Practical Cloud Native Security with Falco: Risk and Threat Detection for Containers, Kubernetes, and Cloud. Early Release

Cover
Copyright
Table of Contents
Preface
	Who Is This Book For?
	Overview
		Part I: The Basics
		Part II: The Architecture of Falco
		Part III: Running Falco in Production
		Part IV: Extending Falco
	Conventions Used in This Book
	Using Code Examples
	O’Reilly Online Learning
	How to Contact Us
	Acknowledgments
		Leonardo
		Loris
Part I. The Basics
	Chapter 1. Introducing Falco
		Falco in a Nutshell
			Sensors
			Data Sources
			Rules
			Data Enrichment
			Output Channels
			Containers and More
		Falco’s Design Principles
			Specialized for Runtime
			Suitable for Production
			Intent-Free Instrumentation
			Optimized to Run at the Edge
			Avoids Moving and Storing a Ton of Data
			Scalable
			Truthful
			Robust Defaults, Richly Extensible
			Simple
		What You Can Do with Falco
		What You Cannot Do with Falco
		Background and History
			Network Packets: BPF, libpcap, tcpdump, and Wireshark
			Snort and Packet-Based Runtime Security
			The Network Packets Crisis
			System Calls as a Data Source: sysdig
			Falco
	Chapter 2. Getting Started with Falco on Your Local Machine
		Running Falco on Your Local Machine
			Downloading and Installing the Binary Package
			Installing the Driver
			Starting Falco
		Generating Events
		Interpreting Falco’s Output
		Customizing Your Falco Instance
			Rules Files
			Output Channels
		Conclusion
Part II. The Architecture of Falco
	Chapter 3. Understanding Falco’s Architecture
		Falco and the Falco Libraries: A Data-Flow View
		Drivers
		Plugins
		libscap
			Managing Data Sources
			Supporting Trace Files
			Collecting System State
		libsinsp
			State Engine
			Event Parsing
			Filtering
			Output Formatting
			One More Thing About libsinsp
		Rule Engine
		Conclusion
	Chapter 4. Data Sources
		System Calls
			Examples
			Observing System Calls
		Capturing System Calls
			Accuracy
			Performance
			Scalability
			So What About Stability and Security?
			Kernel-Level Instrumentation Approaches
		The Falco Drivers
			Which Driver Should You Use?
			Capturing System Calls Within Containers
		Running the Falco Drivers
			Kernel Module
			eBPF Probe
			Using Falco in Environments Where Kernel Access Is Not Available: pdig
			Running Falco with pdig
		Falco Plugins
			Plugin Architecture Concepts
			How Falco Uses Plugins
		Conclusion
	Chapter 5. Data Enrichment
		Understanding Data Enrichment for Syscalls
			Operating System Metadata
			Container Metadata
			Kubernetes Metadata
		Data Enrichment with Plugins
		Conclusion
	Chapter 6. Fields and Filters
		What Is a Filter?
		Filtering Syntax Reference
			Relational Operators
			Logical Operators
			Strings and Quoting
		Fields
			Argument Fields Versus Enrichment Fields
			Mandatory Fields Versus Optional Fields
			Field Types
		Using Fields and Filters
			Fields and Filters in Falco
			Fields and Filters in sysdig
		Falco’s Most Useful Fields
			General
			Processes
			File Descriptors
			Users and Groups
			Containers
			Kubernetes
			CloudTrail
			Kubernetes Audit Logs
		Conclusion
	Chapter 7. Falco Rules
		Introducing Falco Rules Files
		Anatomy of a Falco Rules File
			Rules
			Macros
			Lists
			Rule Tagging
			Declaring the Expected Engine Version
		Replacing, Appending to, and Disabling Rules
			Replacing Macros, Lists, and Rules
			Appending to Macros, Lists, and Rules
			Disabling Rules
		Conclusion
	Chapter 8. The Output Framework
		Falco’s Output Architecture
		Output Formatting
		Output Channels
			Standard Output
			Syslog Output
			File Output
			Program Output
			HTTP Output
			gRPC Output
			Other Logging Options
		Conclusion
Part III. Running Falco in Production
	Chapter 9. Installing Falco
		Choosing Your Setup
		Installing Directly on the Host
			Using a Package Manager
			Without Using a Package Manager
			Managing the Driver
		Running Falco in a Container
			Syscall Instrumentation Scenario
			Plugin Scenario
		Deploying to a Kubernetes Cluster
			Using Helm
			Using Manifests
		Conclusion
	Chapter 10. Configuring and Running Falco
		Configuring Falco
		Differences Among Installation Methods
			Host Installation
			Containers
			Kubernetes Deployments
		Command-Line Options and Environment Variables
			Configuration Settings
			Instrumentation Settings (Syscalls Only)
			Data Enrichment Settings (Syscalls Only)
			Ruleset Settings
			Output Settings
			Other Settings for Debugging and Troubleshooting
		Configuration File
		Ruleset
			Loading Rules Files
			Tuning the Ruleset
		Using Plugins
		Changing the Configuration
		Conclusion
	Chapter 11. Using Falco for Cloud Security
		Why Falco for AWS Security?
		Falco’s Architecture and AWS Security
			Detection Examples
		Configuring and Running Falco for CloudTrail Security
			Receiving Log Files Through an SQS Queue
			Reading Events from an S3 Bucket or the Local Filesystem
		Extending Falco’s AWS Ruleset
		What About Other Clouds?
		Conclusion
	Chapter 12. Consuming Falco Events
		Working with Falco Outputs
			falco-exporter
			Falcosidekick
		Observability and Analysis
		Getting Notified
		Responding to Threats
		Conclusion
Part IV. Extending Falco
	Chapter 13. Writing Falco Rules
		Customizing the Default Falco Rules
		Writing New Falco Rules
			Our Rule Development Method
		Things to Keep in Mind When Writing Rules
			Priorities
			Noise
			Performance
			Tagging
		Conclusion
	Chapter 14. Falco Development
		Working with the Codebase
			The falcosecurity/falco Repository
			The falcosecurity/libs Repository
			Building Falco from Source
		Extending Falco Using the gRPC API
		Extending Falco with Plugins
			Preparing a Plugin in Go
			Plugin State and Initialization
			Adding Event Sourcing Capability
			Adding Field Extraction Capability
			Finalizing the Plugin
			Building a Plugin Written in Go
			Using Plugins While Developing
		Conclusion
	Chapter 15. How to Contribute
		What Does It Mean to Contribute to Falco?
		Where Should I Start?
		Contributing to Falcosecurity Projects
			Issues
			Pull Requests
		Conclusion
Index
About the Authors
Colophon