►
From YouTube: Cloud Native Runtime Security with Falco - Kris Nova, Sysdig & Abhinav Srivastava, Frame.io
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Cloud Native Runtime Security with Falco - Kris Nova, Sysdig & Abhinav Srivastava, Frame.io
Falco is a CNCF Sandbox project focused on Container Runtime Security. In this maintainers track session the Falco maintainers will focus on what runtime security is and how it differs from other layers of security for Kubernetes. They will show how to enable system call abnormality detection using Falco’s eBPF integration, as well as how to detect abnormal behavior in the Kubernetes API server. Lastly, the Falco maintainers will walk through various implementation examples from end users of Falco, and how to integrate Falco in with cloud based event processing services to build security event pipelines. Attendees will leave with a better understanding of Falco and runtime security, how to get started writing their own Falco rules, and how to contribute improvements to the project.
https://sched.co/UakJ
A
Think
the
overall
pattern
of
how
we're
gonna
do
this
today
is
I'm
going
to
do
a
very
low
level.
Hacker
style
presentation
here
in
the
command
line
and
I'm
gonna
be
sort
of
setting
the
stage
pun
intended
for
for
Falco
and
what
we're
going
to
be
talking
about
today,
and
so
you,
when
I'm
up
here,
you're
gonna,
learn
about
the
process.
The
project,
the
CNC
F,
you're,
gonna,
see
it
running
in
kubernetes.
A
But
I
think
when
you
hear
from
the
from
one
of
the
maintainer
of
the
project,
why
we
did
what
we
did
and
then
seeing
how
a
ban
of
and
folks
at
framed
IO
are
using.
It
I
think
it's
a
pretty
good
thought
experiment
just
to
to
remind
ourselves
that
when
you
are
building
your
open-source
technology,
there's
things
that
you
may
not
be
prepared
for
it.
A
That
could
happen
and
that's
a
general
sentiment
that
we're
going
to
be
going
through
today,
this
concept
of
things
that
you
weren't
prepared
for
and
for
how
do
you
prepare
yourself
for
them
right?
How
do
you?
How
do
you
get
ready
for
something
that
you
you
don't
understand,
or
you
don't
anticipate
it's
going
to
happen
so
anyway,
we're
gonna
run
my
slides
in
the
terminal.
My
my
talk
here,
all
of
my
slides
everything
I
do
is
going
to
be
in
the
command
line.
A
So
if
we
want
I,
don't
know
if
we
can
maybe
dim
the
lights
or,
if
folks
can
can
see
this,
does
anybody
want
me
to
switch
to
a
higher
contrast?
That
looks
good,
a
higher
contrast
view
here.
You
don't
have
to
raise
your
hand.
You
can
just
shout
it
out
if
you
want
to
move
to
the
front
if
you
want
to
see
more.
This
is
about
what
it's
gonna
look
like
on
the
screen
for
folks
at
home,
I
see
a
lots
of
thumbs.
A
Ups
I
see
more
thumbs
up
lots
of
lumps
up
so
yeah,
okay,
everybody
just
put
thumbs
up
last
chance
to
shout
out
for
higher
contrast
going
once.
Okay
again,
if
at
any
point,
you're
missing
something
or
you
can't
read
something
raise
your
hand,
I
can
zoom
in
or
we
can.
We
can
switch
so
I
again
I'm.
Giving
this
talk
to
you.
A
A
At
the
beginning
of
most
of
my
talks
and
I've
been
doing
this
at
cube
con
for
a
few
years,
and
it's
really
interesting
to
see
how,
then
that
the
ratios
have
changed
over
the
years
so
hands
in
the
air
running
kubernetes
in
production.
I
am
the
entire
room,
just
put
their
hand
up
hands
in
the
air.
Who
here
has
ran
a
docker
container?
B
A
My
main
man
has
his
and
we
have
another
one
back
over
here.
Okay,
we
might
do
that
today.
If
we,
if
we
get
there,
we'll
see
how
how
this
goes.
Okay
and
who
here
knows
what
Falco
is?
Who
here
is
run
Falco?
Okay,
who
here's
running
Falco
in
production?
Okay,
you
should
you
should
see
me
afterwards.
We
would
love
to
talk
more
and
get
you
some
free,
Falco
swag
and
see
if
we
can't
get
you
in
our
official
adopters
MD
file,
I'm
speaking
of
Falco
swag.
A
If
you
answer
questions
that
I
have
I
have
a
limited
edition
magnetic
Falco
pins
up
here
and
we
can
get
you
a
Falco
t-shirt
as
well
sent
out
to
you
after
the
conference.
So
if
I
ask
questions,
there
is
some
incentive
to
you
to
answer.
Okay.
So
without
further
ado,
we
are
going
to
view
with
these
illustrious
slides
of
mine
that
are
in
very
high
quality
64
columns
of
pure
Unicode
yeah,
our
first
sign,
okay,
so
yeah.
This
is
actually
cool.
A
A
Github
Chris,
no
pup,
speaking
slides
BAM
and
now
you
should
be
able
to
get
your
cell
phones
out
and
take
a
picture
of
the
bottom
left
corner
of
the
screen.
Okay,
there's
I
just
missed
this
bitly
link
here.
If
you
want
a
grab
and
photo
of
that
everything
now
I'm
gonna
be
talking
about
in
a
Vinod's
going
to
be
talking
about.
You're
gonna
be
able
to
reach
from
that
bitly
link
and
it's
gonna
be
on
every
slide,
so
feel
free
to
take
a
picture
of
it.
A
Whenever
you
want
and
then
that's
going
to
help
us
justify
that
what
we're
talking
about
today
is
important
in
people
care
so
yeah.
So
we're
gonna
talk
about
cloud
native
runtime
security
with
Falco
I
am
your
host
for
the
first
half
of
this.
My
name
is
Chris
Nova
I
work
at
a
company
called
cystic
a
little
bit
about
me.
I
am
an
o'reilly
media.
Author
I
wrote
the
book
on
cloud
needed
infrastructure
literally.
A
If
you
have
an
opportunity
to
buy
several
copies
of
it
for
your
friends
and
family,
please
do
and
then
buy
some
more
copies
and
I
am
a
maintainer
I.
Actually,
just
got
done
doing
a
C&C
F
interview
today
about
all
the
projects
I've
been
maintaining
or
have
maintained
or
currently
maintained,
or
I've
worked
on,
I've
been
in
around
cloud
native.
A
Let's
talk
about
this
thing
called
run
time
security
who
here
thinks
they
have
a
good
idea
of
what
run
time
security
means
we
have
a
couple
of
hands:
go
okay,
pretty
good
hand,
so
that
hands
go
up
so
I'm
gonna
talk
about
what
I
think
run
time.
Security
is
and
I'm
gonna
talk
about.
Why
I
think
that's
important,
and
you
know
my
my
opinions
here-
aren't
necessarily
the
right
way.
They're.
A
Just
my
opinions
and
I
encourage
everybody
here
to
to
question
this
and
to
start
thinking
about
security
in
general,
because
if
you
look
at
my
career
honestly
in
the
past
five
years
in
cloud
native,
there's
been
this
pattern
of
bits
and
pieces
of
the
cloud
native
ecosystem,
particularly
around
Cooper
net,
that
were
incomplete.
The
first
one
that
I
was
very
excited
about
solving
was
the
infrastructure
problem.
When
kubernetes
first
came
out,
we
said
no,
we're
not
gonna.
Tell
you
how
to
install
kubernetes.
A
That's
that's
outside
his
scope
of
the
project,
and
that
was
frustrating
for
folks
who
well
frankly,
wanted
to
install
kubernetes,
and
so
that
was
one
of
the
first
tools
they
worked
on.
And
if
you
look,
there's
been
this
pattern
of
the
the
space
growing
and
in
different
subsections
or
different
components
of
cloud
negative.
A
Around
kubernetes
growing,
based
on
these
gaps
in
what
we
we
have
easily
accessible,
tooling,
around
and
I
think
we're
kind
of
at
this
point
where
kubernetes
are
starting
to
level
off
and
there's,
maybe
one
or
two
really
big
holes
in
the
global
pie.
Chart
here
and
in
my
mind,
one
of
the
biggest
ones
is
security.
How
do
you
secure
a
kubernetes
cluster
and
what
does
security
even
mean
like?
Where
does
it
start?
A
I
think
is
important,
and
so
the
three
kind
of
buzzwords
I
have
that
come
to
mind
when
I
think
of
runtime
security
is
it's
a
fancy
word
anomaly
detection,
which
basically
means,
in
my
mind
something
bad
or
confusing
happened
that
we
weren't
prepared
for,
and
we
just
kind
of
want
to
know
about
it
or
at
least
be
able
to
go
back
and
get
some
information
about
this
thing
that
we
weren't
expecting
to
happen
forensics.
So
this
is
like
the
detective
work.
A
This
is
like
you
know,
like
we've,
all
seen,
detective
Pikachu
right
with
his
hat
and
his
magnifying
glass
going
in
and
actually
trying
to
solve,
the
the
mystery
of
the
privilege,
escalated
container
of
2019
and
then
last
but
not
least,
stability
right,
runtime
security.
In
my
mind,
is
our
last
line
of
defense.
We're
gonna
talk
a
little
bit
more
about
that
in
a
moment,
and
it's
critical
for
this
layer
of
software
ready
to
be
stable,
right.
A
Wewe,
don't
want
to
have
the
the
one
piece
of
software
that
we're
you
we're
counting
on
in
an
emergency
to
save
us,
to
break
our
computer
or
to
crash
or
to
not
work
or
to
to
fail.
