get enable k8s audit rules in falco . Iam using minikube v1.22.0 Kubernetes v1....
Sathya's user avatar
  • 69
0 votes
1 answer
1k views

no matches for kind "Config" in version "v1"

I tried to run a config file to set Falco as my backend webhook. Iam getting this error on trying to run my config file revaa@revaa-Lenovo-E41-25:~/opa$ kubectl apply -f conflc.yaml error: unable to ...
Sathya Narayanan's user avatar
0 votes
0 answers
46 views

Volume mount on SCC as requirement for running Falco

Is it possible to run falco with removing several volume value on scc ? for example just putting hostpath only as value on falco SCC because on the environment (OCP & k8s) only permitted to access ...
Indra's user avatar
  • 1
0 votes
2 answers
1k views

Falco output formation

I am using runtime detection tool Falco to analyse the container behavior for at least 40 seconds, using filters that detect newly spawning and executing processes store the incident file art /opt/...
O.Man's user avatar
  • 601
1 vote
1 answer
140 views

How to identify commands ran by Ansible on a remote host in Falco context?

I would like to know if someone has an idea about how to identify commands ran by Ansible within a remote host. To give you more context I'm gonna describe my workflow in-depth: I have a scheduled ...
Arch's user avatar
  • 13
6 votes
1 answer
2k views

Logs not getting sent to AWS Cloudwatch when docker in detached or foreground

When I run the docker script in interactive mode it works. I can see the logs in the console and also in AWS CloudWatch Logs. The below docker script runs in interactive mode and I have added the ...
kumar's user avatar
  • 8,559
0 votes
1 answer
538 views

Falco crashes in aws ECS

I am trying to run the docker container in ECS when I do that I get the following error. the task definitions https://github.com/sysdiglabs/falco-aws-firelens-integration/blob/master/ecs/falco/task-...
kumar's user avatar
  • 8,559
2 votes
0 answers
1k views

Loop crashes with Falco

I'm currently experimenting with Falco (a runtime monitoring solution for container). I'm working locally on a Mac (Catalina v10.15.3), have Helm (v3.1.2) installed, Docker (version 2.2.0.5 (43884)) ...
Pacifuras's user avatar
  • 116