Run a timed capture window falco
Run Falco for 60s then exit; great for ad-hoc triage on a suspect node
falco -M 60 -o json_output=true 2>/dev/null | jq -c '{rule,output_fields}'
more falco
all 6 commands →
List supported event fields
falco --list | grep -E 'k8s\.|container\.|proc\.' | sort
Custom rule for shell in container
cat > /etc/falco/rules.d/shell.yaml <<'EOF'
- rule: Shell in container
desc: A shell was spawned in a container
condition: container and proc.name in (bash, sh, zsh)
output: "Shell spawned (pod=%k8s.pod.name cmd=%proc.cmdline)"
priority: WARNING
EOF
Validate rules file before reload
falco -r /etc/falco/falco_rules.yaml --validate
Filter critical alerts from logs
kubectl logs -l app.kubernetes.io/name=falco -n falco | jq 'select(.priority=="Critical")'
Install rules from artifact registry
falcoctl artifact install falco-rules:latest && falcoctl artifact list