So
I
think
it's
it's
absolutely
critical
that
this
is
stable
and
we're
gonna
look
at
some
interesting
patterns
in
kubernetes
and
in
the
linux
kernel
that
sort
of
ensure
that
we're
writing
some
pretty
stable
code
here.
A
Okay,
so
I
I
have
been
talking
to
a
lot
of
folks
here
at
cube
con
over
the
past
few
days
and
on
the
internet
over
the
past
few
weeks,
and
one
of
the
big
pieces
of
feedback
that
I've
got
is
we're
kind
of
in
a
very
similar
situation
to
what
docker
was
in
a
few
years
ago,
which
is
we
have
some
language
and
some
naming
confusion.
We
all
know
naming
is
the
hardest
part
of
writing
software,
so
I'm
going
to
spend
a
few
moments
here
and
just
clarifying
three
very
important
actors
in
in
the
field.
A
Here,
the
first
one
cystic
the
company,
the
company
who
pays
me
I
work
there
and
we
are
a
bunch
of
low-level
hackers.
We
hang
out
all
around
the
world.
We
have
an
office
in
San,
Francisco
and
a
bunch
of
really
smart
folks,
I
get
to
work
with,
and
we
write
a
lot
of
C
and
C++
and
get
to
do
fun
stuff
with
the
kernel.
A
So
assisting
the
company
is
a
effectively
an
evolution
of
Wireshark
Wireshark
show
of
hands.
Who
here
is
ran
it
yeah
everybody
just
put
their
hands
up
so
I
you,
our
founder,
loris,
a
great
friend
of
mine.
He
was
one
of
the
original
authors
of
Wireshark
and
if
you
look
there's
some
similarities
into
what
cystic
does
and
I
think.
A
The
big
thing
to
start
to
imagine
here
is
Wireshark
said
hmmm
if
we
want
to
find
the
ultimate
source
of
truth
right
like
in
my
mind,
this
is
like
the
quantum
particle
of
computer
observability
like
what's
the
most
fundamental
element
that
can
always
tell
us
what's
exactly
going
on
and
the
original
thesis
was
the
network.
If
it's
a
TCP
packet,
that's
that's
the
ultimate
source
of
truth.
You
can't
get
any
smaller
than
that
and
like
good
scientists,
we
continue
to
push
our
field
forward.
A
This
is
a
CLI
tool
show
of
hands
who
here
has
ran
this
before
it's
similar
to
s
tres,
except
for
it
sort
of
works
globally,
and
it
has
a
little
bit
more
enriched
maida
information
about
what's
going
on
in
the
kernel.
But
basically,
when
you
look
at
how
a
process
interfaces
with
the
kernel,
it
ultimately
translates
everything
it's
doing
through
the
syscall
interface,
usually
using
a
library
like
G,
let's
see
and
those
go
into
the
kernel
and
what
we
do
is
we
just
simply
track
those
we
trace.
A
It's
called
kernel,
Tracey
every
event
in
the
kernel
is
a
function
executed
and
we
trace
those
events
and
we
send
those
back
up
above
the
kernel
into
what
we
call
user
space
and
then
with
those
metrics.
We
have
this
crazy
idea
that
we
will
be
able
to
tell
some
sort
of
story
with
these
metrics,
which
is
where
falco
comes
into
play
here
in
a
moment,
I'm
going
to
do
a
demo
and
I'll
show
you
the
Cystic
tool
and
the
firehose
of
data
that
comes
out
of
it
and
then
we're
gonna
run.
A
A
So
we're
able
to
put
together
this
really
nice
enriched
object
that
spans
multiple
layers
of
the
stack
starting
at
the
lowest
most
fundamental
layer
and
going
all
the
way
up
to
kubernetes
and
we're
able
to
tell
a
story
using
all
of
these
inputs
and
we're
going
to
explore
Falco
a
little
bit
today.
So
again,
it's
a
it's
a
CNCs
project.
If
you
go
to
see
in
CF
dot
IO
you
can,
you
can
find
more
about
Falco
and
there'll,
be
some
links
here
and
that
link
in
the
bottom
will
get
you
there
as
well.
A
Ok,
so
the
history
of
Falco,
it
was
originally
created
as
an
engine
to
pars
libs
cap
in
lib
sense
and
when
we
say
engine
what,
basically,
what
we
mean
is
it
is
those
two
libraries
wrapped
up
in
a
for
loop
and
runs
as
a
daemon,
with
a
signal
handler
very
very
fancy.
I
know.
So
this
was
donated
to
the
C
and
C
F.
It
was
originally
created
at
assisting
and
I
joined
the
company
about
three
months
ago
and
I've
been
working
on
making
this
as
hygienic
and
healthy
of
an
open-source
project
as
possible.
A
So
if
you're
interested
in
the
security,
we
would
love
to
invite
you
to
come,
join
the
party
and
hang
out
with
us
and
start
hacking
on
the
kernel
right
now.
The
majority
of
falco
is
written
in
c++.
Raise
your
hand
if
you
write
C++
and
you
like
it.
Okay,
two
hands:
okay,
Eritrean!
If
you
like,
go
Python
other
yeah,
everybody
just
put
their
hands
up.
A
Here's
my
very
fancy
diagram
in
ASCII
art.
So,
let's
start
at
the
bottom.
I
feel
like
a
lot
of
folks,
especially
insecure.
You
like
to
start
at
the
top
and
go
down
we're
gonna
flip
that
around
and
we're
gonna
go
from
the
bottom
up:
okay,
so
the
bottom
half
you
can
see
there's
that
line
in
the
middle,
the
bottom
half
of
this
it
represents
the
Linux
kernel,
and
here
you
can
see
we
have
two
main
avenues
of
running
code
in
the
kernel,
one
of
which
is
the
more
conventional
approach.
A
The
kernel
module,
the
other
one
is
a
newer
approach,
the
ebps
approach,
who
here
has
written
a
kernel
module
who
here
is
written
an
ABAP,
F
probe,
okay
I,
think
Leo's
put
his
hand
up
for
every
one
of
these
and
basically,
what
these
do
is
these
we
solve
the
problem
of
hi
I'm,
a
software
engineer
and
I
would
like
to
run
logic
in
the
kernel
in
the
same
way
that
there's
a
somebody
who
said
on
Twitter
the
other
day.
I
forget
who
was
I'm
I'll.
A
So
the
problem
with
the
kernel
module
is
that
if
you
write
a
bad
or
a
buggy
kernel
module,
you
can
break
your
system
because
the
kernel
is
going
to
basically
you're
gonna
hook
into
the
kernels
processes
and
then
you're
gonna
take
some
action
and
if
something
goes
wrong,
while
you're
taking
action,
the
kernel
is
gonna.
Wait,
it's
got
a
halt
on
that
and
you
can
put
your
computer
into
deadlock
pretty
easily
just
by
a
very
simple
bug.
A
So
that's
where
you
BPF
comes
into
play
and
ebps
is
brilliant,
because
what
it
does
is
it
actually
has
code.
That's
already
pre-written
for
you
in
the
kernel
and
it's
been
tested,
it's
gone
through
the
same
Linux
testing
suite
that
we
use
for
all
for
all
of
our
releases
and
we
basically
just
tell
the
kernel
to
turn
on
or
off
various
pieces
of
EPF
that
are
running
in
a
virtual
machine
in
the
kernel.
So
we're
not
actually
writing
custom
code,
we're
just
saying:
hey
kernel,
you
weren't
executing
this
code
before,
but
would
you
mind?
A
Please
also
executing
this
little
bit
of
code
along
the
way
and
then
we
can
pull
that
up
into
user
land
and
we
can
start
to
make
sense
of
it.
One
of
the
features
that
ebps
supports.
You
guessed
it
kernel
tracing
so
anytime,
you
execute
a
sis
call.
You
are
then
able
to
begin
to
understand
those
syscalls
up
in
user
land.
So
those
are
the
two
approaches.
A
The
the
caveat
here
is
EB
PF
requires
a
newer
kernel,
4.14
ish,
to
execute
a
lot
of
the
stuff
that
we
use
in
Falco,
whereas,
if
you're
running
in
an
older
kernel,
the
kernel
module
is
going
to
be
the
way
to
do
that.
So
obviously
there's
some
pros
and
cons
with
each
of
those.
So
then
that
goes
into
a
ring
buffer.
A
Where
we
have
16
megabytes
I
know,
that's
a
lot
16
megabytes
of
memory
per
core
of
information
that
comes
up
from
the
kernel,
and
this
is
just
stuff-
that's
going
on
your
system,
and
then
we
have
these
two
libraries
in
user
space
that
just
pop
events
off
of
that
ring
buffer
and
the
beauty
of
the
ring
buffer
approach.
Here
is,
as
it
circles
around,
imagine
a
clock
right
the
hand
going
around
to
clock
as
it
circles
around.
A
It's
leaning,
the
previous
events
before
it
and
it
won't
overwrite
events
until
it
circles
all
360
degrees
back
around,
which
means
that
any
given
instance.
If
this
has
been
running
for
you,
know
a
period
of
time.
We
have
16
megabytes
of
history
that
we
can
go
back
and
observe
if
needed.
So
this
is
this
is
where
we're
starting
to
tell
these
stories
and
starting
to
gather
information
in
doing
what
we
call
run
time
security.
A
So
we're
able
to
respond
to
events
at
run
time
effectively
by
looking
back
in
time
in
this
buffer
that
we
have
in
memory
and
all
that
goes
to
Falco
and
then
all
that
can
ultimately
go
to
gr
PC
endpoint
that
you
lovely
software
engineers
can
use
to
to
plug
up
and
plug
into
anything.
You
want
effectively
and
we're
gonna
do
a
demo
later,
so
you'll
be
able
to
kind
of
see
concretely
how
this
works.
So,
let's
talk
about
Falco
so
now
that
we
understand
how
we're
getting
the
SIS
call
information
into
Falco.
