Questions tagged [falco]
Falco is an anomaly detection engine for cloud native
29
questions
0
votes
1
answer
133
views
Falco k8s audit plugin usage
I am using Azure AKS cluster. Have deployed the falco helm chart with the k8s-audit plugin. But I am not getting any events for k8s-audit in the falco log.Following is the falco configuration.
falco:
...
0
votes
1
answer
19
views
Why I do not see the file path in a simple falco rule output concerning the cat command?
Here is my rule:
- rule: My test rule
desc: Alert when cat is executed
condition: spawned_process and proc.name = cat
output: TEST_RULE_ALERT (command=%proc.cmdline pid=%proc.pid file=%fd.name ...
1
vote
1
answer
40
views
Combining two different CMakefiles (gRPC and libsinsp) into a same program
I need to create a consolidated program with Libsinsp and gRPC.
How the program works?
Collects the syscall data with Libsinsp
Transfer the data with gRPC
I have created both programs, and would ...
1
vote
0
answers
62
views
In /etc/falco i can't see falco_rules.yaml [closed]
In /etc/falco i can only see falco_rules.yaml . I can't see falco_rules.local.yaml or rules.d directory. I am installing through official helm chart
How to load local falco rule file with own set of ...
0
votes
0
answers
97
views
Falco Installation failure due to GPG key
I am trying to install Falco on OCI instance but it is failing with the following error:
Following this blog: https://blogs.oracle.com/cloud-infrastructure/post/monitor-oke-cluster-using-falco?source=:...
0
votes
1
answer
241
views
Falco pod initcontainer is not working. curl: (22) The requested URL returned error: 404
I am trying to install falco on my kubernetes cluster with helm chart. I am deploying as Deamonset and using ebpf but getting error on my init containers. What should I do?
This is my values yaml
1
vote
2
answers
263
views
How to define a rule to capture alerts when any manual command gets executed inside the container on Falco
Installed Falco drivers on the host.
Able to capture alerts for specific conditions like when there is a process spawned or if any script is getting executed inside the container. But the requirement ...
0
votes
1
answer
29
views
How to catch an ouppuit of a process or a command
I'm trying to write a rule where the condition depends on the output of a script.sh. I had tried several approaches, but I did not have success.
Searching in your documentation but didn´t find ...
0
votes
1
answer
240
views
Falco - Readiness probe failed: Get "http://10.62.94.129:8765/healthz": dial tcp 10.62.94.129:8765: connect: connection refused
I have a falco image that is crashing because of readiness proble failed
I have this set
Liveness: http-get http://:8765/healthz delay=60s timeout=5s period=15s #success=1 #failure=3
...
0
votes
1
answer
46
views
falco docker containers monitoring
Can any one of you please tell me where I can find the way to monitor docker images with falco? Now I'm using Ubuntu for testing purposes, but in the end I want to use it in AWS Fargate environment.
...
1
vote
2
answers
440
views
Issue installing Falco on K3s (PopOS)
I am trying to install Falco on my home lab (K3s v1.23.6+k3s1 on Pop!_OS v20.04). For work I need to create a response engine, for that I have chosen FalcoSidekick and OpenFAAS - before taking this to ...
0
votes
1
answer
469
views
Falco: couldn't get in datasource k8s-audit in Falcosidekick UI after deploy falco with k8saudit plugin
my test environment:
kubernetes: 1.20.15
falco: 0.32.1
falco helm chart: falco-2.0.17
my deployment process.
deploy falco with helm, with k8saudit plugin
$helm repo add falcosecurity https://...
0
votes
1
answer
461
views
Falco pod is not working init:ImagePullBackOff
I'm using helm chart of falco and here are the commands
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
helm install falco falcosecurity/falco
Here's the output
...
0
votes
1
answer
84
views
Falco node info
How do we get the node information from falco threats events response. According to current supported fields for conditions we do not get any information regarding the node name as such.
https://falco....
