Runtime Security & Threat Detection

Identity prevents unauthorized access. Network policies restrict traffic. But what about threats INSIDE an authorized workload? A compromised container running a cryptominer, an attacker spawning a shell, malware reading sensitive files - these are runtime threats that require real-time detection and response.

Falco: Syscall-Based Detection

Falco is a CNCF graduated project that monitors Linux syscalls and alerts on suspicious behavior. It runs as a DaemonSet and watches every container on the node.

# Falco rule: detect shell spawned in container
- rule: Terminal shell in container
  desc: A shell was spawned in a container
  condition: >
    spawned_process and container and
    proc.name in (bash, sh, zsh, dash)
  output: >
    Shell spawned in container
    (user=%user.name container=%container.name
     image=%container.image.repository
     pod=%k8s.pod.name ns=%k8s.ns.name)
  priority: WARNING

Tetragon: eBPF Runtime Enforcement

Tetragon goes beyond detection - it can block malicious actions in real-time using eBPF. While Falco alerts you to a shell spawn, Tetragon can prevent the shell from executing.

eBPF: The Foundation

eBPF (extended Berkeley Packet Filter) runs verified programs in the Linux kernel without loading a traditional kernel module. It gives runtime security tools low-level visibility and enforcement hooks, with overhead that depends on the probes, event volume, and userspace processing and should be measured on the target workload.

Incident Response

Detection without response is just monitoring. The response pipeline should: alert the security team (Slack/PagerDuty), capture forensic data (pod logs, network connections), isolate the pod (NetworkPolicy deny-all), preserve evidence (do not delete the pod), and investigate root cause.