search

orchestructure / presentations

Holds and organizes all past, present, and future presentations at the meetup
http://orchestructure.io/
41 stars 11 forks source link

Sysdig Falco presentation #58

Open castrojo opened 5 years ago

castrojo commented 5 years ago

It'd be cool to see if we can get @mfdii up here to show us all the sysdig goodies. August 28 and September 25th are open.

markjacksonfishing commented 4 years ago

Count me in for this @castrojo

castrojo commented 4 years ago

Sweet, do you have a description we could use? We'd like to add it all to the meetup page, etc.

markjacksonfishing commented 4 years ago 
Host intrusion detection (HID) has been around for some time. What if we rethought the problems HID solves in the context of Cloud Native platforms? What if we can detect abnormal behavior in the application, container runtime, & cluster environment as well? In this talk, we’ll present Falco, a CNCF Sandbox project for runtime security. We will show how Falco taps Linux system calls & the Kubernetes API to provide low level insight into application behavior, & how to write Falco rules to detect abnormal behavior. We’ll show how to collect & aggregate alerts using an EFK stack (Elasticsearch, Fluentd, Kibana). Finally we will show how Falco can trigger functions to stop abnormal behavior, & isolate the compromised Pod or Node for forensics. Attendees will leave with a better understanding of what problems runtime security solves, & how Falco can provide runtime security, auditing & incident response.
markjacksonfishing commented 4 years ago

@castrojo let me know when the meetup page drops so i can spread the word ❤️

markjacksonfishing commented 4 years ago

Title: Falco- Container Native Runtime Security