A
We
want
to
talk
about
other
input
streams
that
we
have
so
obviously
the
SIS
calls
that
we're
pulling
out
of
the
kernel
traci
and
either
through
a
kernel,
module
or
an
EVP
F
probe
are
going
to
be
important
and
that's
probably
the
most
exciting
bit
of
what
Falco
can
do,
but
we
are
also
like
I
mentioned
earlier:
we're
able
to
get
the
container
context.
This
is
going
to
be
the
container
ID,
the
image
that
the
container
is
running
on
all
of
this
wonderful
maeda
information
about.
A
What's
going
on
and
the
last
input
stream,
we
have
there's
actually
two
here
that
I
kind
of
munched
into
one
which
is
kubernetes
maeda
information.
What's
the
name
of
the
pod,
what
namespace
isn't
running
in
what
are
the
labels,
as
well
as
the
audit
log
information?
Who
did
what
and
when
did
they
do
it
and
again?
This
is
where
we're
starting
to
look
at
telling
a
story
of
being
a
detective
of
understanding.
A
Our
systems
I
had
a
fundamental
full
stack
level
instead
of
just
at
the
kernel
or
instead
of
just
in
userland,
we're
going
in
spanning
the
entire
system
with
Falco.
We
simply
assert
these
input
streams
against
a
set
of
rules
and
we're
gonna
look
at
some
of
these
rules
in
a
moment
and
and
then,
if
one
of
those
rules
is
violated,
we
plummet
through
to
an
output,
and
here
we
have
three
outputs
that
I
put
up
on
the
screen
and
we
have
more
coming
and
there's
actually
a
lot
more.
A
That
Falco
can
do,
but
I
picked
two,
the
three
that
I
think
you're
going
to
resonate
with
you,
the
most
the
first
one
I've
mentioned
a
few
times
already.
We
have
a
TLS
mutually
encrypted
G
RPC
in
point,
and
we
have
clients
that
generate
code
using
protobufs
that
you
can
consume
the
same
point
with
we
have
a
web
hook
in
the
exact
same
way
that
kubernetes
audit
log
will
reach
out
and
send
a
request
to
a
configured
web
hook.
A
If
you
want,
if
you
want
to
see
those
come
find
me
afterwards,
okay,
so
let's
talk
about
the
problem
of
runtime
security.
Now
that
you
kind
of
understand,
Falco
and
how
it
works.
Let's
talk
about
how
we
got
here
right,
how
did
how
did
we
go
from
this
idea
that
I'm
about
to
explain
to
that
code
in
that
system
that
we
just
looked
at
so
I'm
gonna?
Ask
a
few
questions
here,
and
these
are
the
questions
that
we
began
to
ask
ourselves
as
we
started
to
explore
how
we
were
gonna
solve
this
problem?
A
What
happens
when
access
control
fails
and
what
we
mean
by
that
is
a
lot
of
security,
is,
is
implemented
by
preventive
action,
locking
the
door
setting
an
alarm
saying:
hey,
you
know
if
we
can
prevent
folks
from
doing
things
that
we
consider
malicious,
we're
going
to
secure
our
system,
and
that
is
a
fundamental
part
of
secure
system
and
probably
the
most
effective
way
to
get
started
with
securing
your
system
and
the
concern
here
is
every
time
somebody
has
a
catastrophe.
A
car
is
broken
into.
A
bank
is
broken
into
you.
Your
house
is
broken
into.
A
Something
happens
that
you
aren't,
anticipating
somebody
does
something
to
attack
you.
They
usually
don't
care.
If
you
have
door,
locks
set
right,
they've
found
some
way
to
bypass
the
door
locks,
and
this
is
where
the
second
layer
that
maybe
is
only
applicable
a
very
small
portion
of
the
time,
but
it's
going
to
be
applicable
during
the
most
important
time,
which
is
when
something
happens
you
weren't
prepared
for
so
in
my
mind,
we
need
both
of
these
in
place
to
truly
secure
a
system.
A
So
what
do
we
do
in
catastrophe
strikes
and
then,
last
but
not
least
after
catastrophe
strikes?
How
do
we
tell
the
story?
How
do
we
begin
to
look
at
all
of
the
data
and
actually
make
sense
of
it
and
actually
come
and
be
able
to
put
together
this
person
from
this
IP
address,
came
to
this
container
and
did
this
and
installed
a
Bitcoin
miner,
and
here
we
are
and
I
can
I
can
give
you
all
the
information
to
to
demonstrate
that
this
is
beyond
the
shadow
of
a
doubt.
A
In
fact,
what
happened
and
that's
what
we
try
to
solve
with
Falco?
So
here
are
the
three
common
approaches
to
solving
both
prevention,
as
well
as
forensics
analysis
or
surveillance.
After
a
catastrophe
has
happened,
so
the
first
one
is
using
a
concept
called
LG
preload,
which
I'm
gonna
high-level.
This
there's
a
lot
of
great
resources
on
the
Internet
and
I.
Don't
want
to
bore
folks
with
like
reading
the
LD
preload
man
pages,
which
I
have
done
in
the
past,
and
you
can
go
to
youtube
and
watch
me
read
those
on
stage.
A
It's
quite
fun,
but
basically,
in
order
for
you
to
use
LD
preload.
What
you
would
do
is
you
would
write
some
code,
usually
in
C,
and
you
would
effectively
hook
into
the
G
standard
library
deal
obscene
and
when
a
executable
program
that
was
written
by
either
yourself
or
another
engineer,
tries
to
access
the
C
standard
library.
A
If
you
use
LD
preload
and
you
wrote
the
LD
preload
library
you're
loading
correctly,
you
would
effectively
be
able
to
intercept
that
function,
call
take
some
action
and
in
most
cases
you
would
then
take
a
small
amount
of
action,
hopefully
nothing
too
invasive
or
blocking,
and
then
you
would
hand
that
off
to
the
original
function,
that
the
user
was
trying
to
call
now.
This
is
great
because
this
solves
the
problem
of
like
all.
A
We
have
to
do
is
wrap
every
g-load,
C,
publicly
exposed
function
or
method
to
a
log
file,
and
we
can
start
to
see
what's
happening
behind
the
scenes.
There's
a
problem
here
and
who
here
is
written,
go
okay,
so
go
doesn't
use
DMC.
So
write
me
right
away.
That's
not
going
to
work
here,
so
that
was
one
of
the
things
that
we
we
started
to
explore
and
we
said
okay,
so
LD
preload
is
good,
but
it
can
be
better.
A
So
the
next
thing
we
went-
and
we
said:
okay,
let's
talk
about
sidecars,
who
here
has
ran
a
sidecar
before
great,
so
sidecars
run
in
me,
the
same
context
in
the
system
space
as
the
the
original
process.
He
so
if
you
go
and
you
read
in
the
kubernetes
documentation,
it
says,
like
a
pod,
has
shared
networking
and
shared
storage,
which
means,
if
I
have
two
container
processes
running
in
a
pod,
they
can
communicate
to
each
other
via
localhost
when
2700
to
1,
which
is
great.
A
So
we
said
site
cars
aren't
going
to
do
it.
So
then
we
looked
at
kernel
modules.
This
allows
us
to
write
arbitrary
code
in
the
kernel,
but,
like
I
mentioned
earlier,
these
could
potentially
crash
a
kernel,
so
it's
a
little
bit
better
than
LD
preload,
but
there's
still
some
risk
here.
Furthermore,
like
if
we're
already
not
scared
enough
apt-get
installing
random
package
dot,
DP
kg
from
the
internet,
we're
now
effectively
telling
people
to
yeah,
just
trust
us
and
run
our
kernel
module
in
your
kernel,
we're
a
security
company.
A
We
we're
not
gonna,
do
anything
too
scary
here,
so
there
was
some
concern
there,
particularly
about
loading
custom
logic
into
your
Linux
kernel,
probably
the
most
intimate
part
of
your
system.
Okay.
So
let's
kind
of
summarize
this
here,
so
we
looked
at
those
three
approaches.
We
we've
understood
that
kernel
modules
are
the
best
of
those
three
but
EB
PF
is
really
where
we
want
to
move
going
for
it
and
so
to
summarize
the
the
problem
again
kind
of
looking
at
it
differently
now
that
we
know
the
possible
avenues
of
solving
the
problem.
A
The
first
thing
we
want
to
solve
is
prevention.
In
the
same
way
that
selinux
prevents
you
from
executing
various
bits
and
pieces
of
the
kernel,
we
would
potentially
want
to
prevent
folks
in
our
system,
such
as
a
kubernetes
cluster,
from
taking
action.
This
is
where
tools
like
our
back
or
tools
like
OPA
come
into
play
because
you
can
effectively
say
no,
you
have
your
labels
configured
incorrectly
or
no
there's
some
string
that
doesn't
match
this.
This
pattern
that
we've
defined
and
we're
going
to
prevent
you
from
taking
action.
A
We're
gonna
tell
you
no,
and
if
you
look
at
the
way
that
controllers
in
kubernetes
work,
they
basically
allow
you
to
hook
into
a
process
and
reject
a
request
to
take
change
or
mutate,
an
object
in
the
API
server,
and
so
that's
prevention,
which
again
this
is
a
the
first
step
most
folks
take
and
they're.
Probably
the
first
step
I
would
encourage
folks
to
take.
A
But
prevention
doesn't
always
complete
the
story,
so
we
want
to
start
taking
security
seriously
in
the
enterprise
in
looking
at
how
do
we
respond
to
events
that
we
aren't
prepared
for,
which
is
where
run
time,
security
and
forensics
comes
in
to
play.
