Practical Cloud Native Security with Falco

Preface
Who Is This Book For?
Overview
Part I: The Basics
Part II: The Architecture of Falco
Part III: Running Falco in Production
Part IV: Extending Falco
Conventions Used in This Book
Using Code Examples
O’Reilly Online Learning
How to Contact Us
Acknowledgments
Leonardo
Loris

Part I. The Basics
1. Introducing Falco
Falco in a Nutshell
Sensors
Data Sources
Rules
Data Enrichment
Output Channels
Containers and More
Falco’s Design Principles
Specialized for Runtime
Suitable for Production
Intent-Free Instrumentation
Optimized to Run at the Edge
Avoids Moving and Storing a Ton of Data
Scalable
Truthful
Robust Defaults, Richly Extensible
Simple
What You Can Do with Falco
What You Cannot Do with Falco
Background and History
Network Packets: BPF, libpcap, tcpdump, and Wireshark
Snort and Packet-Based Runtime Security
The Network Packets Crisis
System Calls as a Data Source: sysdig
Falco

2. Getting Started with Falco on Your Local Machine
Running Falco on Your Local Machine
Downloading and Installing the Binary Package
Installing the Driver
Starting Falco
Generating Events
Interpreting Falco’s Output
Customizing Your Falco Instance
Rules Files
Output Channels
Conclusion

Part II. The Architecture of Falco
3. Understanding Falco’s Architecture
Falco and the Falco Libraries: A Data-Flow View
Drivers
Plugins
libscap
Managing Data Sources
Supporting Trace Files
Collecting System State
libsinsp
State Engine
Event Parsing
Filtering
Output Formatting
One More Thing About libsinsp
Rule Engine
Conclusion

4. Data Sources
System Calls
Examples
Observing System Calls
Capturing System Calls
Accuracy
Performance
Scalability
So What About Stability and Security?
Kernel-Level Instrumentation Approaches
The Falco Drivers
Which Driver Should You Use?
Capturing System Calls Within Containers
Running the Falco Drivers
Kernel Module
eBPF Probe
Using Falco in Environments Where Kernel Access Is Not Available: pdig
Running Falco with pdig
Falco Plugins
Plugin Architecture Concepts
How Falco Uses Plugins
Conclusion

5. Data Enrichment
Understanding Data Enrichment for Syscalls
Operating System Metadata
Container Metadata
Kubernetes Metadata
Data Enrichment with Plugins
Conclusion

6. Fields and Filters
What Is a Filter?
Filtering Syntax Reference
Relational Operators
Logical Operators
Strings and Quoting
Fields
Argument Fields Versus Enrichment Fields
Mandatory Fields Versus Optional Fields
Field Types
Using Fields and Filters
Fields and Filters in Falco
Fields and Filters in sysdig
Falco’s Most Useful Fields
General
Processes
File Descriptors
Users and Groups
Containers
Kubernetes
CloudTrail
Kubernetes Audit Logs
Conclusion

7. Falco Rules
Introducing Falco Rules Files
Anatomy of a Falco Rules File
Rules
Macros
Lists
Rule Tagging
Declaring the Expected Engine Version
Replacing, Appending to, and Disabling Rules
Replacing Macros, Lists, and Rules
Appending to Macros, Lists, and Rules
Disabling Rules
Conclusion
8. The Output Framework
Falco’s Output Architecture
Output Formatting
Output Channels
Standard Output
Syslog Output
File Output
Program Output
HTTP Output
gRPC Output
Other Logging Options
Conclusion

Part III. Running Falco in Production
9. Installing Falco
Choosing Your Setup
Installing Directly on the Host
Using a Package Manager
Without Using a Package Manager
Managing the Driver
Running Falco in a Container
Syscall Instrumentation Scenario
Plugin Scenario
Deploying to a Kubernetes Cluster
Using Helm
Using Manifests
Conclusion

10. Configuring and Running Falco
Configuring Falco
Differences Among Installation Methods
Host Installation
Containers
Kubernetes Deployments
Command-Line Options and Environment Variables
Configuration Settings
Instrumentation Settings (Syscalls Only)
Data Enrichment Settings (Syscalls Only)
Ruleset Settings
Output Settings
Other Settings for Debugging and Troubleshooting
Configuration File
Ruleset
Loading Rules Files
Tuning the Ruleset
Using Plugins
Changing the Configuration
Conclusion

11. Using Falco for Cloud Security
Why Falco for AWS Security?
Falco’s Architecture and AWS Security
Detection Examples
Configuring and Running Falco for CloudTrail Security
Receiving Log Files Through an SQS Queue
Reading Events from an S3 Bucket or the Local Filesystem
Extending Falco’s AWS Ruleset
What About Other Clouds?
Conclusion
12. Consuming Falco Events
Working with Falco Outputs
falco-exporter
Falcosidekick
Observability and Analysis
Getting Notified
Responding to Threats
Conclusion

Part IV. Extending Falco
13. Writing Falco Rules
Customizing the Default Falco Rules
Writing New Falco Rules
Our Rule Development Method
Things to Keep in Mind When Writing Rules
Priorities
Noise
Performance
Tagging
Conclusion

14. Falco Development
Working with the Codebase
The falcosecurity/falco Repository
The falcosecurity/libs Repository
Building Falco from Source
Extending Falco Using the gRPC API
Extending Falco with Plugins
Preparing a Plugin in Go
Plugin State and Initialization
Adding Event Sourcing Capability
Adding Field Extraction Capability
Finalizing the Plugin
Building a Plugin Written in Go
Using Plugins While Developing
Conclusion

15. How to Contribute
What Does It Mean to Contribute to Falco?
Where Should I Start?
Contributing to Falcosecurity Projects
Issues
Pull Requests
Conclusion

Index
About the Authors