►
From YouTube: Security In the Cloud With Falco: Overview And Project Updates - Jason Dellaluce & Luca Guerra
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from April 17-21, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Security In the Cloud With Falco: Overview And Project Updates - Jason Dellaluce & Luca Guerra, Sysdig
Speakers: Jason Dellaluce, Luca Guerra
Falco is the Cloud-Native Runtime Security project and the de facto Kubernetes threat detection engine. Join us to discover Falco and its ecosystem, hear the hottest news, and get up to speed as a contributor. In this session, Jason and Luca will dive into the most exciting recent developments and the upcoming project roadmap. You will learn about the recent support to ARM and gVisor, the next-generation eBPF probe, the growing adoption of the Falco libraries, the novel Cloud Security use cases, and much more.
A
A
And
also
a
couple
of
bucks
every
now
and
then
so
do
they
find
us
when
we
get
on
the
Twitter,
so
feel
free
to
reach
out
and
say
hi
first
things:
first,
what
is
follicles
security
tool
that
watches
everything
happening
in
your
system
as
angular
metabolic
suspicious
perspective,
ensuring
development
assistant
and
I'm
actually
contributed
in
2017
in
business
yeah
so
currently,
probably
well
along
in
the
open
source.
Community
is
recognized
as
a
defective
standard
for
protection
and
kubernetes,
and
it's
an
easy
living
level
project
that
this
is
yet
very
clearly.
A
Now
my
security
tools
decide
to
collect
security
events,
store
them
and
use
that,
for
you
know,
query
and
leader
inspection
I
could
do
this
a
different
approach,
hardcore
watches
even
three
a
break
time
and
I.
You
know
priced
with
that,
so
it
could
be
using
exact
moment,
but
it
happens
so
that
you
can
get
a
divide.
A
This
is
going
to
begin
with
either
General
module
or
UPS
or
which
value
is
a
great
auditor
and
recently
since
one
year
ago,
we
should
build
up
to
one
of
the
software.
We
introduced
a
new
plugin
system
that
to
Cloud
Security
in
a
broader
sense,
it
makes
you
basically
try
to
adjust
security
events.
You
know
different
kind,
for
example,
we're
able,
as
you
can
see,
to
connect
contact
with
the
U.S,
cloudtrail
and
pull
you
know.
A
A
It
is
thanks
for
the
blocking
system.
I
had
introduced
in
version
0.31,
which
basically
is
a
standard
way
for
now
to
create
and
develop
Hardware
extensions,
which
already
has
been
greatly
appreciated,
but,
of
course,
we're
going
to
forget
about
system
security
and
there
is
actually
development
on
that
aspect
as
well,
and
you
know
the
device
and
integration.
It's
a
big
knowledge
in
a
way
to
use
over
the
past
the
past
few
months,
which
we
will
cover
later.
A
A
We
introduced
official
support
to
the
r64
architecture.
Now
many
you
can
say
probably
that
this
is
not
a
big
deal
in
2022
and
this
problem
between
later
than
expected.
But
I
can
assure
you
that
when
there's
current
exploration
involved,
this
is
everything
brush
for
you
and
we
had
to
know
how
many
compromise
and
effort
s
who
have
achieved
with
this
goal,
but
now
you're
always
set.
So
from
now
on.
A
Whenever
a
new
phone
conversation
recipes,
we
can
provide,
you
know
official
packages
on
their
images
and
even
applying
artifacts
for
both
nearly
64
and
number
64.,
and
you
know
many
of
you
probably
already
know
that
we
also
provide
a
big
advocacy,
Theory
called
previous
modules
for
our
for
our
users
to
download
instead
of
attending
a
local
population
of
the
system
for
different
camera
versions,
real
estate
stores.
Now
we
support
964
for
those
as
well,
which
greatly
even
largest
possible
amount
to
give
the
data
user
systems.
A
A
In
this
case,
but
the
way
this
was
implemented
was
very
lucky.