So
again,
these
are
useful
in
the
very
small
edge
cases,
but
if
you
have
this
installed,
this
is
gonna,
be
the
difference
between
a
total
catastrophe
and
at
least
a
catastrophe
that
you
can
understand
and
prevent
moving
forward
and
draft
some
policy
around
and
again.
A
A
Folks
here
get
excited
about
this
and
we're
going
to
talk
a
little
bit
more
about
how
you
can
find
out
more
about
ebps
moving
forward,
but
I'm
just
gonna
give
you
a
quick
high-level
overview
for
my
demo
so
that
you
kind
of
understand
what
I'm
showing
on
the
screen
here
so
who
here
has
heard
of
the
Berkeley
packet
filter,
okay
and
who
here
knows
the
difference
between
that
and
EBP
F
cool
handful
of
folks.
So
basically
I
think
the
analogy
I
like
to
use
is
B.
A
Bp
of
BP
f
is
to
e
BP
f,
as
them
is
to
or
as
V
is
to
them
right.
It's
extended
Berkeley
packet
filter
right,
so
it's
just
an
improved
version
of
the
original
BP
f
work
that
was
done
and,
as
I
always
say,
like
BP,
f
we're
gonna
party
like
it's
1992.
This
has
been
around
for
quite
some
time,
so
we're
gonna
explore
kind
of
what
it
is
and
how
it
works.
A
Okay,
so
let's
remind
ourselves
of
our
use
case,
we
want
to
trace
all
kernel
events
into
and
out
of
the
kernel,
so
every
syscall
has
to
two
fundamental
parts
right.
The
this
is
call
coming
into
the
kernel
and
the
return
value
coming
out
of
the
kernel.
So
there's
two
events
there
that
we
want
to
trace.
We
eventually
want
to
enrich
that
data
about
what
was
happening
with
metadata.
A
We
want
this
to
be
stable.
We
don't
want
to
run
the
risk
of
breaking
our
system
or
running
a
potentially
malicious
or
invasive
kernel
module,
and
we
want
to
be
able
to
audit
this
in
userspace,
so
we
had
of
a
pretty
tall
order
here.
If
you
think
about
what
we're
actually
asking
the
kernel
to
do,
and
EBP
F
in
this
case
was
a
perfect
solution
for
us.
So
again,
let's
look
at
the
the
problems
with
the
kernel
module
approach
number
one.
A
It
was
invasive
invasive
folks
were
hesitant
to
load
new
kernel
modules
into
production
for
good
reason,
and
it
was
risky
buggy
kernel
modules
can
crash,
kernels
and
block
kernel,
processing
and
no
matter
how
well
tested
your
code
is,
as
I've
been
saying
this
entire
time.
Things
happen
that
you're
not
prepared
for,
and
there
are
always
going
to
be
edge
cases
and
there's
no
such
thing
as
perfect
technology.
A
So
again,
ebps
gets
us
closer
to
that
that
zero
level
that
we
are
so
desperately
trying
to
to
reach
so
how
he
BPF
works
like
I
mentioned
earlier,
the
code
is
already
written
and
we're
just
turning
it
on
there's
a
virtual
machine
that
is
compiled
into
the
kernel.
In
fact,
you
can
go
to
github.com,
slash,
Torvalds,
slash,
Linux,
I,
think,
slash,
BP
I,
think
it's
in
the
top-level
directory
and
you
can
actually
see
the
code
that
is
that
folks
have
been
working
on.
A
A
We
can
dynamically
load
via
ABI
BPF
system
call
our
BPF
program
that
we
want
to
start
using
and
we
can
use
bpe
BPF
for
networking
analysis
for
kernel
tracing,
there's
a
whole
arsenal
of
things
that
it
can
do
for
us
and
again,
the
code
is
pre-written
and
we're
just
taking
advantage
of
it
if
you're
interested
in
finding
out
more
because
again,
I'm
keeping
this
kind
of
high-level.
For
for
this
talk,
because
we
have
a
lot
to
go
through.
There's
two
links
here.
A
If
you
want
to
snap
a
photo-
and
these
are
in
that
bitly
link
as
well.
The
first
one
is
a
blog
written
by
an
engineer
at
Cystic
and
name
is
john
luca
he's
the
one
who
wrote
the
e
BPF
probe
that
we
use
to
this
day
and
the
next
one
is
a
link
to
the
BP
PF
observability
in
Linux
book
that
one
of
our
engineers
Levin
so
Fontana
that
we've
been
giving
away
at
the
Cystic
booth.
A
Ok,
so
I
need
somebody
to
shout
out
a
word
because
we're
gonna
run
an
experiment,
the
silly
or
the
word,
the
better
anybody
say
a
funny
word
banana
ok,
so
we
are
going
to
run
the
banana
experiment.
So
what
we're
gonna
do
is
we're
gonna
demonstrate
using
the
open
sis
call.
This
is
a
very
simple
syscall.
Basically,
this
just
opens
up
a
file
for
reading
or
writing
using
the
kernel.
10
minutes.
Ok,
the
next
thing
we
do
is
we're
gonna
we're
gonna
replicate
the
banana
experiment.
A
It's
good
word
I,
like
it
already
in
3
different
environments,
one
in
raw
Linux,
one
in
a
container
and
one
in
kubernetes
and
we're
gonna
perform
the
exact
same
experiment
in
all
three
environments
and
we're
gonna
see
what
the
kernel
does
using
Falco
Falco
is
gonna.
Give
us
visibility
into
the
kernel
and
we're
gonna
understand
what
kind
of
information
were
able
to
get
and
actually
see
me.
A
Do
something
scary
and
we're
gonna
see
what
Falco
has
to
say
about
it
and
so
the
goals
here
we
want
to
understand
the
importance
of
surveillance
of
tracking
these
logs
over
time,
and
we
want
to
understand
a
complete
system.
Auditing
right
so
like
this,
should
show
you
that
auditing,
a
system
from
the
kernel
up
is
going
to
give
you
the
information
that
you
can
get,
regardless
of
how
the
banana
experiment
is
ran,
regardless
of
if
it's
ran
in
a
regular
old
Linux
process
in
a
container
or
in
a
pod
and
Amazon.
A
A
So
let's
look
at
selca,
so
the
first
thing
I
want
to
do
is
I'm
gonna
run
sudo
Falco
should
I
see.
Men
can
folks
see
this
okay,
yep
cool
okay,
so
you
can
see
here
not
very
much
is
happening
because
Falco
is
taking
the
spire
hose
of
syscall
information.
Oh,
this
is
chrome
yelling
at
me
right
now.
This
fire
hose
of
syscall
information
and
it's
asserting.
A
Without
those
set
of
rules
filtering
it,
we
can
run
the
Cystic
CLI
tool
and
all
into
my
password
and,
as
you
can
see,
there's
a
small
amount
of
data
coming
out
at
the
kernel
right
now-
and
most
of
this
is
my
gnome
terminal,
but
I
also
have
I,
probably
have
zoom
or
slack
doing
some
crazy
stuff
behind
the
scenes.
But
you
can
begin
to
see
here
we
have
reading.
We
have
writing.
We
have
syscall
information.
We
have
the
arguments
that
are
part
passed
to
these.
A
This
calls
and
you
can
see
the
process
ID
whether
it's
got
an
event
in
the
kernel,
that's
going
in
or
an
event
in
the
kernel
that's
going
out.
So
this
is
great,
but
this
doesn't
really
tell
much
of
a
story
unless
you
know
exactly
what
you're
looking
for
so
what
Falco
does
is
it
allows
you
to
write
some
rules
that
say
if
we
detect
patterns
in
this
set
of
data,
we
want
to
start
knowing
about
it.
We
want
to
start
learning
about
it,
and
so
in
this
example,
when
I
ran
Falco
in
the
other
terminal.
A
A
You
can
see
we
have
this
notice
right,
so
this
is
chrome.
Doing
a
set.
Uid
and
Falco
said
okay.
This
isn't
super
invasive,
but
you
probably
might
want
to
know
about
this
in
the
future,
but
we're
gonna
do
something
a
little
more
invasive
here
on
my
laptop,
so
in
a
third
terminal,
I'm
gonna
do
this,
and
I'll
zoom
in
I
am
going
to
touch
user
local
Ben
banana
ba
na
na.
What
does
this
ba
na
did?
A
So
we
need
to
escalate
to
root
in
order
to
do
this
because
my
user,
local
business
of
course
protected
so
sudo
bang-bang
enter
my
password
here
and
now.
Let's
go
see
what
Falco
has
to
say
we
scroll
down-
and
we
have
some
really
interesting
bits
of
output
here,
the
first
one,
it
says,
notice,
shell
history
has
been
deleted
or
renamed
what's
happening.
There
is
I'm
running
different
terminals
as
the
same
user.
A
So,
whenever
I
create
a
new
terminal
session,
which
I
just
did
bash
history,
resets
in
Falco
doesn't
like
that
when
that
happens,
because
that's
potentially
somebody
covering
up
their
tracks
so
again,
using
this
call
information,
we
can
start
telling
a
story,
and
if
you
look
at
the
the
end
of
this
here,
you
can
see
that
we
have
some
some
in
a
fields,
and
this
is
gonna
be
relevant.
The
moment
when
we
run
in
a
container,
particularly
the
container
image
that
we're
gonna
see
down
here
notice.
A
We
have
no
container
image
defined
because
we're
not
running
a
container
right
now.
But
if
you
look
at
this
air,
we
got
an
error.
This
time
it
says,
file
below
to
a
monitored
directory,
opened
for
writing,
and
then
you
can
see
we're
actually
able
to
get
meaningful
information
out
of
the
kernel-
the
user,
for
instance
the
command
that
I
ran
its
user
local
bin
banana,
and
you
can
see
that
we're
actually
able
to
start
painting
a
picture
here
and
taking
action
and
remind
yourself
that
this
is
going
to
standard
out
in
this
example.