1
vote
0
answers
184
views
Falco k8s, when add an exception, some fields become null
If I add an exception to the rule 'The docker client is executed in a container' like:
exceptions:
- name: kube_mon
fields: [container.image.repository, k8s.ns.name, k8s.pod.name]
comps: [=, ...
0
votes
2
answers
210
views
Falco deployment in namespace
How do we deploy falco in adifferent namespace as it is deployed in the default namespace? How do we specify on which namespace to install falco charts?
2
votes
0
answers
454
views
Falco installation on Digital Ocean Kubernetes
While installing falco on Digital Ocean managed kubernetes. I am getting the following error
Runtime error: can't open BPF probe '/root/.falco/falco-bpf.o': Errno 2. Exiting. I know this is caused ...
1
vote
0
answers
148
views
What is causing rules to fire repeatedly?
I have created a local test environment using minikube to test custom falco rules.
The goal is to search for keywords in the namespace and pod names and set an Info priority on them so they can be ...
1
vote
2
answers
159
views
Falco output aws instance metadata
I run falco and falcosidekick with docker compose, without k8s.
I need to retrive aws instance metadata to falco rules output.
I've found the jevt field class but I encountered an error on falco ...
1
vote
1
answer
552
views
Falco security and falcosidekick on docker compose
I'm trying to run falco and falcosikick container in a docker compose.
version: "3.9"
services:
falco:
image: falcosecurity/falco:latest
privileged: true
volumes:
- /var/...
0
votes
1
answer
190
views
Enabling audit rules in falco
I had installed falco using helm in my minikube cluster(v1.22.0 kubernetes v1.17.17). The falco is working good and showing logs for default rules in falco-rules.yaml but when it comes comes to k8s ...
1
vote
0
answers
358
views
Falco audit rules is not showing any alerts
I trying to enable falco audit rules.
[https://sysdig.com/blog/kubernetes-audit-log-falco/][1]
Iam following this blog to get enable k8s audit rules in falco .
Iam using minikube v1.22.0 Kubernetes v1....
0
votes
1
answer
1k
views
no matches for kind "Config" in version "v1"
I tried to run a config file to set Falco as my backend webhook. Iam getting this error on trying to run my config file
revaa@revaa-Lenovo-E41-25:~/opa$ kubectl apply -f conflc.yaml
error: unable to ...
0
votes
0
answers
46
views
Volume mount on SCC as requirement for running Falco
Is it possible to run falco with removing several volume value on scc ? for example just putting hostpath only as value on falco SCC because on the environment (OCP & k8s) only permitted to access ...
0
votes
2
answers
1k
views
Falco output formation
I am using runtime detection tool Falco to analyse the container behavior for at least 40 seconds, using filters that detect newly spawning and executing processes store the incident file art /opt/...
1
vote
1
answer
140
views
How to identify commands ran by Ansible on a remote host in Falco context?
I would like to know if someone has an idea about how to identify commands ran by Ansible within a remote host.
To give you more context I'm gonna describe my workflow in-depth:
I have a scheduled ...
6
votes
1
answer
2k
views
Logs not getting sent to AWS Cloudwatch when docker in detached or foreground
When I run the docker script in interactive mode it works. I can see the logs in the console and also in AWS CloudWatch Logs. The below docker script runs in interactive mode and I have added the ...
0
votes
1
answer
538
views
Falco crashes in aws ECS
I am trying to run the docker container in ECS when I do that I get the following error.
the task definitions https://github.com/sysdiglabs/falco-aws-firelens-integration/blob/master/ecs/falco/task-...
2
votes
0
answers
1k
views
Loop crashes with Falco
I'm currently experimenting with Falco (a runtime monitoring solution for container).
I'm working locally on a Mac (Catalina v10.15.3), have Helm (v3.1.2) installed, Docker (version 2.2.0.5 (43884)) ...