runtime-security

Detect and respond to threats inside running containers using Falco.

---

Interactive Wizard (fires when no arguments are provided)

When invoked with no arguments, ask before proceeding:

Q1 — Mode?

What do you need?
  1. install  — deploy Falco on Kubernetes (EKS or GKE) with eBPF driver
  2. rules    — write and test a custom Falco rule
  3. alerts   — configure Falcosidekick to route alerts (Slack, webhook, etc.)
  4. debug    — diagnose why a Falco rule is not firing
  5. harden   — map runtime Falco alerts to Kyverno admission policies

Enter 1–5 or mode name:

Q2 — Context (after mode selected, one at a time):

• install: Which cloud platform? EKS / GKE / other (specify node OS if known):
• rules: Describe the behaviour to detect (e.g. "shell spawned in a container", "unexpected outbound connection"):
• alerts: Which output destination? Slack / webhook / PagerDuty / other:
• debug: Describe the symptom — which rule is not firing, and what event should trigger it?
• harden: Which Falco alert or rule output should block re-admission? (paste the alert or rule name):

Then proceed into the relevant mode below.

---

Mode: install

Deploy Falco on Kubernetes (EKS or GKE) using the eBPF driver via Helm.

Prerequisites:

• Helm 3.x
• kubectl access to the target cluster
• Node OS: Amazon Linux 2/2023 (EKS) or Container-Optimized OS (GKE) — both support eBPF

Steps:

1. Add the Falco Helm repository:

   helm repo add falcosecurity https://falcosecurity.github.io/charts
   helm repo update
   

2. Install Falco with eBPF driver (never kernel module on managed K8s):

   helm install falco falcosecurity/falco \
     --namespace falco \
     --create-namespace \
     -f examples/runtime-security/falco-values.yaml
   

3. Verify DaemonSet is running on all nodes:

   kubectl rollout status daemonset/falco -n falco
   kubectl get pods -n falco -o wide
   

4. Confirm Falco is receiving events:

   kubectl logs -n falco -l app.kubernetes.io/name=falco --tail=20
   

   Expected: lines like Notice A shell was spawned... (from the default ruleset test events)