Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises.
Start a fresh conversation. Replace the highlighted placeholders.
Use performing-cloud-native-forensics-with-falco to deploy and manage Falco detection rules for [authorized test or lab cluster] and produce an incident-response alert analysis.
Required inputs
[authorized test or lab cluster]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: performing-cloud-native-forensics-with-falcodescription: 'Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises. 'domain: cybersecuritysubdomain: cloud-securitytags: - cloud-security- falco- runtime-threat-detection- container-forensics- kubernetes-security- syscall-monitoringversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.IR-01- ID.AM-08- GV.SC-06- DE.CM-01mitre_attack: - T1078.004- T1530- T1537- T1580- T1068
Performing Cloud Native Forensics with Falco
When to Use
When conducting security assessments that involve performing cloud native forensics with falco
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Familiarity with cloud security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Instructions
Deploy and manage Falco rules for runtime security detection in containerized
environments. Parse Falco alerts for incident response.
# Custom Falco rule for detecting shell in container
- rule: Shell Spawned in Container
desc: Detect shell process started in a container
condition: >
spawned_process and container
and proc.name in (bash, sh, zsh, dash, csh)
and not proc.pname in (docker-entrypo, supervisord)
output: >
Shell spawned in container
(user=%user.name command=%proc.cmdline container=%container.name
image=%container.image.repository)
priority: WARNING
tags: [container, shell, mitre_execution]
Key detection rules:
Shell spawn in non-interactive containers
Sensitive file access (/etc/shadow, /etc/passwd)
Outbound connections from unexpected containers
Privilege escalation via setuid/setgid
Container escape via mount or ptrace
Examples
# Run Falco with custom rules
falco -r /etc/falco/custom_rules.yaml -o json_output=true
# Parse JSON alerts
cat /var/log/falco/alerts.json | python3 -c "import json,sys; [print(json.loads(l)['output']) for l in sys.stdin]"