A
A
The
first
error
notice
the
shell
was
spawned
in
a
container
with
an
attached
terminal
yeah.
We
would
probably
want
to
know
about
that
and
we're
getting
maida
information
from
the
docker
context,
the
docker
socket
and
we're
starting
to
plumb
that
into
cell
so
Falco's
smart
enough
to
to
start
auditing
and
understanding
what's
going
on,
and
you
can
see
here
from
the
kernels
perspective,
it's
the
exact
same
behavior,
because
it's
an
isolated
process
running
in
a
unique
namespace,
the
kernel
process
exactly
like
if
it
was
on
the
host
system
so
by
auditing
at
the
kernel
level.
A
This
is
like
the
big
lesson
here
you
are
actually
able
to.
The
kernel
is
truly
synthesized
into
believing
what
you're
doing
in
a
container
is
actually
happening
on
a
real,
true,
authentic
Linux
system.
So
this
is
great
because,
regardless,
if
you're
onion
in
kubernetes
or
on
a
Linux
system
having
Falco,
you
will
be
able
to
audit
across
the
stack
right.
So
you
can
take
a
job
of
process
and
you'd
be
able
to
start
getting
similar
metrics
as
this
this
one
as
you
would
if
it
was
running
in
a
container
or
Python
or
anything
else.
A
It's
so
the
next
thing
we're
gonna
do
here
is
I
have
alias
queue.
Bechtel
is
equal
to
K.
So
if
I
do
K
get
pods,
you
can
see
here
that
I'm
gonna
list
pods
in
my
AWS
cluster,
and
you
can
see
if
I
do
K
get
nodes,
you
can
see.
I
have
a
kubernetes
version,
1.13
running
in
ec2,
two
nodes
and
one
master.
So
let's
list
pods
in
the
Falco
namespace
you
can
see
here.
Falco
is
running
as
a
daemon
set
and
we
have
two
Falco
containers
or
pods
rather
running
on
each
of
those
nodes.
A
So
what
we're
gonna
do
here
is
we're
gonna
tale
the
Falco
logs
and
you're
gonna
notice
that
we're
actually
getting
a
lot
of
information
out
of
kubernetes
right
out
the
bat.
So
how
we're
gonna
do
that
is
we're
going
to
do.
K
logs,
namespace,
Falco
label
app
is
equal
to
Falco
minus
F,
and
you
can
see
here.
We've
got
a
lot
of
things
in
here.
Let
me
clean
this
up
a
bit
okay,
three
minutes
and
then
I'm
gonna
wrap
up
okay.
So
you
can
see
here
we're
getting
really
valuable
information
about.
A
What's
going
on
in
my
cluster
and
I've,
already
kind
of
demoed
this
before
I
walked
on
stage,
so
you
can
see.
We've
already
got
some
alerts,
but
we're
gonna
generate
some
new
ones
here,
but
we're
gonna
get
the
kubernetes
made
it
information
as
well
as
the
audit
logs
as
well.
So
how
we're
gonna
do
that
I'm,
just
gonna
turn
just
this
demo
and
I'll
be
ready
to
go.
How
we're
gonna
do
that
is
we're.
Gonna
do
Kay
run
in
genetics,
stash
image
engine
X
will
Jeep
in
bash.
A
A
A
Okay,
oh
I'm,
not
gonna,
do
pug
pooping
on
you
is
live
on
on
the
screen
here,
so
we're
gonna.
Just
look
at
some
of
the
I.
Did
this
earlier.
I
have
no
idea:
I'm
gonna
blame
it
on
conference
Wi-Fi,
even
though
that
doesn't
make
any
sense,
but
we
can
see
here.
I
did
the
banana
experiment
earlier
notice.
The
shell
was
spawned
in
a
container.
In
this
case,
I
ran
a
different
command.
Let's
see
if
I
could
find
it
here.
A
Well,
the
point
I'm
trying
to
make
here
is:
if
you
look
at
one
of
these
output
logs,
you
can
see
we're
actually
able
to
get
the
container
ID.
The
the
namespace
that
it's
running
in
and
you
can
see
here.
I
ran
a
container
earlier
called
scary
and
it's
running
the
container
ID.
The
name
of
the
pod
is
scary,
the
namespaces
default
and
we're
starting
to
get
information
from
the
kubernetes
audit
logs
about
who's.
A
A
A
It's
it
really
does
so
it's
it's
obviously
directly
correlated
to
the
the
amount
of
noise
that
your
kernel
is
generating,
but
usually
a
sixteen
megabyte
capture,
I
would
say,
like
huge
crew,
you'd,
probably
look
a
good
60
seconds
back
in
time
on
a
relatively,
like
average
size
computer
with
a
relatively
average-sized
workload.
But
again
those
are
the
kind
of
that's
like
the
down
the
middle
answer,
depending
on
what
you're
doing
expect
that
to
go
greater
or
less
any
other
questions.
A
Yep
one
right
here
have
I
thought:
have
we
thought
about
structure
to
output
from
Falco,
so
yeah?
So
if
you
looked
at
the
standard
out
that
was
on
the
screen,
what
we
have
is
for
every
one
of
our
rules
that
are
defined
in
Hamel.
You
actually
define
an
output
string
and
we
have
variables
that
you
put
in
there
and
it
works
like
a
templating
language
in
in
that
case
it
was
just
the
tip
of
the
iceberg.
A
C
You
have
seen
crystals
hacking
flight
and
let
me
take
it
the
world
of
marketing
slides.
So
so
what
is
frame
IO?
Let
me
give
you
with
two
minutes
overview.
So
frame.
Io
is
a
video
review
and
collaboration
platform.
We
allow
users
to
upload
their
media
contents
of
work-in-progress
contents
into
a
platform.
Then
white
team
members
and
clients
to
collaborate
on
the
project.
So
we
are
essentially
building
the
video
cloud.
We
are
not
a
creation
tool.
C
So
the
first
thing
that
we
allow
we
allow
teams
to
communicate
clearly
they
can
communicate
or
collaborate
on
the
video
itself
right,
not
just
about
daily
video
or
not
not
using
long
email
threads.
So
users
can
annotate
the
video
and
insert
comments
on
the
video
itself
that
can
get
embedded
with
the
frame
and
you
can
easily
click
on
those
comments
and
you
can
do
easy
navigation
to
find
out.
Who
is
doing
what
second
thing
that
we
allow?
C
Finally,
we
allow
teams
to
share
content
because
sometimes
when
you
work
with
certain
collaborators,
they
are
outside
the
platform.
Right
sometimes
executives
wants
to
see
the
cut
off
the
video
before
it
gets
released
and
you
can
use
secure
sharing
feature
to
share
content
with
external
partners,
and
you
can
also
decide
or
customize
what
and
how
they
see
those
content.
C
So,
as
I
said
that
we
are
not
a
video
creators
creation,
we
are
collaboration
tools,
but
we
have
integrated
ourselves
to
variety
of
video
creation
tools,
for
example,
Adobe
Premiere
effects,
Media
Composer,
DaVinci
Resolve,
and
we
have
a
native
integration
with
the
Final
Cut
Pro
X
as
well,
and
this
value
proposition
has
enabled
us
to
accumulate
a
great
set
of
logos
over
the
past
few
years
and
a
bunch
of
logos.
You
can
all
recognize,
and
these
all
are
enterprise
customers,
so
what
we.
So.
C
This
is
a
high-level
overview
of
the
platform
and
N
and
let's
see
how
actually
gets
translated
into
actual
platform
that
enabled
all
these
features.
So
we
are
a
containerized
platform
use
eks
and
cluster
ECS
cluster,
and
you
can
see
that
it,
as
I
said
we
are
entirely
hosted
in
Amazon
AWS.
So
when
I
use
a
censor
request,
it
goes
to
AWS
Web
Application
Firewall
then
goes
to
load
balancer
and
depending
on
the
request
type,
it
either
hits
the
KS
cluster
or
easiest
cluster
behind
the
scene.
C
We
use
post-grad,
Postgres
or
a
database
for
storing
the
transactions
and
all
uploaded
videos
are
stored
inside
the
s3
bucket,
and
we
process
two
kinds
of
workloads
very
important
to
understand
for
the
future,
slides
as
well.
That
first
kind
of
workload
is
related
to
web
application.
Requests
right
when
the
user
sensitive
requires
about
for
creating
a
project.
Creating
a
team
member
and
those
kind
of
simple
API
exercise.
C
That's
one
kind
of
request
that
we
process
in
our
platform,
but
and
a
specialized
request
that
he
process
is
for
is
related
to
video
transcoding
so
anytime,
when
a
customer
uploads
a
high-resolution
content,
what
it
what
we
do,
we
we
take
that
video
and
we
transport
that
video
and
generate
a
lot
of
rows.
Low
resolution
proxies
so
that
even
the
devices
of
clients
that
are
resource
constraint
of
language
constraint,
still
they
can
collaborate
on
the
video
and
that
entirely
is
a
separate
pipeline
running
issues
cluster.
C
So
with
that
knowledge,
with
that
background,
let's
see
some
of
the
metrics
related
to
containers.
So
every
day
we
boot
almost
three
hundred
thousand
containers
right,
so
we
don't
know,
that's
it
too
many
containers
or
two
less
containers.
We
haven't
checked
with
other
industries
but
yeah
in
our
platform.
On
a
peak
day,
we
are
running
three
hundred
thousand
containers,
which
roughly
translates
to
thirteen
thousand
containers
per
hour
and,
as
I
said,
that
these
containers
are
either
processing
web
requests
or
doing
transcoding
jobs
so
based
on.
