►
From YouTube: Deep Dive: Falco - Mark Stemm, Sysdig
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Deep Dive: Falco - Mark Stemm, Sysdig
In any Cloud Native architecture, there’s a seemingly endless stream of events that happen at each layer. These events can be used to detect abnormal activity and possible security incidents, as well as providing an audit trail of activity. In this talk, we’ll cover how we extended Falco to ingest events beyond just host system calls, such as Kubernetes audit events or even application level events. We will also show how to create Falco rules to detect behaviors in these new event streams. We show how we implemented Kubernetes audit events in Falco, and how to configure the event stream. Finally, we will cover how to create additional event streams leveraging the generic implementation Falco provides. Attendees will gain a deep understanding of Falco’s architecture, and how it custom Falco for additional events sources.
To learn more: https://sched.co/I1p9
A
All
right
cool,
let's
get
started.
Well
thanks
everybody
for
coming
to
the
one
of
the
last
conferences
on
the
last
day
across
the
street,
top
building
I
have
fantastic
cash
prizes
for
all
of
you,
all
you
have
to
do
is
fix
three
issues
on
the
Falco
repo
and
then
that
prize
is
yours.
So
keep
that
in
mind
guys
so
I'm
mark
stem
and
I'm
gonna
talk
about
how
we
added
support
for
kubernetes
audit
events
to
Falco.
A
Just
a
little
bit
about
me.
I'm,
a
senior
software
engineer
at
Cystic
I've
been
there
about
three
years
and
the
first
week
I
was
at
Cystic.
Laura,
said:
hey,
let's
go
release
this
thing
called
Falco
and
I
said:
okay,
what's
that
and
then
look
where
we
are
now
so
we
got
this
awesome
stuff,
so
I
mean
I'm
kind
of
one
of
the
maintainer
Zahn,
it's!
Oh,
it's
all
my
fault
or
it's
all
I
I
made
it
all
awesome
either.
One
is
fine
with
me.
A
So
if
you
don't
know
much
about
Falco
hope
you're,
hopefully
you
are
familiar
with
it,
but
if
not,
let's
just
do
a
quick
introduction.
So
Falco
is
a
behavioral
Activity.
Monitor
and
what
it
does
is
look
for
suspicious
or
other
notable
activity,
as
defined
by
a
set
of
rules
that
it
has
on
prior
to
kubernetes
audit.
All
of
the
activity
that
it
was
monitoring
was
based
on
system
calls
that
came
from
the
underlying
code
and
Cystic.
So
a
lot
of
the
things
that
you
see
in
Falco
are
actually
powered
by
Cystic.
A
When
Falco
identifies
some
suspicious
activity,
it
basically
can
send
messages
to
a
number
of
output
channels,
and
so
we
have
some
basic
stuff
in
there.
You
know
you
can
write
to
files.
You
can
write
to
standard
out
if
you're
running
it
directly,
we
can
go
to
syslog.
We
can
invoke
little
programs,
so
you
can
use
that
for
all
kinds
of
purposes
like
sending
emails
or
posting
to
web
hooks,
or
anything
like
that.
A
So
it's
a
pretty
flexible
way
to
get
your
stuff
from
Falco
to
wherever
else
you
want
to
get
it
and
obviously
it's
open
source.
So
I'll
talk
more
about
it
in
a
second,
but
we
moved
it
to
the
Apache
License.
It's
been
open
source
since
it
began
now
it's
Apache,
so
you
know
please
make
your
contributions
feel
free
to
use
it
incorporate
it
in
your
own
stuff.
But
if
you
use
it,
please
let
us
know,
because
you
know
one
thing
we
really
want
to
do
is
build
a
strong
community
around
this.
A
So
just
a
quick
example:
if
you've
never
seen
Falco
kind
of
what
the
kind
of
stuff
you
can
do
with
it
and
the
top
pane
we've
got
Falco
running
in
the
bottom,
pane
we're
doing
all
kinds
of
bad
stuff,
so
we're
doing
stuff
like
exacting
into
a
container.
You
might
use
that
for
privilege,
escalation,
we're
reading
sensitive
files
below
like
Etsy
shadow,
we're
modifying
system
files
like
things
below
/bin
and
so
forth,
and
for
all
of
that
bad
activity.
