Falco runtime security: reading alerts and writing your first rule

What Falco watches

Falco is a CNCF runtime security tool that watches system calls through an eBPF probe, enriches them with container and Kubernetes metadata, and evaluates them against rules. Default rules cover behaviors such as a shell spawned in a container, writes below /etc, reading sensitive files like /etc/shadow, and unexpected outbound connections.

Anatomy of a rule

A rule has a condition written in Falco’s filter syntax, an output string with fields, a priority, and tags. Macros and lists keep conditions readable. Exceptions let you exclude known-good images or processes without editing the base rule.

Snippet

- list: allowed_debug_images
  items: [docker.io/library/busybox]

- rule: Package manager run in container
  desc: A package manager ran inside a running container
  condition: >
    spawned_process and container and proc.name in (apt, apt-get, apk, yum, dnf, pip)
    and not container.image.repository in (allowed_debug_images)
  output: >
    Package manager in container (user=%user.name cmd=%proc.cmdline
    pod=%k8s.pod.name ns=%k8s.ns.name image=%container.image.repository)
  priority: WARNING
  tags: [container, drift]

Lab: trigger and read

Install Falco with Helm on a kind or minikube cluster using the modern eBPF driver. Start a test pod, exec into it with a shell, and read the Falco logs: the Terminal shell in container rule fires with the pod, namespace, image, and command line. Add the custom rule above through a values file, run apk add curl in an alpine pod, and confirm your rule fires.

Snippet

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco -n falco --create-namespace --set driver.kind=modern_ebpf
kubectl run shelltest --image=alpine:3.20 -- sleep 3600
kubectl exec -it shelltest -- sh -c 'id; exit'
kubectl -n falco logs -l app.kubernetes.io/name=falco --tail=20 | grep -i shell

Tuning

Expect noise from legitimate tools at first. Add exceptions scoped to a specific image and process rather than disabling rules. Send alerts to a SIEM or Slack with Falcosidekick, and treat high-priority alerts in production namespaces as incidents to triage.

Diagram

Example default detections

Behaviors, not signatures.

Terminal shell in container
An interactive shell started inside a container.
Read sensitive file untrusted
A process read /etc/shadow or similar.
Write below etc
A file under /etc was modified at runtime.
Contact K8S API server from container
A container unexpectedly called the API server.

Check yourself

1. What data source does Falco primarily inspect?

2. You exec into a pod with sh. Which default rule is most likely to fire?

3. A rule is noisy for one known debug image. What is the best fix?