Custom rule for shell in container

Minimal custom rule with condition/output/priority; loaded from rules.d drop-in dir

cat > /etc/falco/rules.d/shell.yaml <<'EOF' - rule: Shell in container desc: A shell was spawned in a container condition: container and proc.name in (bash, sh, zsh) output: "Shell spawned (pod=%k8s.pod.name cmd=%proc.cmdline)" priority: WARNING EOF
tool
falco6 commands
tags
falcosecurityk8s

More falco commands

  • Validate rules file before reload
    falco -r /etc/falco/falco_rules.yaml --validate

    Lint rule syntax offline before applying; note: nonzero exit on error, use in CI gate

  • Filter critical alerts from logs
    kubectl logs -l app.kubernetes.io/name=falco -n falco | jq 'select(.priority=="Critical")'

    Pull only Critical Falco events from JSON output; requires json_output: true in falco.yaml

  • Install rules from artifact registry
    falcoctl artifact install falco-rules:latest && falcoctl artifact list

    Pull and manage versioned rules/plugins via OCI; modern: replaces manual rule file copying

  • Run a timed capture window
    falco -M 60 -o json_output=true 2>/dev/null | jq -c '{rule,output_fields}'

    Run Falco for 60s then exit; great for ad-hoc triage on a suspect node

  • List supported event fields
    falco --list | grep -E 'k8s\.|container\.|proc\.' | sort

    Discover filter fields for writing custom rule conditions and outputs

all 6 falco commands