A
Okay,
so
let's
talk
a
little
bit
about
how
how
Falco
is
kind
of
architected
and
that'll
kind
of
set
up
the
second
half
of
the
talk
pretty
well
so
in
the
lower
left
right
here,
we've
got
a
curl
module
and
the
kernel
module
taps
into
the
stream
of
system
calls
on
the
machine,
and
we
see
every
system
call
that's
running.
You
know
what
doesn't
matter
if
it's
in
the
container
or
not
or
directly,
on
the
host
we
get
all
the
system
calls
we
take.
A
The
system
calls
and
we
turn
them
a
little
into
a
little
system
call
event
object.
We
bring
that
up
to
user
space
and
the
job
of
user
space
is
basically
to
add
context
to
it.
So
the
thing
we
get
from
the
kernel
module
is
pretty
basic.
It's
like
a
thread,
ID
assist,
call
number
and
the
arguments,
but
from
that
we
start
adding
context.
So
we
know
that
thread.
Id
10
is
actually
a
thread
in
a
process
called
Apache
and
so
we'll
add
context,
saying
hey
this.
For
this
event,
the
process
name
is
Apache.
A
If
this
is
running
in
a
container
will
add
container
level
information,
we'll
say:
oh,
this
is
running
as
a
part
of
a
container
with
a
given
ID
here's
the
image
that
was
used
for
that
container.
Here's
the
mounts
that
container
has-
and
we
add
all
of
that
as
context
to
that
system-
call
event.
If
it's
running
in
a
containerized
or
orchestration
environment,
we
add
more
context,
we
say:
hey,
it's
a
part
of
this
pod,
a
part
of
this
deployment,
part
of
this
namespace.
We
had
all
of
that
context
to
the
object.
A
So
now
we
have
this
really
rich
view
of
the
activity
done
as
a
part
of
that
system
call.
So
you
know
who
did
it,
what
they're
doing
it
on?
And
you
know
where
in
your
environment
that
you're
doing
it,
so
it's
pretty
rich.
Once
we
have
these
system
call
events,
we
basically
run
it
through
a
rules
engine
and
that's
all
provided
by
Falco.
The
rules
like
I,
said
they
kind
of
look
for
suspicious
or
other
notable
stuff.
A
We
take
every
event
kind
of
match,
it
matching
matching
match
I,
match
it
against
the
rules
and
when
an
event
matches
one
of
the
rules,
we
send
it
to
one
of
the
outputs
and
then
you
can
construct
a
special
output
string.
That's
got
a
mix
of
stuff
that
you
type
in
and
stuff
that
comes
from
the
event
and
that's
what
goes
to
the
different
output
channels.
A
So,
let's
look
at
you
know
very
quickly.
What
a
rule
looks
like
and
then
use
that
to
kind
of
talk
about
how
we
extract
this
information
out
of
the
event
objects?
Okay,
so
this
is
what
a
Falco
rule
looks
like.
It's
got
a
name,
a
description.
This
condition
piece
of
the
gamal
is
basically
a
filter
that
gets
matched
against
all
of
the
system
calls.
So
in
this
case
the
rule
is
looking
for
rights
below
a
binary
directory
and
what
the
condition
does
is
says
is
the
event
type
open.
A
So
is
that
an
open
call
and
is
the
directory
component?
That
is
the
thing
being
opened
just
take
the
directory
part
of
that?
Does
it
match
either
bin
or
user
bin
so
get
some
matching
stuff
when
it
matches
we
generate
this
output
string,
which
again
is
a
mix
of
plain
text
and
stuff
that
comes
from
the
event.
That's
the
little
percentage
percent
dies.
Then
you
can
tell
receipt
programmers
because
I'll
print
up
for
us,
it
was
gonna,
be
like
the
brackets
and
stuff
and
that's
kind
of
it.
A
So,
let's
talk
about
how
we
kind
of
can
take
this
and
adapt
it
to
use
a
different
kind
of
event
than
the
system
call
events
that
we
previous
used
without
go.
So
the
heart
of
it
is
that
we
have
these
fields
that
basically
are
reside
in
the
condition
expression
or
in
the
output
expression
and
for
each
field.
