Falco: The Security Camera

Falco (originally by Sysdig, now a CNCF graduated project) is the industry standard for runtime threat detection using eBPF. Think of it as a security camera for your kernel — it watches everything and alerts when it sees something suspicious, but it doesn't physically stop the intruder.

Architecture

Falco has three components:

1. Kernel Driver: Either an eBPF probe or a traditional kernel module (eBPF is preferred for safety). This captures the raw stream of system call events.
2. Falco Engine: A user-space process that receives events from the driver and evaluates them against the rules engine.
3. Rules Engine: A YAML-based rule language that defines conditions and alert outputs.

The Rule Language

Falco rules follow a simple structure: a condition (a boolean expression over event fields) and an output (a formatted alert message). The field namespace is rich — proc.name, container.id, fd.sip (socket IP), user.name, k8s.pod.name, and dozens more.

- rule: Shell Spawned in Container
  desc: >
    Detects when a shell process is spawned inside a container.
    This is a common indicator of an attacker gaining interactive
    access after exploiting a web vulnerability.
  condition: >
    container.id != host
    and proc.name in (bash, sh, zsh, dash)
    and not proc.pname in (bash, sh, zsh, dash)
  output: >
    Shell spawned in container
    (user=%user.name container=%container.name
     image=%container.image.repository
     parent=%proc.pname shell=%proc.name
     cmdline=%proc.cmdline)
  priority: WARNING
  tags: [container, shell, mitre_execution]

The condition container.id != host restricts the rule to containerized processes. proc.pname is the parent process name — excluding cases where a shell spawns another shell (e.g., a legitimate shell script) reduces false positives.

What Falco Can and Cannot Do

Can do:
- Detect anomalous process execution, file access, network connections in real time
- Integrate with Kubernetes metadata (pod name, namespace, labels)
- Output alerts to stdout, syslog, HTTP webhooks, Slack, PagerDuty, Falcosidekick

Cannot do (by default):
- Block the operation. Falco is detective, not preventive. By the time the alert fires, the execve has already succeeded.