Lion Cipher Lab
Author and tune host-level Falco detections (and actually cut the false-positive noise)
- SOC Analyst / Blue Team
- Advanced
- ~75 min
- Free · no account required
Why it matters
Anyone can install a runtime detector and turn on the default ruleset. The job that actually pays — detection engineering — starts the moment that ruleset drowns your analysts in false positives. A rule that fires 47 times an hour on normal traffic is not a detection; it is a training exercise in ignoring alerts, and the one real hit will land in the same muted channel as the 46 lies. So the real skill is not 'can you write a condition that catches the bad thing' — it is 'can you write one that catches the bad thing AND stays quiet on everything else, and can you prove it with numbers.' This…
What you'll learn
- host-level (not container) runtime detection: watching the Linux syscall stream on the box itself
- choosing the eBPF probe vs the kernel module, and confirming the driver loaded and events flow
- authoring a Falco rule from scratch: rule/desc/condition/output/priority/tags and the fields (proc.name, proc.pname, evt.type)
- mapping a detection to MITRE ATT&CK (T1059 Command and Scripting Interpreter)
- triggering a detection legitimately to confirm it fires, and reading the output line field-by-field
- the real job: measuring a rule's false-positive rate over a benign workload window
- cutting noise the RIGHT way with the exceptions field, macros, and lists (an allowlist of known-good parent/child pairs)
- tightening a condition without over-tuning it into a hole an attacker walks through
- the named failure modes: alert fatigue, an over-tuned exception, and rule ordering/priority
- detection-as-code: versioning rules and testing them against benign + attack corpora
Steps in this lab
- Host vs container scope, and the eBPF-vs-module driver choice
- Install Falco and confirm the driver loaded and events flow
- Author a custom HOST rule from scratch (map it to MITRE T1059)
- Trigger it legitimately and read the output line field-by-field
- Run a benign workload and watch the rule LIE (measure the FP rate)
- Cut the noise the RIGHT way: exceptions, macros, and a known-good list
- The named failure modes: over-broad, over-tuned, and rule ordering
- The judgment: noisy rules, the three levers, and detection-as-code