We
basically
go
over
and
interrogate
the
system,
call
object
and
say:
what's
the
value
of
this
field
so
in
this
case
event
dot
type.
A
A
So
the
nice
thing
is
is
that
we
realized
that
you
know
there's
a
lot
here
that
we
can
reuse
if
we
want
to
use
other
event
streams.
You
know
all
this
stuff
for
the
yam
all
and
the
logical
operators
and
naming
the
fields
extracting
the
values
we
can
make,
that
pretty
general
purpose
and
all
we
have
to
do
is
make
up
a
new
kind
of
event,
object
and
new
kinds
of
fields
that
know
how
to
extract
stuff
out
of
the
event
job
object.
A
If
we
have
that,
we
can
reuse
all
the
framework
that
we
already
have
in
Falco
and
that's
what
we
did
for
kubernetes
audit
events,
if
you
don't
know
what
kubernetes
audit
events
are,
let's
talk
about
it
a
little
bit,
it's
a
new
thing
in
kubernetes
111
and
what
it
does
it's.
Basically,
an
audit
log
that
gives
you
a
chronological
set
of
records
that
document
all
the
changes
have
that
happen
to
your
cluster.
The
nice
thing
about
Kerber
naty's
is
almost
all
the
activity
go
through
the
API
server.
A
So
that's
a
nice
point
where,
if
you
can
just
create
an
audit
log
of
what
happens
there,
it's
going
to
reflect
almost
all
the
changes
that
are
being
made
to
your
cluster.
So
when
you
set
up
audit
logging
for
kubernetes,
one
thing
you
provide
is
basically
an
audit
policy.
So
this
isn't
a
Falco
thing.
It's
just
a
kubernetes
thing.
You
basically
tell
the
cluster
here
are
the
kinds
of
events
that
I
want
you
to
put
in
the
audit
log.
A
So
you
might
say
things
like
only
tell
me
about
deletes
only
to
only
tell
me
about
things
that
happen
to
deployments
and
there's
a
rich,
documented
framework,
for
you
know,
that's
really
flexible
and
giving
you
the
kinds
of
stuff
that
you
want
out
of
it
in
the
Falco
repo.
We
have
an
example,
audit
policy,
which
is
the
one
we've
used
that
we
think
would
be
a
good
reference
if
you
want
to
kind
of
use
it
in
conjunction
without
go.
Of
course
you
can
add
whatever
you
want
to
it.
A
So
once
you
have
this
audit
policy
that
controls
what
events
are
going
to
come
out,
you
have
to
decide
where
they
go.
So
you
have
a
couple
options
there.
You
can
write
them
to
a
log
file.
You
know
simple
log
file
rotates
every
once
in
a
while.
You
know
like
you
would
expect
out
of
any
like
web
server
log
or
you
know
anything
with
those
audit
type
longer
logs,
and
you
can
also
post
it
off
to
a
web
hook.
A
So
you
can
give
it
a
network,
endpoint
and
said:
hey
go
over
to
this
IP
or
service
or
hostname,
and
you
know
on
this
port
and
here's
the
path
you
should
use
and
it
just
batches
it
up.
It's
got
a
little
like
Nagle,
algorithm
type
thing
where
like
matches
a
little
bit,
but
if
it's
been
too
long
sends
them
off
and
it
just
posts
it
to
HTTP.
A
So
pretty
simple
and
that's
the
mechanism
we
actually
used
in
Falco,
so
just
to
give
you
an
example
of
what
what
one
of
these
audit
events
looks
like
I,
simplified
it
a
little
bit
because
there's
actually
a
lot
of
stuff
in
there,
but
this
has
all
the
main
pieces.
So
a
naught
event
has
a
you
know:
timestamp
there's
a
stage
because
for
the
audit
logging,
you
can
actually
check
it
at
different
points.
A
You
can
check
it
like
as
they're,
making
the
request
after
they're
making
the
request
and
as
the
response
goes
out,
so
that's
that
what
that
stage
means
so
there's
a
always
a
verb.
So
it's
like
what
action
you
want
to
take
on
the
target,
object
or
named
object,
or
something
like
that.
In
this
case,
this
audit
event
represents
deleting
a
namespace.
So
in
this
case
the
verb
is
delete.
We
have
a
URI,
we
can
say
who
they
are,
so
they
have
a
username
it
might
get
all.
