Skip to content
This repository has been archived by the owner. It is now read-only.
master
Switch branches/tags
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
 
 
 
 
 
 

Kubernetes Response Engine for Sysdig Falco

A response engine for Falco that allows to process security events executing playbooks to respond to security threats.

Architecture

  • Falco monitors containers and processes to alert on unexpected behavior. This is defined through the runtime policy built from multiple rules that define what the system should and shouldn't do.
  • falco-nats forwards the alert to a message broker service into a topic compound by falco.<severity>.<rule_name_slugified>.
  • NATS, our message broker, delivers the alert to any subscribers to the different topics.
  • Kubeless, a FaaS framework that runs in Kubernetes, receives the security events and executes the configured playbooks.

Glossary

  • Security event: Alert sent by Falco when a configured rule matches the behaviour on that host.
  • Playbook: Each piece code executed when an alert is received to respond to that threat in an automated way, some examples include:
    • sending an alert to Slack
    • stop the pod killing the container
    • taint the specific node where the pod is running

About

No description, website, or topics provided.

Resources

Releases

No releases published

Packages

No packages published