NoDrop for threat detection with Falco

This page describes how to use NoDrop for threat detection with Falco.

Architecture

In threat detection, NoDrop serves as a high-performance system event collector. The source and field extraction plugins forward captured event data to Falco for downstream threat detection. The following illustrates a practical method for using NoDrop as the data source of Falco.

• NoDrop: Parse events within the monitor component and stream them into the named pipe in JSON format.
• Source Plugin: Read the JSON stream and push it into Falco.
• Extraction Plugin: Extract values from JSON payload.

Configuration

NoDrop

NoDrop needs to stream JSON-formatted data into a named pipe (/tmp/nodrop.fifo) through the monitor component. A code example showing how to write the JSON stream to the pipe can be found in falco_plugin/monitor/src.

Source Plugin

The Source Plugin consists of two files: source.go and plugin.go. These two Go files can be found at falco_plugin. You need to place these two files in the same directory and compile them into a .so file. You can run the following commands in the directory:

go mod init <module_name>
go mod tidy
go build -buildmode=plugin -o <output_name>.so

Extraction Plugin

We leverage the official, open-source JSON plugin provided by the Falco community to handle field extraction. This plugin acts as a consumer for the events produced by our custom source plugin.

Falco

First, you need to install Falco on your machine. Detailed steps are available on the Falco website.

Second, you need to modify the falco.yaml file to enable plugin configuration.

You can run the following command:

sudo nano /etc/falco/falco.yaml

Here is a complete falco.yaml snippet showing valid configurations for the two plugins:

load_plugins: [nodrop,json]
plugins:
  - name: nodrop
    library_path: <nodrop_path>
    open_params: "/tmp/nodrop.fifo"
  - name: json
    library_path: <json_path>

Third, you need to author custom Falco rules, as Falco rules are bound to a specific event source. Here is an example below:

- rule: Read Sensitive File /etc/shadow
  desc: Detects any attempt to read the password shadow file
  condition: fd.name == "/etc/shadow" and evt.type in (open, openat)
  output: "Sensitive file opened for reading (user=%user.name command=%proc.cm>
  priority: WARNING
  source: syscall