It
could
also
be
like
service
account
information.
A
We
have
the
response
status,
so
you
know
it's
HTTP
level
responses,
but
they
mapped
a
you
know
the
expected
yes/no
kind
of
thing
in
this
case
or
it's
referring
to
a
namespace.
So
that's
what
object
rect
is
for
they
all
have
unique
IDs,
so
you
can
just
unambiguously
identify
them
and
they
have
information
about
like
what
authorization
decisions
it
had
to
make
and
whether
it
was
allowed
to
do
that
and
that
stuff's
included
there
too.
A
So
it's
it's
a
pretty
rich
set
of
information
about
like
what
they
tried,
what
the
result
was
and
what
happened
as
a
result
of
it
going
back
to
our
architectural
diagram.
Let's
talk
about
how
we
added
support
in
so
step,
one.
We
added
an
embedded
web
server
to
Falco,
so
just
nice,
little
civic
web
thing
that
can
basically
it
sits
there
and
listens
for
posts
on
one
in
exactly
one
endpoint
and
it's
configurable
in
the
ports
configure
what
that's
all
it
does
no
gets
nothing
else.
A
A
We
do
some
simple
transformation,
a
small
amount
of
like
repackaging
to
turn
it
into
the
objects
we
need
internally
within
Falco
and
then
then
we're
set
once
we
had
that
we
can
use
the
same
rules
engine
that
we
already
had
all
the
Yambol,
all
the
logical
expressions,
all
the
in
operators
and
equal,
not
equal.
All
that
stuff
all
works
just
the
same,
but
it's
a
different
stream
of
events
and
it's
a
actually
a
different
set
of
rules.
They're
just
running
in
parallel
on
parallel
event,
streams.
A
Both
system
calls
and
kubernetes
audit
activity
a
little
more
detail
on
how
we
actually
implemented
this
in
Falco
itself,
so
it
Falco
is
pretty
much
all
C++
with
a
smattering
of
Lua
for
kind
of
set
up.
So
we
already
had
this
object.
That
was
a
sis
call
object.
C++
object.
We
just
you
know,
put
another
object
on
top
of
it
and
made
a
bunch
of
virtual
void
methods.
So
we
just
defined
some
interfaces
that
say
hey
if
you
want
to
be
a
generic
event.
Here
are
the
things
you
have
to
do.
A
A
We
ended
up
using
JSON
pointers
to
do
the
extraction
just
because
it's
a
convenient
way
to
do
it
and
I'll
talk
about
that
in
a
second
and
now,
once
we
have
that
we're
pretty
much
set,
and
then
we
wrote
a
bunch
of
new
rules,
so
there's
a
new
role
in
0,
13,
0,
Kate's
audit
rules.
Yamo
runs
parallel
to
the
main
rules
file
that
we
already
had
and
all
rules
now
have
a
source.
A
So
by
default,
the
source
for
a
role
is
syscall,
which
means
the
system
calls
to
the
ones
already
had,
but
you
can
have
another
source,
Kate's
audit,
and
if
you
have
a
source
of
Kate's
audit,
you
get
the
events
that
come
from
the
API
server.
Otherwise,
you
get
all
the
events
that
come
from
the
system
calls.
It
didn't
really
make
sense
to
mix
them
because,
like
all
the
fields,
don't
really
have
like
cross,
meaning
so
they're
just
two
parallel
streams
of
events
going
through
one
rules:
engine
where
they
pick
off.
A
Ok.
So
let's
just
do
a
quick
summary
of
what
JSON
pointers
are
because
it's
a
convenient
way
to
access
this
stuff
in
it.
We
kind
of
build
on
that
to
define
our
field
names,
so
JSON
pointers
are
just
a
way
to
extract
the
value
of
a
given
property
path
in
a
in
a
JSON
object.
If
you
know
XPath
like
you're
old,
like
me,
it's
that
kind
of
stuff,
but
it's
for
JSON
objects
do
see
some
laughing
up
here.
A
I'll
drop
some
motif
references
next,
okay,
so
you've
got
a
JSON
object
on
the
left
and
then
we'll
just
kind
of
say
like
okay,
let's
go
through
examples
right
so
if
I
want
to
get
the
value
of
the
property
called
foo
in
the
object,
you
just
put
a
string
that
says
/foo
pretty
easy
right.