You
know
we
lost
anodized
and
we
didn't
have
like
great
safety
measures
for
perspective,
nor,
if
you're
deployment
in
this
case,
so
this,
for
example,
caused
many
users
to
run
on
both
system
course.
Collection
and
academic
results
consumption.
What
it
is
not
necessary.
So
then,
when
the
value
system
was
introduced
in
version
0.31,
we
had
a
standardized
way
to
create
new
real
sources
that
would
actually
each
plugin
can
Implement
that
you
want
right.
A
A
great
example
again
is
database
Cloud
for
a
black
woman,
I
mentioned
before
so
one
other
thing
that
we
did
is
version.
3.32
was
reimplant
the
support
for
amazon.com
as
a
plugin,
entire
URL,
and
you
know,
with
Future
Part
before
we
had
before,
which
is
great
much
more
on
the
table,
and
you
know
easy
to
read
and
developer,
but
there
has
been
some
differences
from
before
and
the
biggest
one
is
that,
initially,
with
the
blanket
system
was
able
to
only
run
21
Source
very
configuration.
A
So,
for
example,
if
you
wanted
to
do
both
system,
cool
collection
and
gold,
University
supply,
for
example,
which
was
not
super
handy
and
manually
defaults
from
playing,
you
know,
because
it
was
a
data
for
what
we
had
in
the
basketball
today
is
all
of
us.
So
since
version
Philadelphia
degree,
a
couple
weeks
ago,
we
introduced
a
standardized
estate
support
for
multiple
resources.
A
Facebook
so
another
feature
that
we
recently
introduced
the
support
for
divisor
and
you
might
be
asking
that
what
is
device
or
not,
everyone
is
familiar
with
this
technology
as
a
security
person,
myself
I'm
really
excited
about
marketing,
because
it's
a
sandboxing
technology.
It's
been
developed
by
the
open
source,
payment
Google
and
it's
used
in
ukg
and
it's
completely
open
source
side
and
it
can
be
deployed
in
a
variety
of
different
system
design,
including
flavors
of
kubernetes.
A
So
a
lot
of
this
practical
way,
which
means
that
it's
going
to
make
our
containers
even
more
contained
containers
are
of
course,
already
have
security
properties,
but
the
divisor
is
going
to
sandwich
them
even
more,
limiting
the
system,
growth
that
they
can
do
and
actually
emulating
the
parts
of
the
Linux
operating
system
kernel
in
order
to
perform
actions
more
securely
and
not
adding
an
extra
layer
for
the
file
system,
elevation
and
also
second
boundaries.
So
this
means
that
a
lot
of
privilege
escalations
has
simply
not
happen
when
running.
A
Our
work
of
the
under
device
office
is
greater
for
a
lot
of
high
security
workloads
and
high
security
use
cases.
But
what
if
you
can,
if
you
want
to
also
observe
the
workloads
and
so
on?
Not
only
we
want
to
continue
them,
but
we
want
to
take
a
look
at
and
see
when
something
suspicious
is
happening
and
everything,
including
our
containers,
for
example,
for
compromised
workloads
or
potential
human
issues.
We
can
find
plug-in.
A
Well,
the
thanks
to
collaboration.
We
did
the
open
source
schema
at
managers
divisor.
We
were
able
to
create
a
new
a
way
to
plug
an
event
into
into
half
directly
into
this
cap,
so
that
not
only
part
of
the
management
program
is
not
any
open
source
product
that
uses
the
same
laborator,
and
in
this
way
we
can
go
directly
through
uninstalling
socket
in
user
space.
So
we
can
have
one
instance
of
performance
on
collecting
all
information
from
all
the
devices
and
boxes
and
forward
length
part.
A
A
Cases
that
have
some
rules
enabled
and
somebody
is
able
to
innovate.
Conversions.
So
now,
I
would
like
to
talk
to
you
a
bit
more
about
the
libraries.
