Falco Logs Suspicious Events on Your K8s and Servers

Falco Logs Suspicious Events on Your K8s and Servers

Author: Bret Fisher June 2, 2023 Duration: 1:08:31

Bret and his co-host, Matt, are joined by Jason Dellaluce and Luca Guerra from Sysdig to talk about Falco, a tool I recommend for production clusters and knowing about any bad behavior on your servers.

🙌 The Agentic DevOps Guild has launched! It's a training + community + mentorship program for engineers wanting to learn the latest CI/CD automation and dive into Agentic DevOps. Meetups are happening now, with new course videos dropping every few weeks. Join the Guild and become your team's leader in AI for infrastructure automation https://www.bretfisher.com/theguild 🍾

Falco is a security tool I've mentioned multiple times on this show, because I mostly think that a low level security focused logging product is something that every production server needs. The ability to log unexpected events and behaviors on your Linux host is powerful and necessary to be able to audit what's really happening on your infrastructure outside of your app itself.

Falco has been a CNCF incubating project for over four years, and I was immediately drawn to it in its early days, because it was container and Kubernetes aware and it could log and alert with default rules for everything, from someone starting a shell inside a container, to a bash history file being deleted, to a container trying to talk to the Kubernetes API.

This episode will be useful for those of you new to tools like Falco and for those familiar with its basics, but also wanting to learn about newer features and use cases, which I did some learning on myself in this episode.


Live recording of the complete show from April 6, 2023 is on YouTube (Ep. #210).

★Topics★
Falco website
Falco on CNCF


You can also support this podcast by subscribing to my YouTube channel and my weekly newsletter at bret.news!

Grab the best coupons for my Docker and Kubernetes courses.
Join my cloud native DevOps community on Discord.
Grab some merch at Bret's Loot Box
Homepage bretfisher.com


Creators & Guests
  • (00:00) - Intro
  • (04:41) - Introducing the guests
  • (07:42) - What is Falco? Why do we need it?
  • (10:17) - What can Falco monitor?
  • (19:28) - How are events logged?
  • (33:16) - Does Falco classify alerts by severity?

Bret Fisher hosts DevOps and Docker Talk: Cloud Native Interviews and Tooling alongside Nirmal Mehta, pulling conversations directly from their live audience sessions. This isn't a theoretical lecture series; it's grounded in the practical, often messy realities of building and running modern systems. Each episode digs into the specific tools and philosophies shaping infrastructure today, from the foundational elements like Docker and container orchestration with Kubernetes or Swarm to the broader cultural shifts of DevOps, SRE, and platform engineering. You'll hear discussions that span the entire software lifecycle, touching on the integration of security with DevSecOps, the automation promises of GitOps, and what "Cloud Native" truly means for development teams. The dialogue stays focused on actionable insights and real-world use cases, offering a genuine sense of what works and what doesn't in the field. For anyone navigating the container and cloud ecosystem, this podcast serves as a regular, insightful check-in with practitioners and experts, hosted by someone deeply embedded in the community. The natural, interview-driven format makes complex topics accessible, ensuring listeners come away with more than just buzzwords-they get context and clarity.
Author: Language: English Episodes: 100

DevOps and Docker Talk: Cloud Native Interviews and Tooling
Podcast Episodes
AWS Lambda Containers [not-audio_url] [/not-audio_url]

Duration: 49:02
Bret and Nirmal are joined by Ken Collins, AWS Serverless Hero and Principal Engineer at Custom Ink to discuss all things Lambda and to dig into the details of running containers in serverless.🙌 The Agentic DevOps Guild…
Ephemeral & Preview Environments for Compose and Kubernetes [not-audio_url] [/not-audio_url]

Duration: 43:01
Bret and Nirmal are joined by Grayson Adkins and Josh Thurman on the show. They are co-founders of Uffizzi, an environments-as-a-service company for Docker Compose and Kubernetes.🙌 The Agentic DevOps Guild has launched!…
Codefresh and Argo CD with Dan Garfield [not-audio_url] [/not-audio_url]

Duration: 1:01:33
Bret is joined by Dan Garfield of CodeFresh to talk about growth of GitOps as a standard, growth of Argo, and more.🙌 The Agentic DevOps Guild has launched! It's a training + community + mentorship program for engineers w…
OpenSauced with Brian Douglas [not-audio_url] [/not-audio_url]

Duration: 53:09
In this episode, Bret and Nirmal talk with Brian Douglas of OpenSauced. 🙌 The Agentic DevOps Guild has launched! It's a training + community + mentorship program for engineers wanting to learn the latest CI/CD automation…
Istio Ambient Mesh and Solo.io [not-audio_url] [/not-audio_url]

Duration: 1:04:59
Bret and Nirmal welcome Idit Levine, Founder/CEO Solo.io. Idit focuses on Service Mesh, API-GW and Multi-Cloud networking, and security.🙌 The Agentic DevOps Guild has launched! It's a training + community + mentorship pr…
Future of Kubernetes with Brendan Burns [not-audio_url] [/not-audio_url]

Duration: 1:04:51
Bret and Matt welcome special guest Brendan Burns, CVP Azure Cloud Native & Resource Management, and also a founding member of the Kubernetes project.🙌 The Agentic DevOps Guild has launched! It's a training + community +…
Kasten K10 Kubernetes Backups [not-audio_url] [/not-audio_url]

Duration: 1:11:03
Bret and Matt welcome Michael Cade, the field CTO at Kasten by Veeam. 🙌 The Agentic DevOps Guild has launched! It's a training + community + mentorship program for engineers wanting to learn the latest CI/CD automation a…
Cycle.io LowOps container platform [not-audio_url] [/not-audio_url]

Duration: 52:17
Bret and Matt welcome Jake Warner back to the show to talk about LowOps. What does LowOps mean? What can Cycle offer us as an alternative to Swarm and Kubernetes?🙌 The Agentic DevOps Guild has launched! It's a training +…
AWS containers with Corey Quinn [not-audio_url] [/not-audio_url]

Duration: 1:07:31
Bret and Matt are joined by Corey Quinn to talk about AWS and containers.🙌 The Agentic DevOps Guild has launched! It's a training + community + mentorship program for engineers wanting to learn the latest CI/CD automatio…
Podman In Action: Desktop, Machine, and more [not-audio_url] [/not-audio_url]

Duration: 1:00:42
Bret and Matt are joined by Brent Baude and Dan Walsh from Red Hat to talk about the latest with Podman, Quadlet, Podman Desktop and Podman machine, and how it all works with Kubernetes.🙌 The Agentic DevOps Guild has lau…