Falco Runtime Security: Kubernetes Threat Detection & Alert Rules

Falco is a CNCF graduated open-source runtime security tool that detects threats inside running containers by monitoring Linux syscalls. It acts as a behavioral detection layer that catches exploits, container escapes, and insider threats that pre-deployment scanning cannot see.

What is Falco and Runtime Security?

Traditional security tools (SAST, DAST, vulnerability scanners) analyze code and configurations before deployment. Runtime security monitors what actually happens when your containers run. Even a perfectly hardened container can be attacked via a zero-day exploit — Falco detects the attacker's behavior: spawning a shell, reading credential files, or making unexpected network calls.

Falco was originally created by Sysdig and donated to the CNCF in 2018. It's now a CNCF graduated project and the de facto standard for Kubernetes runtime threat detection.

Architecture: Kernel Module vs eBPF

Falco intercepts syscalls via a kernel-space probe and evaluates them against rules in userspace. Two probe types are available:

Installation via Helm

# Add Falco Helm repo
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update

# Install with eBPF driver
helm install falco falcosecurity/falco \
  --namespace falco \
  --create-namespace \
  --set driver.kind=ebpf \
  --set falcosidekick.enabled=true \
  --set falcosidekick.webui.enabled=true

# Verify DaemonSet is running
kubectl get pods -n falco

Default Rules — What Falco Detects Out of the Box

# View default rule file
kubectl exec -it -n falco daemonset/falco -- cat /etc/falco/falco_rules.yaml | grep "^- rule:" | head -20

# Key default rules:
# Terminal shell in container
# Write below etc
# Read sensitive file untrusted
# Unexpected outbound connection destination
# Container drift detected
# Privilege escalation using setuid binary

Writing Custom Falco Rules

# custom_rules.yaml
- macro: nginx_container
  condition: container.image.repository = "nginx"

- list: allowed_nginx_ports
  items: [80, 443]

- rule: Unexpected port opened by nginx
  desc: Nginx is listening on a non-standard port
  condition: >
    evt.type = listen and
    nginx_container and
    not fd.sport in (allowed_nginx_ports)
  output: >
    Nginx listening on unexpected port
    (port=%fd.sport container=%container.name image=%container.image.repository)
  priority: WARNING
  tags: [network, custom]

- rule: Crypto mining process detected
  desc: Detect known crypto miner process names
  condition: >
    spawned_process and
    proc.name in (xmrig, minerd, cpuminer, ccminer)
  output: >
    Crypto miner detected (proc=%proc.name user=%user.name container=%container.name)
  priority: CRITICAL
  tags: [process, crypto]

Alert Channels via Falcosidekick

# Falcosidekick values in Helm
falcosidekick:
  enabled: true
  config:
    slack:
      webhookurl: "https://hooks.slack.com/services/..."
      minimumpriority: "warning"
    prometheus:
      # metrics exposed at :2801/metrics
    elasticsearch:
      hostport: "http://elasticsearch:9200"
      index: "falco-alerts"
      minimumpriority: "notice"

Falco vs Runtime Security Alternatives