C
So
that's
when
they
span
from
seconds
to
hours
right,
depending
on
the
length
of
videos
that
is
being
uploaded.
If,
let's
say
user
is
uploading,
very
short,
video
or
the
transcoding
can
finish
very
quickly
and
and
that
containers
may
large
just
for
a
few
seconds.
But
if
the
video
is
that
is
being
uploaded,
it's
very
long.
It
might
take
hours
to
transport
that
video
and
that's
when
those
containers
runs
for
hours
and
and
any
container
that
is,
processing
user
and
web
request
is
also
long
running
containers
and
a
fun
fact
that
we
every
are.
C
C
C
So
we
tried
few
tools
to
solve
these
problems
right.
We
tried
vendor
based
solutions
as
well,
and
we
tried
open
source
solutions
as
well
and,
and
my
background
is
in
system
security
in
my
PhD
I
worked
on
lot
of
system
call
monitoring
and
developing
system,
so
we
were
looking
into
a
lot
of
tools
to
find
out
whether
who
can
support
our
environment
and
we
decided
to
use
Falco
Falco,
as
Chris
mentioned
a
lot
about
that.
That
is
a
container
native
runtime
security.
C
So
this
is
what
Falco
provided
and
Falco
can
give
you
alerts
right
and
something
bad
is
happening.
It
doesn't
tell
you
what
events,
but
it
can
tell
you
that
the
shell
was
opened
or
not
as
Chris
demoed,
but
we
had
few
different
requirements
that
we
wanted
to
how
I
wanted
to.
We
were
looking
in
a
tool.
Basically,
he
wanted
raw
events.
We
didn't
want
to
just
get
alerts.
We
wanted
to
get
actual
system
calls.
So
the
idea
was
that,
if
we
have
actual
system
call,
then
we
can
build
a
lot
of
tooling
around
that
right.
C
So
Falco
does
a
pretty
good
job
in
terms
you
in
terms
of
collecting
metadata
related
to
event,
but
we
wanted
to
have
more
events
associated
with
our
system
call,
for
example,
what
kind
of
cluster
it
is
running
with
a
decisioning
in
these
years
or
eks,
what
kind
of
VP
CR
what
what
which
PPC
it
was
running
on
or
what
load
balancer?
It
is
accepting
the
request
and
so
on.
So
we
had
we
needed
a.
We
wanted
to
have
lot
more
context
around
those
events.
C
We
also
wanted
to
have
a
easy
to
update
rule
process
right,
for
example,
what
happens
that
Falco
rules
sit
on
each
machine
all
right
each
instances.
If
you
want
to
update
those
rule
either
you
have
to
use
ansible
scripts
to
update
those
rules
at
runtime
which
can
which,
if
it
goes
wrong,
it
can
crash
or
cluster
or
vm,
or
you
have
to
rotate
virtual
machines
every
time
the
golden
image
with
a
new
rule
set
in
order
for
you
to
have
new
rules.
C
So
we
didn't
want
to
have
that
kind
of
setup
and
we
wanted
to
have
a
centralized
alerting
engine
right.
Falco
has
a
rule
engine,
but
we
didn't
want
to
use
that
rule
engine.
We
wanted
to
have
a
one
rule:
engine
across
all
services,
so
single
rule
engine
that
can
support
god.
Duty
AWS
concert,
Falco
inspector,
all
those
services,
so
these
were
the
requirements
that
we
we
were
looking
for
in
a
tool
along
apart
from
these
sort
of
hard
requirements,
we
had
few
soft
requirements.
C
We
didn't
want
to
manage
our
own
cluster
to
support
all
those
features
that
we
wanted
or
extra
features
that
we
wanted
right.
Otherwise
we
had
to
manage
or
patch
those
VMs,
and
we
have
to
worry
about
our
own
cluster.
We
wanted
to
be
very
cost
effective.
We
didn't
want
to
boot
big
infrastructure
to
blow
up
the
cost.
C
We
didn't
want
to
look
into
scalability
issues
right.
We
didn't
want
to
go
into
auto
scaling,
group
setup
and
so
on.
Right
so
and
we
want-
and
last
but
not
least,
we
wanted
to
have
a
very
easy
way
to
to
look
into
alerts
to
this
point,
to
errors
and
before
going
into
the
hard
requirement
that
we
were
and
that's
like
a
roi
vents
and
all
those
things
let's
go
into.
Let's
look
into
soft
requirements.
Little
more
and
in
order
to
realize
these
soft
requirements
we
realized
to
use,
we
we
decided
to
use
serverless
based
technology.
C
We
are
using
ABR
in
AWS,
so
we
started
using
lambda
functions
very
heavily
and
several
function
is
came
out
in
last.
You
know
two
three
years
ago
where,
if
you
look
into
the
offering
in
the
beginning
cloud
providers
who
are
offering
infrastructure
as
a
service
model
right
there,
they
were
managing
hardware
and
hypervisor,
and
customers
were
about
managing
virtual
machine
operating
system
and
application.
C
So
if
you
in
a
off
in
a
in
a
peak
time,
if
you
want
to
run
thousands
of
functions
concurrently,
cloud
provider
will
run
thousands
of
functions
concurrently
for
you,
fine
grained
metering,
right,
you
only
pay
when
the
functions
are
invoked.
So
if,
in
a
in
a
off
big
time,
if
the
functions
are
not
getting
involved,
you
won't
pay
even
a
dime
and
when
the
functions
are
invoked,
that's
when
you
have
to
pay
and
faster
time-to-market
right,
because
we
are
bringing
our
own
code
we
don't
have
to.
C
We
don't
have
to
worry
about
setup
and
infrastructure
related
issues,
so
it's
very
easy
to
get
up
to
get
yourself
up
and
running.
So
there
are
many
ways
you
can
run
server,
less
functions,
yeah
and
there
are
different
different
models
of
running
it.
One
is
the
one
that
default
a
very,
very
common
model
where
you,
the
way
humans
are
rather
function
is
in,
is
called
even
reverse.
C
Event-Driven
serverless
function
so
idea
is
that
these
lambda
functions
or
Cerberus
functions
will
subscribe
to
some
resources
and
then
wait
for
events
to
get
rigored
and
as
soon
as
events
are
triggered,
they
they
get
context
for
those
events
and
with
the
context
they
also
get
necessary
information
to
process
those
events.
So,
for
example,
lambda
functions
can
subscribe
to
s3
bucket
and
wait
for
put
objects
to
happen.
C
As
objects
are
inserted
into
that
three
bucket,
the
event
will
SNS
event
will
be
generated
and
lambda
function
will
be
involved
and
lambda
function
will
get
the
context
as
the
context
actual
information
about
the
object
that
is
being
uploaded
and
lambda
function
can
process
that
object
do
whatever
it
is
supposed
to
do,
and
then
it
can
go
back
to
sleep.
There
are
many
others,
so
we
are
using
even
driven
model
a
lot
in
our
extensions
that
we
build
for
Falco.
C
There
are
many
other
ways
you
can
invoke
service
functions,
and
so
we
are
using
server
lesson
function.
A
lot
of
a
transcoding
pipeline
is
written
in
server
layers,
and
we
do
lot
of.
We
use
a
lot
of
service
function
in
the
security
team
as
well,
and
they
actually
came
up
with
the
six
design
pattern
and
we
wrote
a
research
paper
last
year
in
the
conference
called
hot
cloud
and
if
you
guys
know
more,
if
you
guys
want
to
read
about
it
check
it
out.
C
So
let's
look
into
what
are
the
security
components
that
we
built
for
Falco.
So
there
are
three
main
components:
one
we
call
it
Falco
and
host.
Basically,
the
way
Falco
runs,
but
we
change
little
bit
around
about
it.
Then
we
developed
a
system
called
driftwood,
which
is
the
analytic
system
that
basically
consume
the
data
generated
by
Falco
and
process
it,
and
then
we
developed
a
lighting
engine
called
babi.
C
So
let's
look
into
Falco
on
host
architecture,
so
this
is
the
glorified
version
of
what
Chris
showed
you
so
again.
This
is
a
single
ec2
instance
and
we
are
running
bunch
of
containers.
All
containers
are
generating
system
calls.
A
normal
system
calls
normally
system
calls
is
the
way
for
you
to
interrupt
from
user
mode
to
kernel
mode.
So
that's
what
kernel
is
system
call
goes
to
the
kernel
and
kernel
module
is
actually
interest.
C
Acting
all
those
system
calls
and
as
soon
as
it
is
collecting
the
system
call,
it
is
pushing
back
to
through
the
ring
buffer
to
the
Falco
agent
and
Falco
agent.
Job
is
to
get
these
system
calls
get
metadata
associated
with
those
system
calls
for
the
country
for
the
system
call
what
continent
is
coming
from.
C
C
Now
this
is
the
set
up,
even
if
you
use
Falco
in
a
default
way
as
well
I
mean
you
can
have
a
BPA
for
instead
of
Cardinal
module,
but
you
will
have
a
Phalke
of
rule
file.
You
have
a
Falco
agent,
the
way
we
are
the
in
this
design,
the
design
that
we
are
using.
We
are
different
in
only
few
ways
forth.
First
of
all,
our
rule
file
does
not
contain
any
alerts.
C
If
you
use
Falco
in
a
vanilla
mode,
this
rule
file
contain
all
the
alerts
that
we
showed
you,
whether
somebody
is
creating
a
shell
within
the
container
or
some,
where
or
or
or
/bin
directory
is
being
written.
Those
kind
of
alerts
normally
are
in
the
rule
file,
but
our
rule
file
does
not
contain
any
of
those
alerts.