If
you
have
a
nested
object,
you
just
keep
going
down
in
the
nested
expression
with
Pat
with
path
separators.
A
So
if
you
want
to
get
the
value
of
the
Baz
property
within
the
object,
that
is
the
borrower
property,
you
say
slash
bar
slash
Baz
and
you
get
tea.
You
can
do
array
indexing.
That's
just
you
just
do
that
by
doing
a
slash
and
then
a
number
and
then
they'll
say,
hey
assume
this
thing's
an
array
give
me
the
zeroth
value
out
of
it
and
you'll
get
one
in
this
case.
A
Okay,
so
pretty
simple,
looking
back
at
our
kubernetes
on
an
event,
the
way
we
can
extract
this
stuff
is
kind
of
the
same
way
with
these
JSON
pointers.
So
if
we
want
to
figure
out
what
the
verb
is,
we
just
make
a
JSON
pointer,
that's
slash
verb.
If
we
want
to
figure
out
what
the
status
code
is,
we
look
at
response
status,
slash
code,
so
it's
a
pretty
nice
flexible
way
to
get
pretty
much
anything
we
want
out
of
these
JSON
objects,
there's
a
little
bit
more
stuff
within
falco.
A
So
there's
a
few
fields
that
you
we
created
in
order
to
add
support.
The
first
one
is
J
event
value.
This
is
kind
of
your
general-purpose
one.
It's
always
there
and
you
know
you
can
always
use
that
to
get
something
out
of
the
object.
If
nothing
else
works,
so
J
event
dot
value
bracket,
and
then
you
just
put
one
of
those
JSON
pointer
strings
in
there,
and
then
you
start
it
at
the
top
work.
Your
way
down
get
that
whatever
value
comes
out
that
gets
matched
in
the
filter
or
gets
put
in
the
output
string.
A
Everything
has
a
time
so
J
event.
Time
is.
It
extracts
a
specific,
accurate
time
out
of
the
JSON
object,
but
we
just
have
it
as
a
direct
thing
and
then
the
next
thing
is
we
have.
We
have
all
these
basically
aliases
or
macros,
because
it
would
be
kind
of
awkward
to
write,
J
event,
value,
blah,
blah
blah
or
J
event
about
you
to
get
really
awkward
and
clutter
up
your
rules
file.
A
J
event
value
bracket,
verb,
okay,
target
resource,
same
thing:
okay,
if
you
want
to
know
what
all
the
rules
are
or
all
the
fields
are,
you
can
look
at
the
wiki
or
you
can
just
run
it
live
so
falco
list
equals
skates.
Audit
will
just
dump
out
all
the
fields.
If
you
know
cystic
it's
very
similar
to
cystic
shell,
you
know
print
out
all
the
fields
you
can
kind
of
get
an
idea
of
what
your
what
you
can
get
out
of
these
objects.
A
Okay,
so
let's
look
at
a
rule
right
so
now
we
didn't
know
time
we're
doing
it.
This
is
kind
of
like
one
sample
rule
and
it's
supporting
macros.
If
you
don't
know
if
Alko
you
know,
falco
has
rules,
but
it
also
has
macros
for
code,
reuse
and
lists
and
stuff.
So
we
just
got
all
pieces
here
so
going
top
down.
So
the
first
thing
we
do
is
we
define
a
macro.
That's
called
contains.
Oh
the.
A
The
goal
of
this
rule
is
to
look
for,
like
somebody
created
a
config
map
and
they
and
you
put
your
AWS
key
in
there
like
don't
do
that.
But
if
you
do,
then
we
got
a.
We
got
a
Falco
roll
to
slap
you
on
the
wrist.
You
know,
so
we
have
a
macro
that
says,
contains
private
credentials
and
what
we're
doing
here
is
we're
just
specifying
a
little
condition.
Snippet
that
says,
KDOT
request,
config
Mac
dot
object,
which
is
basically
the
operation
when
it
referred
to
a
config
map.
A
Look
at
the
object,
which
is
just
a
string
when
we
grab
it
out,
it
says:
does
it
contain
a
B
AWS
access,
key
ID,
so
I
guess,
if
you're
just
evil
enough
you'll
put
your
password
in,
but
you'll
spell
it
wrong,
and
then
we
won't
get
this,
but
if
you're
dumb
enough,
you'll,
probably
still
call
it
password,
so
we'll
get
you.