The
same
scan
from
the
model
I
need
to
get
wrong
because
those
are
used
by
stock
market
that
are
not
necessary,
helpful
and
we
are
improving
that
a
lot
in
the
photo
Community
recently.
Actually,
it's
the
most
exciting
time
to
work
on
this
library,
because
we
are
thinking
the
highest
amount
of
contributions
to
the
libraries
ever
even
before
the
contribution
of
the
language
themselves
to
the
cnci.
A
So
now
what
really
does
a
lot
of
people
from
different
from
different
organizations
that
are
contributing
a
lot
of
code
issues,
features
in
circles
and
many
other
places
algorithm?
This
is
very
exciting
here
and
I
will
give
really
it's
really
a
pleasure
to
work
to
work
with
this
Labyrinth
now,
but
it
comes
with
a
little
bit
of
a
price
that
that
comes
straight
with
a
letter
from
our
one
of
our
containers
that
contributes
automatics
is
the
downstream.
They
were
saying
every
time
you
pull
some
reports,
we
get
some
work.
A
That
was
surprises,
so
I'm
sure
there
was
a
pleasantly
surprised
by
the
news
is
caused
by
their
performance
by
everything,
but
I.
Think
some
of
those
quote-unquote
surprises
were
not
completely
Pleasant
and
were
not
completely
joyful
and
as
a
part
of
community.
We
understand
because
the
more
clients,
more
people
that
want
to
use
the
library
more
changes,
and
so
we
need
to
do
some
cleanups
to
the
lips
themselves.
So
we've
got
now
verses
for
everything
we've
got
using
space.
We've
got
kernel
space
that
they
both
indoor
versions.
A
That
says,
we
don't
we're
just
there
adding
version
numbers,
so
we've
got
versions
for
the
interface
as
well.
So
when
you
load
the
driver,
maybe
in
the
next
compatible
client,
then
you
get
a
narrow,
installable
crash
after
one
and
we
added
more
testing
to
the
digital
fast
before
historically
the
clients
like
Funko
or
other
Downstream
had
tested
populations,
not
so
much.
So
what
should
we
test?
First,
a
little,
what
let's
pick
it
apart?
Well,
it
turns
out
that
the
system
software,
so
everything
is
written
out.
A
A
So
we
also
have
a
feature
that
was
highly
requested
by
our
clients.
If
the
time
knows
what
they're
doing
they
can
actually
decide,
which
this
course
and
which
way
to
play
more,
this
is
not.
This
doesn't
translate
powerful,
because
the
client
really
needs
to
know
what
they're
doing.
Otherwise,
we
get
very
consistent
results
of
our
clients.
That
is
the
ones
in
the
public
community
that
you
know
are
super
smart,
so
they
figured
it
out
easy.
A
Also
speaking
about
the
community,
without
a
creative
system,
we
always
have
products
and
open
source
project
huge
particle
and
then
integrate
your
platform.
Our
very
favorite
golfer
with
wings
I
take
that
can
now
send
events
to
even
more
even
more
Integrations.
So
also
we've
got
the
armed
supporter.
We've
got
the
policy
report
today.
A
Cosine,
thanks
to
the
one
figure
or
the
design
project
that
it's
really
growing
and
even
the
UI
might
be
knowing
from
such
a
sidekick
is
growing
a
lot
because
it's
been
completely
Rewritten.
It's
cool,
as
ever
when
I,
when
I
want
to
Democrat
I,
always
use
it
because
I
love
it
and
I
have
to
say
that
it
doesn't
have
the
limitation
that
the
old
one
had
about
a
number
of
events
per
tax
rate.
A
I
mean
that
someone
just
went
there
and
replaced
the
video
with
the
new
one,
and
this
is
great
because,
if
you're
buying
supporter,
you
know
the
appliance
and
it's
Incorporated,
it's
more
modern
and
it
means
are
easier
than
ever
to
deploy
hardcore
in
our
kubernetes
structures
and
speaking
of
the
ease
of
deployment.
