Practical Cloud Native Security with Falco: Risk and Threat Detection for Containers, Kubernetes, and Cloud

Preface
    Who Is This Book For?
    Overview
        Part I: The Basics
        Part II: The Architecture of Falco
        Part III: Running Falco in Production
        Part IV: Extending Falco
    Conventions Used in This Book
    Using Code Examples
    O’Reilly Online Learning
    How to Contact Us
    Acknowledgments
        Leonardo
        Loris
I. The Basics
1. Introducing Falco
    Falco in a Nutshell
        Sensors
        Data Sources
        Rules
        Data Enrichment
        Output Channels
        Containers and More
    Falco’s Design Principles
        Specialized for Runtime
        Suitable for Production
        Intent-Free Instrumentation
        Optimized to Run at the Edge
        Avoids Moving and Storing a Ton of Data
        Scalable
        Truthful
        Robust Defaults, Richly Extensible
        Simple
    What You Can Do with Falco
    What You Cannot Do with Falco
    Background and History
        Network Packets: BPF, libpcap, tcpdump, and Wireshark
        Snort and Packet-Based Runtime Security
        The Network Packets Crisis
        System Calls as a Data Source: sysdig
        Falco
2. Getting Started with Falco on Your Local Machine
    Running Falco on Your Local Machine
        Downloading and Installing the Binary Package
        Installing the Driver
        Starting Falco
    Generating Events
    Interpreting Falco’s Output
    Customizing Your Falco Instance
        Rules Files
        Output Channels
    Conclusion
II. The Architecture of Falco
3. Understanding Falco’s Architecture
    Falco and the Falco Libraries: A Data-Flow View
    Drivers
    Plugins
    libscap
        Managing Data Sources
        Supporting Trace Files
        Collecting System State
    libsinsp
        State Engine
        Event Parsing
        Filtering
        Output Formatting
        One More Thing About libsinsp
    Rule Engine
    Conclusion
4. Data Sources
    System Calls
        Examples
        Observing System Calls
    Capturing System Calls
        Accuracy
        Performance
        Scalability
        So What About Stability and Security?
        Kernel-Level Instrumentation Approaches
    The Falco Drivers
        Which Driver Should You Use?
        Capturing System Calls Within Containers
    Running the Falco Drivers
        Kernel Module
        eBPF Probe
        Using Falco in Environments Where Kernel Access Is Not Available: pdig
        Running Falco with pdig
    Falco Plugins
        Plugin Architecture Concepts
        How Falco Uses Plugins
    Conclusion
5. Data Enrichment
    Understanding Data Enrichment for Syscalls
        Operating System Metadata
        Container Metadata
        Kubernetes Metadata
    Data Enrichment with Plugins
    Conclusion
6. Fields and Filters
    What Is a Filter?
    Filtering Syntax Reference
        Relational Operators
        Logical Operators
        Strings and Quoting
    Fields
        Argument Fields Versus Enrichment Fields
        Mandatory Fields Versus Optional Fields
        Field Types
    Using Fields and Filters
        Fields and Filters in Falco
        Fields and Filters in sysdig
    Falco’s Most Useful Fields
        General
        Processes
        File Descriptors
        Users and Groups
        Containers
        Kubernetes
        CloudTrail
        Kubernetes Audit Logs
    Conclusion
7. Falco Rules
    Introducing Falco Rules Files
    Anatomy of a Falco Rules File
        Rules
        Macros
        Lists
        Rule Tagging
        Declaring the Expected Engine Version
    Replacing, Appending to, and Disabling Rules
        Replacing Macros, Lists, and Rules
        Appending to Macros, Lists, and Rules
        Disabling Rules
    Conclusion
8. The Output Framework
    Falco’s Output Architecture
    Output Formatting
    Output Channels
        Standard Output
        Syslog Output
        File Output
        Program Output
        HTTP Output
        gRPC Output
        Other Logging Options
    Conclusion
III. Running Falco in Production
9. Installing Falco
    Choosing Your Setup
    Installing Directly on the Host
        Using a Package Manager
        Without Using a Package Manager
        Managing the Driver
    Running Falco in a Container
        Syscall Instrumentation Scenario
        Plugin Scenario
    Deploying to a Kubernetes Cluster
        Using Helm
        Using Manifests
    Conclusion
10. Configuring and Running Falco
    Configuring Falco
    Differences Among Installation Methods
        Host Installation
        Containers
        Kubernetes Deployments
    Command-Line Options and Environment Variables
        Configuration Settings
        Instrumentation Settings (Syscalls Only)
        Data Enrichment Settings (Syscalls Only)
        Ruleset Settings
        Output Settings
        Other Settings for Debugging and Troubleshooting
    Configuration File
    Ruleset
        Loading Rules Files
        Tuning the Ruleset
    Using Plugins
    Changing the Configuration
    Conclusion
11. Using Falco for Cloud Security
    Why Falco for AWS Security?
    Falco’s Architecture and AWS Security
        Detection Examples
    Configuring and Running Falco for CloudTrail Security
        Receiving Log Files Through an SQS Queue
        Reading Events from an S3 Bucket or the Local Filesystem
    Extending Falco’s AWS Ruleset
    What About Other Clouds?
    Conclusion
12. Consuming Falco Events
    Working with Falco Outputs
        falco-exporter
        Falcosidekick
    Observability and Analysis
    Getting Notified
    Responding to Threats
    Conclusion
IV. Extending Falco
13. Writing Falco Rules
    Customizing the Default Falco Rules
    Writing New Falco Rules
        Our Rule Development Method
    Things to Keep in Mind When Writing Rules
        Priorities
        Noise
        Performance
        Tagging
    Conclusion
14. Falco Development
    Working with the Codebase
        The falcosecurity/falco Repository
        The falcosecurity/libs Repository
        Building Falco from Source
    Extending Falco Using the gRPC API
    Extending Falco with Plugins
        Preparing a Plugin in Go
        Plugin State and Initialization
        Adding Event Sourcing Capability
        Adding Field Extraction Capability
        Finalizing the Plugin
        Building a Plugin Written in Go
        Using Plugins While Developing
    Conclusion
15. How to Contribute
    What Does It Mean to Contribute to Falco?
    Where Should I Start?
    Contributing to Falcosecurity Projects
        Issues
        Pull Requests
    Conclusion
Index
About the Authors