The
next
macro
is
config
map
and
we're
saying
K
dot
target
resource
is
saying.
The
thing
is
that
you're
acting
on
is
a
config
map.
A
We
have
a
macro
called
modify
which
looks
at
the
verb
and
says:
is
it
create
or
update
or
patch?
So
is
it
some
modification
type
thing
to
the
config
map
bringing
it
all
together?
This
is
where
we
tie
it
together
in
the
rule.
So
we
have
a
rule
that
says,
create
config
map
with
private
credentials,
and
the
condition
is
just
the
combination
of
these
macros.
A
If
it
matches
that,
then
here's
your
output
string,
Kate's
config
map
with
private
credential
and
again
we're
giving
you
a
mix
of
information
that
comes
from
the
text
and
also
the
audit
event,
so
we'll
be
able
to
say
who
did
it
the
K
dot
username,
what
action
they're
doing,
K
dot
verb,
the
name
of
the
config
map
and
the
contents
in
the
config
map,
so
very
similar
to
what
we
have
with
system
calls,
but
working
on
these
like
cluster
wide
Kate's
operations
instead,
alright,
so
let's
do
a
demo.
You
know
that's
the
most
fun
right.
A
A
You
know
based
on
nginx
or
something
so
in
the
rule
spa
we
actually
have
a
few
different
classes
of
rules,
so
we
have
like
one
class
of
rules
that
looks
for
suspicious
stuff
stuff
that
you
probably
shouldn't
be
seeing
anywhere.
We
really
take
care
to
use
the
severity
field
of
these
rules
in
Falco
rules.
They
have
severe
DS
that
go
from
like
debug
up
to
error,
and
so
we
try
to
make
sure
like
the
warning
really
reflects
like
how
bad
we
think
the
thing
is
so
the
first
class
is
generally
like
warnings
or
errors.
A
We
have
another
class
of
rules
that
are
like
hey.
These
are
just
things
that
are
happening
to
your
clusters,
so
basically
objects
get
created
or
deleted.
We
have
stuff
for
that
that
stuff's
more
like
notice
or
info
level,
and
then
we
have
a
third
class
which
is
basically
whatever
object
comes
in.
We
just
print
it
out.
That's
actually
that
rule
is
actually
off
by
default,
but
it's
debug
severity.
So
you
can
turn
it
back
on
if
you
want
alright,
so
we'll
create
a
deployment
here
and
then
Falco
what
detect
it.
A
A
A
Up
for
us
everything's
in
my
demo,
namespace,
so
we're
gonna
delete
the
deployment
same
thing
happens
down
here.
We
can
see
that
hey
somebody
deleted
the
deployment
that
we
just
created.
You
can
do
the
same
thing
for
a
service,
so
we
have,
you
know,
support
for
all
the
major
classes
of
objects
in
there.
So
if
we
create
a
nginx
service,
it
works.
If
we
delete
a
and
the
next
service,
it
works.
A
A
So
we
created
the
config
map
and
then
Falco
detected
it
because
we
saw
the
audit
event
that
reflected
the
config
Mac
being
created
all
the
fields
that
we
had
looked
in
the
config
back
contents
for
something
called
AWS
access
key.
When
it
did,
we
sent
you
an
information
about
it.
You
can
see
here.
The
severity
is
warning
because
it's
probably
shadier
than
just
somebody
creating
one
right.
A
A
A
So
here
we
did
cue
cuddle
exact
into
the
pod,
and
we
detected
that
too.
You
know
the
reason
we
really
focus
on
this.
You
like
cube
exact
stuff,
is
it's
like
a
pretty
powerful
mechanism
for
privilege
escalation,
which
is
you
know
a
great
way
when
somebody
gets
in
to
start
getting
more
power
right.
So
if
you
can
exact
into
a
pod,
you're
gonna
be
a
slowly
inherit
all
of
the
permissions
that
you've
granted
to
that
pod.
So
if
somebody
can
get
in,
they
can
do,
and
that
pot
is
really
powerful
and
has
lots
of
privileges.