C
Our
rule
file
just
contains
few
instructions
for
Falco
on
what
system
calls
it
should
collect
what
system
call
it
should
not,
and
we
also
have
some
filters
to
avoid
the
to
reduce
the
volume
of
data
that
is
coming
from
from
Falco,
and
then
we
are
using
cloud
watch
and
and
to
read
the
data
and
push
it
to
cloud
watch
logs
so
normal.
So
what
what
the
rules,
what
those
system
calls
are?
So
we
wanted
no
process.
C
We
wanted
to
capture,
process
creation,
file,
operations
and
network
connections,
so
we
are
monitoring
exactly
for
process
creation,
file,
open,
open
system
call
and
network
connection
connect
system
cause.
We
are
monitoring
it,
it
would
it.
It
will
tell
more
system
cause
like
a
rename
rename
at
open,
open,
add
unlink
and
look
at
those
kind
of
things
that
can
tell
you,
if
somebody
is,
is,
is
doing
some
kind
of
anomalous
operations,
but
again
rule
file
just
contains
what
system
calls
to
collect.
C
So
now
we
have
Falco
started
generating
the
data
data
is
coming
in
a
very
high
volume.
I
will
show
you
some
numbers,
so
next
up
is
driftwood
comes
into
the
picture
now.
Triffids
job
is
to
collect
the
data
that
is
being
generated
by
falco,
enrich
the
data
further,
because
that
was
one
of
our
requirement
to
have
more
contacts
associated
with
the
data
and
then
visualize
it
create
loss,
graph
and
charge
sawed
off.
C
So
this
is
how
driftwoods
pipeline
looks
like
again.
It's
entirely
server
less
this
pipeline,
so
the
goal
was
to
create
a
generalized
system
that
we
can
just
not
not
only
use
with
Falco
but
with
others
services
as
well,
so
driftwood
cluster
is
our
analytic
thought
that
intelligence
cluster
for
our
for
for
all
the
data
that
said
that
we
have
so
even
ELB
log
VPC
flow
log,
oddity
log,
all
kinds
of
log
goes
through
our
driftwood
cluster
and
falco
log
is
one
of
the
inputs
and
we
have
a
multi
account
a
strategy.
C
We
have
multiple
AWS
accounts,
so
you
can
see
there
on
the
left
side.
We
have
a
different
different
accounts,
running
different
different
cloud
watch,
because
each
of
those
accounts
can
run
some
vm
in
containers
and
they
all
will
be
pushing
the
data
through
this
interpret
pipeline.
So
now
cloud
watch
is,
is
basically
storing
Falco
data
graph,
their
Application
Firewall
data.
C
There
are
more
data
sources
and
all
these
accounts
will
start
sending
data
to
the
firehose
that
say
ws,
message,
bus
and
that
when
data
goes
to
the
firehose
Farwell
stores
the
data
into
the
three
bucket
and
this
as
three
bucket
has
a
event-driven
lambda
associated
with
it.
With
it,
as
you
can
see,
that
as
three
is
generating
SNS
events
and
this
event-driven
lambda,
we
call
it
in
ritual
lambda
is
getting
involved
every
time
the
log
is
written.
C
When
the
log
is
returned,
it
abuse
lambda
takes
it
enriches
it
I'll
show
you
what
kind
of
enrichment
that
we
do
and
then
it
stores
in
the
elastic
search
and
a
copy
of
enriched
data
is
also
stored
inside
the
another
s3
bucket
for
alerting
purposes,
and
these
enrichment
that
you
get
in
C
is
customized
for
each
type
of
data
and
data
source.
So,
for
example,
for
valve
data
might
go
through
include.
It
goes
through
different
enrichment
process
compared
to
Falco
data
and
based
on
the
data
type
at
runtime.
C
We
can
decide
which
processes
to
use
to
to
enrich
the
data,
so
some
of
the
enrichment
that
we
do
first
of
all
iptg
or
mappings
right,
we
get
a
IP
data,
but
we
associate
geo
locations
with
that
then
IP
to
resource
data
for
each
IP
that
we
are
getting.
We
can
so
see
at
that
weather.
This
IP
belongs
to
s3
or
not,
or
whether
this
means
this
traffic
is
going
through.
C
S3
or
this
traffic
is
going
through
that
or
this
traffic
is
going
to
load
balancers,
so
that
kind
of
enrichment
that
we
do
as
well
and
then
instance
of
cluster
type
that
whether
this
instance
belong
to
easiest
cluster
or
UK's,
cluster
or
path
is
part
of
the
transcoding
pipeline.
Or
is
it
the
Web
API
pipeline
so,
and
we
also
attach
VP
cid
and
all
those
things
with
the
data
set
so
that
basically
realizes
so
driftwood,
basically
full
full
service
requirement
of
raw
data
and
the
enrichment
data.
C
So
some
numbers
right
so
in
a
peak
day
we
process
close
to
two
hundred
forty
million
raw
events
that
goes
through
our
pipeline.
These
are
just
raw
system
calls
right
that
we
are
collecting
every
day
on
a
given
weekend
on
Saturday
Sunday.
We
it
comes
down
to
76
million
or
seventy-five
millions
right
now.
It's
like
a
10
million
even
spur
are
the
deviation
and
and
standard
deviation,
and
is
almost
same.
So
it's
not
that
we
see
100
million
events
per
hour
in
a
day.
C
So
this
is
how
a
single
record
looks
like.
So,
if
you
have
a
open
system,
call
right
that
Chris
showed
you.
This
is
all
we
are
collecting
for
that
single
open
we
are
collecting,
which
instance
is
coming
from
its
private
IP
instance.
Type
container
name
contain
an
image,
repository,
VPC
flow,
ID,
subnet
ID,
and
what
file
was
opened?
What
process
opened
it?
What
was
the
parent
process
and
all
those
things
so,
as
you
can
see
that
it's
a
quite
a
bit
of
information
and
there
pids
as
well.
C
C
So
it
has
all
all
those
integrations
as
well,
and
it
can
allow
very
easy
white
listing
and
throttling
features
as
well,
so
that
if
the
others
are
keep
coming,
you
can
whitelist
them.
If
you
know
it
says
a
benign
alert
and
you
can,
if
alerts
are
coming
with
it,
let's
say
that
you
are
any
hundred
VMs
and
all
of
them
saw
the
same
event
and
all
of
them
send
our
alert.
At
the
same
time,
you
can
use
startling
feature
to
tell
them
hold
it
back
for
you,
so
this
is
Bobby
architecture.
C
So
again,
it's
using
lot
of
server,
let's
even
given
lambda
functions,
but
but
now
recall
that
B's
we
store
the
Falco
data
in
s3
bucket
the
English
data
right,
so
so
that
s3
is
pointing
to
that
s3
bucket.
Now
this
has
three
bucket
as
soon
as
data
is
stored,
it
again
since
the
event-driven
lambda
as
function
and
and
invoke
the
rule
engine
lambda
and
this
rule
engine
lambdas
job
is
to
take
the
data
that
is
sent
by
trip
wood
and
read
the
rule
engines
file.
C
Our
alert
file
that
that
that
we
have
a
centralized
file
in
the
database
where
not
centralized,
alerting
database
where
we
can
have
all
those
rules
crafted
the
rules
are
very
similar
to
what
rules
you
see
in
the
Falco
file.
But
then
you
can,
it's
like
a
command
ran
out
of
time
or
shell
was
created,
crypto
mining
is
happening,
and
so
on
and
all
those
errors
and
rule
in
general
gets
a
data
from
Chris
would
get
the
rules
and
applies
that
and
decides
whether
it
needs
to
it
needs
to
be
a
la.
C
It
needs
to
allow
the
security
team
or
not
and
what
we
have
also
the
Dino
to
be
a
set
of
whitelist
that
we
have
already
developed
over
time.
So
it
also
checks
with
the
white
listing
option
saying
that
well,
this
alert
needs
to
be
generated
or
not.
If
there's
that
noise-
it's
not
in
the
vital
it's
a
new
alert,
then
it
can
send
it
to
multiple
output
sources,
so
slack
off
jeanne
and
elasticsearch
with
every
day
appropriate
priority.
So
whether
we
have
to
subject
somebody
up
in
the
night,
then
it's
a
p1p2.
C
Otherwise
you
can
look
into
up.
Look
at
it
when
you
are
in
the
office
and
from
slack
when
you
get
a
message
on
slack,
you
can
actually
take
action
on
those
alloys,
so
you
can
either
whitelist
or
you
can
ignore
those
alerts.
And
then
you
press,
the
whitelist
there's
a
api
gateway
and
part
from
the
slack
web
gets
fired
and
it
goes
through
api
gateway
and
invoked
another
lambda
and
that
lambda
basically
stores
that
bite.
C
So
this
is
how
concept
file
look
like
right,
so
it's
based
on
object,
path,
language.
So
let's
say
alerts
call
come
on
out
of
tamp
right.
If
that
is
the
alert,
then
we
have
some
conditions
that,
and
that
is
the
system
calls
these
needs
to
be
exactly
e
and
which
is
like
event
type,
and
we
need
to
know
some
execution
path
or
something,
and
then
the
notify
tells
you.
C
C
C
So,
but
then
we
we
have
an
option
to
whitelist
this
alert
and
you
can
see
that
well,
the
entire
command
that
was
executed
in
order
for
in
order
to
run
this
this
thing
here
we
are
not
showing
you
the
white
listing
option,
because
generally
we
don't
want
to
have
a
discolor
of
of
white
listing
P
ones
right.
We
want
to
go
and
look
into
P
ones.
C
C
So
again,
ork
is
not
very
security
sensitive,
but
we
have
not
seen
odd
before
from
this
VM,
and
this
is
the
development
VM.
