Tag archive
ScyllaDB, Debezium and Falco returned near-zero counts for different reasons. Reading the small numbers together shows how a measurement programme can report on software that is widely deployed and configured to stay quiet.
Collecting audit evidence and catching a breach are the same job. How I wired Falco into a Kubernetes admission controller so the runtime alert and the admission record tell one story.
You scan images in CI, sign them before deploy, and gate manifests at admission. Every one of those controls answers the same question: should this workload be allowed to start? None of them can tell…
The shipped k8s_api_server FQDN condition (fd.sip.name="kubernetes.default.svc.cluster.local") fired on neither Falco 0.43.1 nor 0.40.0 in our lab — and the falco.org example still shows pre-v0.19.0 fd.sip="1.2.3.4"
user.uid, user.loginuid, and fd.name under absent metadata on Falco 0.44.1 — plus the reported 4294967295 and /<NA> forms (0.31.0–0.40.0)
Set up falco kubernetes security with Helm and eBPF. Covers modern_ebpf driver, alert routing with Falcosidekick, and custom rules for real production threats.
Falco takes about ten minutes to install. One Helm chart, and within a minute you have alerts...
Falco ist in etwa zehn Minuten installiert. Ein Helm-Chart, und binnen einer Minute fließen...
Attack 2 of 4 in my K8s SOC Foundation build log. I simulated a full privileged container escape using nsenter, harvested kubelet credentials from the host, and documented the four Falco alerts that fired — two of them before I even exec'd into the pod.
Attack 1 of 4 in my K8s SOC Foundation build log. I simulated a real cryptojacking attack against my own cluster and documented everything Falco detected — MITRE ATT&CK mapping, alert timeline, Loki correlation, Trivy report, kube-bench baseline.
Finding out there is "suspicious activity" in your infrastructure is enough to make any DevOps...
In the first quarter of 2025, the CNCF reported that 73% of production Kubernetes clusters ran at...