Skip to content

Commit

Permalink
Move kubernetes-response-engine to falcosecurity/kubernetes-response-…
Browse files Browse the repository at this point in the history
…engine (#539)

* Move kubernetes-response-engine to falcosecurit/kubernetes-response-engine

As long as Falco and Response Engine have different release cycle, they
are separated.

* Add a README explaining that repository has been moved

@mfdii is absolutely right about this on #539
  • Loading branch information
nestorsalceda authored and mfdii committed Feb 20, 2019
1 parent d7568ac commit a31c3c0
Show file tree
Hide file tree
Showing 61 changed files with 4 additions and 3,129 deletions.
20 changes: 4 additions & 16 deletions integrations/kubernetes-response-engine/README.md
Original file line number Diff line number Diff line change
@@ -1,18 +1,6 @@
# Kubernetes Response Engine for Sysdig Falco
# Kubernetes Response Engine directory moved

A response engine for Falco that allows to process security events executing playbooks to respond to security threats.
As long as Kubernetes Response Engine and Falco has different release cycles,
the Kubernetes Response Engine has been moved to its own repository.

## Architecture

* *[Falco](https://sysdig.com/opensource/falco/)* monitors containers and processes to alert on unexpected behavior. This is defined through the runtime policy built from multiple rules that define what the system should and shouldn't do.
* *falco-nats* forwards the alert to a message broker service into a topic compound by `falco.<severity>.<rule_name_slugified>`.
* *[NATS](https://nats.io/)*, our message broker, delivers the alert to any subscribers to the different topics.
* *[Kubeless](https://kubeless.io/)*, a FaaS framework that runs in Kubernetes, receives the security events and executes the configured playbooks.

## Glossary

* *Security event*: Alert sent by Falco when a configured rule matches the behaviour on that host.
* *Playbook*: Each piece code executed when an alert is received to respond to that threat in an automated way, some examples include:
- sending an alert to Slack
- stop the pod killing the container
- taint the specific node where the pod is running
You can find it in https://github.com/falcosecurity/kubernetes-response-engine

This file was deleted.

17 changes: 0 additions & 17 deletions integrations/kubernetes-response-engine/deployment/aws/Makefile

This file was deleted.

23 changes: 0 additions & 23 deletions integrations/kubernetes-response-engine/deployment/aws/README.md

This file was deleted.

This file was deleted.

This file was deleted.

29 changes: 0 additions & 29 deletions integrations/kubernetes-response-engine/deployment/aws/lambda.tf

This file was deleted.

14 changes: 0 additions & 14 deletions integrations/kubernetes-response-engine/deployment/aws/outputs.tf

This file was deleted.

3 changes: 0 additions & 3 deletions integrations/kubernetes-response-engine/deployment/aws/sns.tf

This file was deleted.

This file was deleted.

20 changes: 0 additions & 20 deletions integrations/kubernetes-response-engine/deployment/cncf/README.md

This file was deleted.

This file was deleted.

This file was deleted.

This file was deleted.

Loading

0 comments on commit a31c3c0

Please sign in to comment.