I
believe
Json
has
some
updates
for
us
about
the
very
hard
test
that
might
surprise
and
supported
so
many
different
kernels,
and
so
many
different
versions.
A
So
it's
time
to
talk
about
current
crawl,
our
resolution
that
we
have
it
ecosystem
very
recently,
which
basically
calls
for
all
the
new
operations
supported
by
manually
Distributors,
at
least
the
ones
that
you
want
to
support.
So
the
good
thing
for
us
is
that
we
can
generate
priority
configurations,
which
is
the
entire
information
that
we
use
to
decide
which
investment
approach
and
current
modules
we
need
to
provide
the
community
to
you
know
to
install
with
a
part
of
our
local
previews
that
they
don't
have
to
buy
their
money.
A
So
before
we
had
that
we
needed
to
actually
enlarge
the
build
grid
manually.
Every
time
you
never
really
ask
for
it
or
every
time
you
have
to
decide
for
it.
You
need
to
upgrade
this
now.
The
federal
board
is
basically
a
headsets.
Problematically
up
to
date
is
really
great.
It
always
had
the
most
popular
General
versions
for
all
the
people's
distributions
that
we
use.
You
know
with
a
weekly
basis
with
big
with
it,
so
this
means
possible.
A
You
know
much
more
easy
to
install
and
much
more
accessible
for
people,
and
we
provide
many
many
more
previews
approach.
As
a
matter
of
fact,
we
provide
for
men,
so
even
during
the
last
three
years
we
actually
work
this
year.
So
we
need
to
work,
but
yeah
there's
really
a
lot
so
models
Point.
Here
we
store
all
this
information
that
we
grow
in
an
open
database,
which
is
the
one
you
see
at
the
link
and
it's
basically
a
social
group
about
all
the
latest
current
versions
or
HIV
distributions,
even
wider
and
I.
A
A
So
if
you're
interested
in
working
at
you
know
asking
our
area
please
check
out
this
morning,
and
this
screenshot
was
taken
from
one
of
the
website
early
into
this
live
and
basically
gives
you
a
hint
about
how
bigger
or
great
you
know,
Builder
it
is,
and,
as
you
can
see,
we
can
now
have
like
multiple
architectures,
maybe
we'll
probably
more
overcome
in
the
future,
and
those
students
could
be
replied
to
call
her
and
you
know
reviews
more
for
every
possibilities.
All
this
information
is
made
available
to
the
final
installed.
A
And
then
there
are
major
updates
in
the
body
resistant
as
well,
so
we
introduced
the
body
system
back
in
January
and
during
the
last
maintenance
tracking
Valencia.
You
know
you
just
made
around
for
only
a
few
months
now
applied
to
time
has
been
last
year
and
there's
been
like
a
major
growth
in
this
place.
So
among
all
the
black
is
that
we're
currently
supportive,
officially
I
think
these
were
the
ones
that
actually
deserve
a
professional
motion.
A
This
is
not
structure,
so
you
know,
since
the
actors
actually
configuration,
there's
also
a
new
body
for
a
GitHub
which
is
basically
able
to
secure
your
core
organization.
It's
able
to
attach
the
black
Empire
to
the
data
platform,
and
you
know
it's
important
security
events
and
many
of
them.
That's
the
secure
stuff,
for
example
like
committing
a
secret
in
your
credit
procedure,
which
is
a
good
thing,
it's
growing
net
and
we
also
you
know,
improved
the
matches.
A
The
way
we
had
developed
as
first
ones,
which
are
about
and
to
give
you
like
an
example
of
the
bowel
roll,
is
like
think
about
the
recent
reach
for
Uber
that
shot
produced
now
more
than
a
few
years
ago.
I
mean
you
also
blogging
in
this
case.
Of
course,
people
are
not
prevented
that,
but
would
that
be
able
to
refactor
that
you
know
very
document
manner,
which
will
be
probably
better?
You
know
for
everyone
in
the
case.
