Discover how to enhance application security using Falco and eBPF in this informative conference talk from Conf42 Observability 2023. Explore runtime security concepts, syscalls, and the fundamentals of Falco and eBPF. Learn about Falco's architecture, including libscap and libsinsp libraries, the rule engine, and default ruleset. Understand how to connect Falco using Falcosidekick and react to events. Dive into the evolution of Falco plugins and witness a live demo. Gain insights on getting started with Falco and contributing to the project. Access additional resources, including the Falco documentation, GitHub repositories, and community channels for further learning and engagement.
Overview
Syllabus
intro
preface
who is thomas
runtime security?
syscalls
falco what's that?
ebpf...
...the hooks
...the verification
falco's architecture
libscap aka library for system capture
libsinsp aka library for system inspection
falco: the rule engine
falco: the default ruleset
connect falco: falcosidekick
react to events
falcosidekick ui
the evolution: the plugins
falco's current architecture
demo
getting started
how to contribute
Taught by
Conf42
Related Courses
-
Extend Falco with Plugins - Trigger Alerts with Any Stream of Events
-
Getting Started with Container Runtime Security Using Falco
-
Introduction to Falco - Cloud-Native Runtime Security
-
Deep Dive into Falco - Empowering DevSecOps with Real-time Container Security
-
Falco to Pluginfinity and Beyond - Cloud-Native Runtime Security
