Lion Cipher Lab
Detect container threats at runtime with Falco
- Cloud Security
- Beginner
- ~40 min
- Free · no account required
Why it matters
Scanning an image before you run it, which the Trivy lab covered, tells you what known flaws are baked in. It cannot tell you what a container does once it is alive: a scan is a photograph taken before the show starts. Runtime detection is the other half of the job. A container that passed every scan can still be told to do something it was never meant to do at runtime, whether by a bug, a misconfiguration, or an attacker who got a foothold. Falco is a free, open-source, CNCF graduated project that watches the live stream of events a running system produces and raises a real-time alert the…
What you'll learn
- runtime threat detection
- syscall monitoring
- Falco
- reading a security alert
- understanding a detection rule
- writing and tuning a Falco rule
- image scanning vs runtime detection
Steps in this lab
- Two halves of container defense: scan before, detect during
- What Falco watches: system calls, the kernel's ground truth
- Install Falco on your Linux lab box
- Start Falco and watch the live stream
- Read a default rule: "Terminal shell in container"
- Trigger a benign detection in your OWN container
- Tune it, then write your own rule
- What you just did — and why you need both halves