A
Lastly,
I
would
like
typically
gave
like
a
few
moments
on
the
updates
involving
our
community
from
our
website
industry,
attractive,
which
we
think
is
just
as
important
on
the
rest
of
the
updates
in
our
path
for
applying
through
graduation.
You
know
there's
something
that
we
communicate
effort
in
reviewing
and
improving
as
practice
right.
A
So
we
try
to
listen
everyone's
voice
here
and
we
improve
the
documents-
precise,
exhaustive,
a
bit
thanks
to
the
doctor
to
prescribers
before
I,
even
helped
us
along
the
way
by
the
way-
and
our
all
we
have
is
in
many
of
us-
are
that
we
clear
that
probably
also
the
community.
So
now
we
have
like
real
definitions
for
contributor
or
the
Redeemer
supporters.
A
Using
all
the
longer
and
calculation
featuring
technology,
we
don't
have
to
compromise,
and
then
we
would
like
to
leave
the
column
size,
Global,
they're
actually
substituted
in
the
future.
When
you
know
the
overall
don't
be
required
anymore,
and
you
know
the
features
here
with
leverage
improved
like
an
80
degree,
marker
Possible
only
access
and
that
important.
So
yes,
if
you
shoot
into
maybe
the
case
in
which
you
don't
have
to
build
any
direct
rules
for
everyone,
because
it
will
be
already
provided
through
your
system
right,
you
know
eight
minutes
called.
A
There
is
something
like
a
very,
very
awkward
development
and
it's
approaching
future
environmental
probe,
so
we're
almost
ready
to
roll
adopt
most
point.
This
came
with
a
native
Highway
industry.
We
basically
ensure
that
there
is
an
issue
engaged
and
performs,
as
expected
as
you
couldn't
reverses
in
the
future,
which
is
great
for
all
the
stakeholders
of
the
problem
with
other
products.
Beautiful
properties
and
curly
measurements
also
showed
that
this
new
growth
is
sort
of
more
performative
than
normal.
A
A
A
So
before
we
all
had
the
rules,
five
employees
outside
Parker,
so
we
had
our
customers
we
could
deployed
and
not
any
whatever
way
to
walk
to
the
Future
could
be.
It
could
be
enough
for
a
physical
amount
of
all
things
that
are
getting
much
more
complicated
because
we've
got
life,
a
monthly
platforms.
A
A
So
particularly,
this
is
active
as
a
little
better
and
it's
able
to
push
and
pull
the
package
user
that
contains
your
rules
and
markets.
When
decided
from
the
form
that
this
package
is
going
to
happen,
we
we
wanted
to
have
Associated
products,
because
this
way
it's
just
like
pulling
it
over
again.
Ocr
is
a
supported
directly
by
the
consequencer
that
you
might
already
have
is
called
a
poster
privately
or
publicly,
for
example,
GitHub
packages.
But
you
don't
need
to
do
anything
yet.
A
Even
more
features
to
use
in
the
future,
such
as
support
for
signing,
because
people
want
to
sign
our
activities
before
they
include
something
comes
off
around
in
the
cloud.
So
this
allows
us
to
get
a
much
better
experience,
but
I
think
when
going
out
with
the
fights-
and
you
might
be
asking
when
you
will
be
able
to
try
this
well,
you
can
try
it
today,
because
we
have
a
review
of
the
school
that
we
have
developed
over
the
last
several
months
and
you
can
have
directly
use
this
Google.
A
A
So
I
think
we've
told
you
a
lot
of
things
about
about
hardcore
and
I.
Think
there's
a
lot
of
exciting
things
that
are
happening
in
between
here
right
now,
so
applied
for
review
and
I
have
to
remind
you
again
that
you
can
just
sign
up
for
the
powerful
Community
we've
got
the
channel
stack,
we've
got
a
community
called
every
Wednesday
and
I
would
really
love
to
say
that
the
community
is
open
to
all
and
everyone.