Falco 0.34: Runtime Security for Kubernetes

Introduction

Falco 0.34, released on September 5, 2022, continues to advance runtime security for Kubernetes. This release improves the rule engine, enhances Kubernetes integration, and expands threat detection capabilities for cloud-native environments.

Security features matter most when you’re trying to enforce guardrails without blocking delivery. This release is useful if you’re tightening policy, improving visibility, or hardening defaults across Kubernetes workloads.

Rule Engine Improvements

• Rule performance optimizations reduce overhead of rule evaluation.
• Rule syntax enhancements provide more expressive conditions for threat detection.
• Rule library expansion includes more pre-built rules for common security scenarios.
• Rule testing tools enable validation of rules before deployment.

Kubernetes Integration

1. CRD support enables managing Falco rules as Kubernetes resources.
2. Operator improvements simplify deployment and configuration management.
3. RBAC integration provides fine-grained access control for rule management.
4. Multi-cluster support enables centralized rule management across clusters.

Threat Detection

• Syscall monitoring improvements provide better visibility into container behavior.
• Network monitoring enhancements detect suspicious network activity.
• File system monitoring expansion tracks file access and modifications.
• Process monitoring improvements detect unauthorized process execution.

Observability & Alerting

• Event streaming improvements provide real-time security event delivery.
• Alert integration expansion supports more notification channels.
• Metrics expansion exposes detailed security metrics for Prometheus.
• Logging enhancements provide structured logs for security analysis.

Getting Started

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco

Create a custom rule:

- rule: Detect shell in container
  desc: Notice shell activity within a container
  condition: >
    spawned_process and container and
    shell_procs and proc.tty != 0 and
    container_entrypoint
  output: >
    Shell spawned in container (user=%user.name %container.info
    shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)
  priority: WARNING

Summary

Falco 0.34 continues to evolve as a leading runtime security solution, providing teams with powerful threat detection capabilities.