A
They're
gonna
be
able
to
do
most
of
those
things
as
well.
So
it's
a
great
way
to
get
in.
So
you
know
again,
we
saw
that
the
exec
happened.
We
checked
to
see
well
yeah,
but
that's
all
we
did
for
this
one.
It
was
that
notice
level
and
say:
hey
somebody
exacted
into
a
pot.
You
might
want
to
check
it
out
all
right.
Let's
do
some
like
service
account
stuff,
so.
A
What
did
I
call
it
so
what
let's
try
something
where
we
create
a
service
account
and
in
accidentally
or
negligently,
give
it
too
many
permissions,
so
a
create
a
service
account
called
bad
account
and
then
we'll
take
that
service
account
and
create
a
cluster
role
binding
that
binds
it
to
cluster
admin.
So
cluster
admin
has
lots
of
powers.
You
probably
don't
want
to
do
that
following
the
principles
of
least
privilege.
So
if
you
did
do
that,
falco
would
notice
that
and
send
you
and
send
you
information
about
it.
A
A
So
here
we
have
a
cluster
role
in
cluster
role,
binding
where
we're
gonna
grant
too
many
permissions
to
a
given
cluster
role
or
two
we're
going
to
define
a
cluster
role
with
too
many
pressures,
then
grant
it
to
a
user.
So
let's
say
you:
you
use
wild
carding,
like
oh
I'm,
too
lazy,
to
name
the
Reese
courses
that
this
guy
can
read.
So
I'll
just
do
star.
Well,
don't
do
that
either
and
we
have
some
rules
in
Falco
that
say
hey.
If
you
try
to
do
that,
we're
gonna!
A
Similarly,
if
getting
back
to
that
pod
exact
thing,
if
here,
let's
just
take
a
look
at
it,
if
you
didn't
grant
anybody
pot
exact
permissions,
but
you
did
grant
them
the
ability
to
grant
more
permissions
well,
the
first
thing
we'll
do
is
give
them
so
the
ability
to
executive
pods.
So
this
is
a
cluster
role
that
allows
pod
exact.
The
way
that
works
is
you
just
have
a
resources
called
pods,
exec
and
I
get
on
it,
and
then
that
allows
you
to
do
exec.
So
if
you
try
to
create
one
of
those.
A
Again,
we
notice,
so
we
see
that
you
created
the
cluster
role
that
had
the
ability
to
do
pod
execs
and
we
let
you
know
hey
somebody
did
that.
Maybe
you
should
check
it
out
and
keep
an
eye
on
it
and
I
think
I
got
one
more
yeah.
Okay,
so
on
you
know,
maybe
you're
running
platform
as
a
service
and
you're
trying
to
you
know,
keep
people
off
in
their
own
namespaces.
A
A
So
please
let
us
know
about
that,
so
wrap
it
up
real,
quick.
Here's
all
the
links
to
all
the
things
you
know,
falcata,
falco
org,
is
our
new
website
under
the
cnc
f.
So
it's
divorced
from
cystic,
so
you
can
go
to
there
to
get
all
these
other
things.
The
public
slack,
I
guess,
is
so
under
cystic,
but
it's
a
there's.
A
channel
they're
called
falco.
We
all
hang
out
there
try
to
answer
questions.
A
A
We
got
a
bunch
of
blog
posts
on
the
Cystic
comp
website
that
talked
about
use
cases
with
falco
sample
integrations
that
kind
of
stuff,
it's
a
great
way
to
figure
out
like
oh,
how
can
they
do
falco
to
detect
this
and
that
kind
of
stuff
as
a
part
of
the
CN
CF
migration,
we've
moved
over
falco
to
its
own
organization,
falco
security,
so
it's
not
under
drea,
said
anymore.
So
if
alko's
security
slash
palco,
we
got
a
wiki
there
that
describes
how
to
use
falco.
A
There's
a
page
there
now
talking
about
kubernetes
audit
support,
so
how
to
get
all
this
stuff
up
and
running,
and
also
we,
you
know
you
can
always
run
Falco's
a
container.
You
know
in
a
daemon
said,
of
course,
for
kubernetes
and
we
just
moved
it
over
to
falco
security.
So
again,
it's
his
own
organization,
not
ordered
reyes
anymore.