Custom rule for shell in container falco

Minimal custom rule with condition/output/priority; loaded from rules.d drop-in dir

cat > /etc/falco/rules.d/shell.yaml <<'EOF'
- rule: Shell in container
  desc: A shell was spawned in a container
  condition: container and proc.name in (bash, sh, zsh)
  output: "Shell spawned (pod=%k8s.pod.name cmd=%proc.cmdline)"
  priority: WARNING
EOF

#falco #security #k8s

more falco all 6 commands →

Validate rules file before reload falco -r /etc/falco/falco_rules.yaml --validate Filter critical alerts from logs kubectl logs -l app.kubernetes.io/name=falco -n falco | jq 'select(.priority=="Critical")' Install rules from artifact registry falcoctl artifact install falco-rules:latest && falcoctl artifact list Run a timed capture window falco -M 60 -o json_output=true 2>/dev/null | jq -c '{rule,output_fields}' List supported event fields falco --list | grep -E 'k8s\.|container\.|proc\.' | sort