Falco Basics

Falco is an open-source, cloud-native runtime security project that detects unexpected application behavior and alerts on threats at runtime. With a single sensor, Falco provides complete visibility into container and application activity using customizable rules.

Key Features

• Real-time anomaly detection (e.g., unexpected shells, suspicious syscalls)
• Full container visibility via a kernel module or eBPF sensor
• Flexible alerting with extendable rule engine
• Multiple output channels for seamless integration

How Falco Works

1. A Falco sensor runs on each host (kernel module or eBPF).
2. The sensor captures syscalls and container metadata.
3. Events are evaluated against your Falco ruleset.
4. When a rule condition is met, Falco emits an alert.

By default, Falco can detect scenarios such as:

• A shell spawned inside a container
• A server process spawning an unexpected child
• A sensitive file (e.g., /etc/shadow) being accessed

These often represent the first steps of an attacker who has gained container access.

Example: Detecting a Shell in an Nginx Pod

Consider an Nginx pod in your Kubernetes cluster. If someone executes a shell inside that pod, Falco’s default rules will trigger:

kubectl exec -it nginx-pod -- /bin/bash

Falco Console Output

15:00:46.499981927: Notice A shell was spawned in a container with an attached terminal (user=root uid=0 loginuid=19048
    container=9048a10aaf_7 (id=cbfbb5e6d496) shell=bash parent=func cmdline=bash terminal=34816
    container_id=cbfbb5e6d496 image=nginx)
Events detected: 6
Rule counts by severity:
    INFO:    2
    NOTICE:  3
    WARNING: 1

Triggered rules by rule name:
    Delete or rename shell history:    1
    Launch Privileged Container:       2
    Terminal shell in container:       3

Syscall event drop monitoring:
    - event drop detected: 0 occurrences
    - num times actions taken: 0

This alert provides:

• Timestamp & Severity: Notice
• Container Details: image nginx, container ID
• Rule Name: Terminal shell in container
• Context: user, shell type, parent process, etc.

Falco Outputs and UI Integration

Falco supports these output channels out of the box:

To enhance Falco with a user interface and external notification services, deploy Falco Sidekick. Sidekick enables you to:

• Ship alerts to Slack, Elasticsearch, PagerDuty, and more
• Expose a web UI for browsing and filtering events
• Persist events in durable backends

Sample Alert Payload

Below is a structured alert payload that you could send to Slack or another endpoint:

user.name:    root
environment:  production
datacenter:   paris
fd.name:      /bin/hack
proc.cmdline: touch /bin/hack
rule:         Fake rule
priority:     Error
time:         2021-04-13 20:58:00.746609046 +0000 UTC

With Falco Sidekick, configure HTTP or webhook integrations to automatically push this payload into your alerting system of choice.

In this article, you learned how Falco uses a single sensor and rule engine to secure containerized workloads at runtime. You saw how to detect an interactive shell in a container, inspect the alert output, and integrate Falco with external systems via Sidekick. Next, explore writing custom Falco rules and deploying Falco on Kubernetes.

Links and References

• Falco Documentation
• Falco Rules Language
• Falco Sidekick GitHub
• Kubernetes Exec Reference