So
we,
when
we
see
alerts
from
the
development
VM,
we
basically
go
ahead
and
and
and
either
whitelist
or
take
some
action
so
that
we
can
learn
from
this
behavior
and
same
behavior
should
not
be
alerted
when
it
happens
in
the
production-
and
here
you
can
see
the
white
listing
options,
and
these
are
the
three
white
listing
options
that
we
have
and
these
white
listing
option
changes
depending
on
race
and
networking.
C
A
lot
or
file
alert
or
process
alerts,
and
this
is
a
process
alert
we
allow
you
to.
We
have
this
thing
that
you
can
whitelist
just
by
being
processed
name
so
based
on
problem,
and
so
it
will
be
vital,
steady
using
process
in
execution
path.
If
not,
then
it
will
be
by
if
you
do
process
in
parallel,
then
process,
execution
path
and
parent
field
will
be
used
to
generate
a
md5
hash.
So
the
next
time
and
the
same
alert
comes.
All
those
fields
will
be
used
to
decide.
C
C
We
have
some
other
use
cases
as
well
other
than
alerting
security
and
visibility.
We
use
Falco
a
lot
during
debugging
process
whenever,
because
we
are
collecting
raw
system
calls.
So
we
can
see
what
is
happening
just
by
when
something
happens.
We
can
go
and
look
into
our
elasticsearch
logs
to
see
who
has
run
what
command
at
what
time.
C
We
mainly
use
a
lot
during
our
game
days
and
to
red
and
blue
team
exercise
when
somebody
runs
something,
and
we
look
into
the
slack
slack
channel,
obviously
anywhere,
that
those
alerts
are
coming
or
not
and
again,
since
we
can
see
the
raw
events,
we
will
know
what
is
happening.
I
have
now
again
during
the
chaos
engineering
as
well.
Then
we
want
to
make
sure
that
we
want
to
know
or
get
visibility
on
what
is
happening.
D
C
Seconds,
yes,
it's
very
fast
because
we
are
doing
in
the
real
time
we
as
soon
as
events
are
so
only
latency
that
we
have
is
is
the
actual
latency
within
the
head
of
those
services,
so
from
Falco
as
soon
as
logs
are
returned,
sister
things
are
happening,
pretty
fast
events.
If
systems
is
being
used
and
you
can
see
files
getting
filled
very
fast,
they
get
pushed
to
the
cloud
wash
log
cloud
watch.
Log.
E
E
C
Sauce,
okay,
so,
depending
on
the
type
of
allure
that
you
are
talking
about
right
few
LS,
you
can
see
a
few
seconds.
You
will
at
least
a
little
bit,
maybe
a
few
more
seconds
of
the
seconds
to
midnight
between
right,
because,
depending
on
how
much
events
are
being
generated
at
that
time
right.
So
that's
not
if
the
log,
if
you
are
the
edge
of
the
log,
you
can
see
very
fast,
but
if
you
otherwise,
you
see
a
tease,
but
we
never
see
anything
goes
beyond
a
minute.
C
Right
so
false
positive,
real
problem
right
so
depending
on
I
think
that's
when
you
need
to
have
a
good
system
where
you
can
run
the
same
system
and
development
that
we
are
running
and
same
system.
We
are
in
production,
right,
Falco
solves
positives.
Are
it's
not
a
machine
learning
based
system?
So
it's
a
signature
based
system.
So
it's
your
appetite
on
what
you
want
to
see.
For
example,
our
alert
an
expected
process
is
spawned
by
nature.
C
It's
a
false
positive
right,
because
orc
is
not
an
alert
right,
but
the
thing
the
same
thing
is
that
we
wanted
to
see
that
we
wanted
to
get
the
visibility.
That's
why
we
have
these
alerts,
but
VI
we
have
kept
it
at
p4,
so
it
means
that
we
don't
want
to
be
waking
up
in
the
night
just
for
some
unexpected
process
point,
because
we
have
other
rules.
More
targeted
rules
are
in
place.
That
can
tell
us
or
something
bad
is
happening.
C
So
it
depends
on
what
kind
of
rules
so
rule
crafting
is
very
important
in
any
security
tools,
right
that,
if
you,
if
you
craft
a
very
general
generalized
rule,
saying
that
any
right
into
user
local
bin
should
be
notified,
then
you
will
find
that
most
of
the
time
even
AWS
agents
and
all
those
benign
programs.
Even
during
the
yum
update,
you
might
find
that
a
lot
of
things
are
operations
are
being
performed
in
the
directory
right.
C
So
it
means
that
you
have
to
you
have
to
craft
your
rule
in
a
way
that
either
time
you're
looking
for
very
specific
operations
or
you
don't
develop
your
white
list
over
time
so
that
you
know
that
oh
I'm,
not
gonna,
worry
about.
If
young
does
that
I'm
not
gonna
worry
about
rpm.
Does
that
and
that's
when
you
can
narrow
down
or
you
reduce
or
false
positive,
for
example,
even
an
expected
process
is
spawned.
C
A
A
little
bit
of
just
looking
to
the
future
on
how
we're
managing
rules
right
now
so
right
now
we're
using
Lua
Andy
amel
to
to
encapsulate
the
rules.
The
next
big
push
for
the
next
six
months
of
the
Falco
open-source
community
is
where
we're
going
to
be
pulling
out
a
lot
of
the
the
native
rule
parsing
that
actually
like
looks
for
configuration
on
disk
and
we're
gonna
expose
that
via
an
API.
So
basically
the
patterns
gonna
be
as
Falco
starts.
A
It's
gonna
start
with
no
configuration
and
it's
effectively
just
gonna,
be
a
very
empty
loop,
doing
virtually
nothing
and
then
you'll
be
able
to
start
sending
rules
to
it.
Dynamically
using
a
client
of
your
choice
and
you'll,
be
able
to
you
know,
create
rules
that
way
and,
of
course,
we're
going
to
increase
backwards.
Compatibility
by
just
having
a
simple
lightweight
CLI
program
that
parses
rules
as
they're
written
today
and
then
just
send
that
out
to
the
client.
Accordingly,.
A
This
is
a
big
design
choice
that
we
made
on
day
one
so
I'm
gonna
draw
a
quick
comparison
to
selinux
right
and
we're
gonna
use
selinux
to
the
kernel
versus
prevention
to
kubernetes,
and
this
is
what
I
was
talking
about
really
where
I
talked
about
prevention,
so
by
design
Falco
does
not
it's
not
in
the
business
of
preventing
anything
from
happening
right
like
we,
don't
want
to
confuse
surveillance
with
access
control.
Those
are
two
independent
systems
that
need
to
work
independent
of
each
other
that
are
both
necessary
to
have
a
secure
system.
A
So
the
the
pattern
that
we
see
most
folks
doing
is
detecting
some
sort
of
anomalous,
behavior
understanding
what
happened
coming
up
with
a
plan
of
like
understanding
what
the
attack
vector
was
what
they
did
and
what
they
were
after
and
then
either
through
an
automated
process
or
through
a
manual
process
responding
to
that
event
in
generating
prevention
policy
moving
forward.
If
you
would
like
to
use
Falco
to
say,
for
instance,
Kayla
pod
or
draft
some
OPA
policy
or
email
someone
or
to
destroy
a
cluster
or
Nuka
p.m.
A
A
Correct
and
so
like,
for
instance,
assisting
the
company
we
work
for
I
work,
for
we
have
like
we
have
patterns
that
we
suggest
in
some
of
our
offerings.
That
say,
like
here's,
how
you
one
could
respond
to
these
events,
but
the
the
Falco
open-source
project.
We
try
to
keep
the
scope
as
limited
as
possible,
and
it's
basically
a
surveillance
tool,
brain
and.
C
You
can,
as
you
can
achieve
some
of
these
automation
by
yourself.
Let's
say
in
our
design.
If,
then,
you
do
on
slack
say
rightly
so
it's
an
attack,
you
can
run
a
lambda
function
which
is,
can
go
and
kill
the
pod
or
which
can
go
in
and
take
some
remediation
action.
The
way
alw
sponsor
does
that
right.
A
And
if
you
look
in
me,
there's
a
train
behind
me.
If
you
look
into
Falco
repository,
we
have
a
tool
called
the
Falco
sidekick
and
we
also
have
one
called
the
Prometheus
exporter
as
soon
as
we
have
the
client
go
for
the
G
RPC
endpoint
and
Falco
folks
begin
contributing
very
lightweight
small
programs
to
do
arbitrary
tasks.
The
Prometheus
exporter
just
basically
relays
the
information
to
Prometheus
Falco
sidekick,
plug
connect
up
to
about
a
dozen
different,
well-known
open-source
tools
and
take
action
from
there.
C
C
C
C
Right
so
yeah
so
right
now,
Cerberus
is
a
glue
component
right
that
basically
taking
actions
right,
but
yeah
I
mean
we
can,
and
maybe
that's
the
reason
for
us
to
get
raw
events
is
to
be
more
creative
right.
We
can
do
a
lot
more
things
because
we
have
raw
events
right,
so
maybe
we
can
correlate
with
the
VPC
flow
log.
We
can
correlate
with
the
web
logs
firewall
logs
to
build
a
better
correlation
model
right
to
bet
about
holistic
picture
of
what
is
happening
in
the
cloud
right.
A
We're
able
to
read
virtually
any
piece
of
address
space
from
the
kernel
and
then
all
the
code
does
is
just
simply
echo
that
up
in
a
meaningful
map
to
user
land,
whereas
with
the
kernel
module,
we
could
actually
go
in
and
we
could
change
things
in
the
kernel
or
we
can
mutate
memory
and
there's
a
lot
of
things.
We
could
do
that
could
potentially
harm
our
system.
So
that's
why
e
BPF
really
is
getting
the
hype.
It
is
because
it's
fundamentally
safe
because
it's
read-only
sure.