Skip to content
No description, website, or topics provided.
Branch: master
Clone or download

README.md

Kubernetes Response Engine for Sysdig Falco

A response engine for Falco that allows to process security events executing playbooks to respond to security threats.

Architecture

  • Falco monitors containers and processes to alert on unexpected behavior. This is defined through the runtime policy built from multiple rules that define what the system should and shouldn't do.
  • falco-nats forwards the alert to a message broker service into a topic compound by falco.<severity>.<rule_name_slugified>.
  • NATS, our message broker, delivers the alert to any subscribers to the different topics.
  • Kubeless, a FaaS framework that runs in Kubernetes, receives the security events and executes the configured playbooks.

Glossary

  • Security event: Alert sent by Falco when a configured rule matches the behaviour on that host.
  • Playbook: Each piece code executed when an alert is received to respond to that threat in an automated way, some examples include:
    • sending an alert to Slack
    • stop the pod killing the container
    • taint the specific node where the pod is running
You can’t perform that action at this time.