Runtime Security Reference

Kernel syscalls (open, exec, connect, …)
  → Falco eBPF probe (per node)
  → Falco engine (rules evaluation)
  → Alert output
      ├── stdout (default)
      ├── Falcosidekick (fan-out: Slack, PagerDuty, SNS, webhook)
      └── gRPC output (for programmatic consumers)

# falco-values.yaml — EKS with modern_ebpf driver
driver:
  kind: modern_ebpf   # no kernel headers required; needs Linux 5.8+ with BTF

falco:
  grpc:
    enabled: true     # enables gRPC output for programmatic consumers
  grpc_output:
    enabled: true
  json_output: true   # structured output; required for Falcosidekick parsing
  priority: warning   # suppress DEBUG and INFO from default ruleset

resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    memory: 512Mi     # cpu limit intentionally omitted — kernel event processing is bursty

tolerations:
  - effect: NoSchedule
    operator: Exists  # Falco must run on ALL nodes including tainted ones
  - effect: NoExecute
    operator: Exists

driver:
  kind: modern_ebpf

tolerations:
  - effect: NoSchedule
    key: node.kubernetes.io/not-ready
    operator: Exists
  - effect: NoSchedule
    key: node-role.kubernetes.io/control-plane
    operator: Exists

- rule: Unexpected binary executed in web container
  desc: A binary not in the known-good set was exec'd in the web-tier container
  condition: >
    spawned_process
    and container
    and container.image.repository = "ghcr.io/<org>/web"
    and not proc.name in (node, npm, sh, bash)
  output: >
    Unexpected binary in web container
    (user=%user.name image=%container.image.repository
     binary=%proc.name parent=%proc.pname cmdline=%proc.cmdline
     pod=%k8s.pod.name ns=%k8s.ns.name)
  priority: WARNING
  tags: [container, execution, custom]

- list: allowed_web_binaries
  items: [node, npm, sh]

- macro: web_container
  condition: container.image.repository = "ghcr.io/<org>/web"

- rule: Unexpected binary in web container
  condition: spawned_process and web_container and not proc.name in (allowed_web_binaries)
  output: >
    Unexpected binary in web container
    (user=%user.name binary=%proc.name cmdline=%proc.cmdline pod=%k8s.pod.name)
  priority: WARNING
  tags: [container, execution, custom]

customRules:
  custom-rules.yaml: |-
    - list: allowed_web_binaries
      items: [node, npm, sh]
    - rule: Unexpected binary in web container
      condition: spawned_process and container and not proc.name in (allowed_web_binaries)
      output: "Binary %proc.name in container %container.name"
      priority: WARNING

# Deploy the official event-generator to trigger known-bad syscall patterns
kubectl run event-generator \
  --image=falcosecurity/event-generator \
  --restart=Never \
  --rm -it -- run syscall

# Watch Falco logs on the same node
kubectl logs -n falco -l app.kubernetes.io/name=falco | grep WARNING

helm upgrade --install falco falcosecurity/falco \
  --namespace falco \
  --create-namespace \
  --set falcosidekick.enabled=true \
  --set falcosidekick.webui.enabled=true \
  -f falco-values.yaml

falcosidekick:
  config:
    slack:
      webhookurl: "https://hooks.slack.com/services/<token>"
      minimumpriority: warning   # suppress DEBUG and INFO
      messageformat: >
        :rotating_light: *{{ .Rule }}* ({{ .Priority }})
        Container: `{{ index .OutputFields "container.name" }}`
        Image: `{{ index .OutputFields "container.image.repository" }}`
        Cmdline: `{{ index .OutputFields "proc.cmdline" }}`
        Pod: `{{ index .OutputFields "k8s.pod.name" }}` in `{{ index .OutputFields "k8s.ns.name" }}`

apiVersion: policies.kyverno.io/v1
kind: ValidatingPolicy
metadata:
  name: block-falco-flagged-workloads
spec:
  validationActions: [Deny]
  matchConstraints:
    resourceRules:
    - apiGroups: ["apps"]
      apiVersions: ["v1"]
      operations: ["CREATE", "UPDATE"]
      resources: ["deployments"]
  validations:
  - expression: >
      !has(object.metadata.labels) ||
      !('security.platform/falco-alert' in object.metadata.labels) ||
      object.metadata.labels['security.platform/falco-alert'] != 'critical'
    message: >
      This Deployment is flagged by a Falco critical alert. Remediate and remove
      the security.platform/falco-alert label before redeploying.