Что такое Falco?

 1# Установка через пакетный менеджер
 2# Ubuntu/Debian
 3curl -s https://falco.org/repo/falcosecurity-3672BA8F.asc | apt-key add -
 4echo "deb https://download.falco.org/packages/deb stable main" | tee -a /etc/apt/sources.list.d/falcosecurity.list
 5apt-get update -y
 6apt-get install -y falco
 7
 8# CentOS/RHEL
 9rpm --import https://falco.org/repo/falcosecurity-3672BA8F.asc
10curl -s -o /etc/yum.repos.d/falcosecurity.repo https://falco.org/repo/falcosecurity-rpm.repo
11yum -y install falco
12
13# Или через Helm в Kubernetes
14helm repo add falcosecurity https://falcosecurity.github.io/charts
15helm repo update
16helm install falco falcosecurity/falco

 1# Запуск Falco как демон
 2sudo systemctl start falco
 3sudo systemctl enable falco
 4
 5# Запуск в интерактивном режиме
 6sudo falco
 7
 8# Запуск с custom конфигурацией
 9sudo falco -c /etc/falco/falco.yaml
10
11# Запуск с дополнительными правилами
12sudo falco -r /etc/falco/custom-rules.yaml

 1# /etc/falco/falco.yaml
 2rules_file:
 3  - /etc/falco/falco_rules.yaml
 4  - /etc/falco/falco_rules.local.yaml
 5  - /etc/falco/k8s_audit_rules.yaml
 6
 7# Outputs
 8stdout_output:
 9  enabled: true
10
11syslog_output:
12  enabled: true
13
14file_output:
15  enabled: true
16  keep_alive: false
17  filename: /opt/falco/events.txt
18
19http_output:
20  enabled: true
21  url: "http://localhost:8080/falco-events"
22
23# gRPC API
24grpc:
25  enabled: true
26  bind_address: "0.0.0.0:5060"
27  threadiness: 8
28
29# Buffered outputs
30buffered_outputs: false
31
32# JSON output
33json_output: true
34json_include_output_property: true

 1# custom-rules.yaml
 2- rule: Shell in Container
 3  desc: Notice shell activity within a container
 4  condition: >
 5    spawned_process and container and
 6    (proc.name in (shell_binaries) or
 7     (proc.name in (shell_interpreters) and
 8      not proc.args contains "-c"))
 9  output: >
10    Shell spawned in container (user=%user.name container_id=%container.id 
11    container_name=%container.name shell=%proc.name parent=%proc.pname 
12    cmdline=%proc.cmdline)
13  priority: WARNING
14
15- rule: Suspicious Network Activity
16  desc: Detect suspicious network connections
17  condition: >
18    inbound_outbound and container and
19    (fd.sport in (suspicious_ports) or fd.dport in (suspicious_ports))
20  output: >
21    Suspicious network activity (user=%user.name container_id=%container.id 
22    connection=%fd.name proto=%fd.l4proto)
23  priority: CRITICAL
24
25- rule: File Modified in /etc
26  desc: Detect modifications to /etc directory
27  condition: >
28    open_write and container and
29    fd.name startswith /etc and
30    not proc.name in (trusted_processes)
31  output: >
32    File in /etc modified (user=%user.name file=%fd.name 
33    container_id=%container.id process=%proc.name)
34  priority: ERROR

 1# falco-daemonset.yaml
 2apiVersion: apps/v1
 3kind: DaemonSet
 4metadata:
 5  name: falco
 6  namespace: falco-system
 7spec:
 8  selector:
 9    matchLabels:
10      app: falco
11  template:
12    metadata:
13      labels:
14        app: falco
15    spec:
16      serviceAccount: falco
17      hostNetwork: true
18      hostPID: true
19      containers:
20      - name: falco
21        image: falcosecurity/falco:latest
22        securityContext:
23          privileged: true
24        volumeMounts:
25        - name: dev-fs
26          mountPath: /host/dev
27        - name: proc-fs
28          mountPath: /host/proc
29        - name: boot-fs
30          mountPath: /host/boot
31        - name: lib-modules
32          mountPath: /host/lib/modules
33        - name: usr-fs
34          mountPath: /host/usr
35        - name: etc-fs
36          mountPath: /host/etc
37      volumes:
38      - name: dev-fs
39        hostPath:
40          path: /dev
41      - name: proc-fs
42        hostPath:
43          path: /proc
44      - name: boot-fs
45        hostPath:
46          path: /boot
47      - name: lib-modules
48        hostPath:
49          path: /lib/modules
50      - name: usr-fs
51        hostPath:
52          path: /usr
53      - name: etc-fs
54        hostPath:
55          path: /etc

1# prometheus-config.yaml
2- job_name: 'falco'
3  static_configs:
4  - targets: ['falco:8765']
5  metrics_path: /metrics
6  scrape_interval: 15s

 1# falco-slack-webhook.py
 2import json
 3import requests
 4from flask import Flask, request
 5
 6app = Flask(__name__)
 7SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK"
 8
 9@app.route('/falco-events', methods=['POST'])
10def handle_falco_event():
11    event = request.get_json()
12    
13    if event.get('priority') in ['CRITICAL', 'ERROR']:
14        slack_message = {
15            "text": f"🚨 Falco Security Alert",
16            "attachments": [
17                {
18                    "color": "danger" if event.get('priority') == 'CRITICAL' else "warning",
19                    "fields": [
20                        {
21                            "title": "Rule",
22                            "value": event.get('rule', 'Unknown'),
23                            "short": True
24                        },
25                        {
26                            "title": "Priority",
27                            "value": event.get('priority', 'Unknown'),
28                            "short": True
29                        },
30                        {
31                            "title": "Output",
32                            "value": event.get('output', 'No details'),
33                            "short": False
34                        }
35                    ]
36                }
37            ]
38        }
39        
40        requests.post(SLACK_WEBHOOK_URL, json=slack_message)
41    
42    return "OK", 200
43
44if __name__ == '__main__':
45    app.run(host='0.0.0.0', port=8080)

 1// Logstash конфигурация
 2input {
 3  http {
 4    port => 8080
 5    codec => json
 6  }
 7}
 8
 9filter {
10  if [rule] {
11    mutate {
12      add_field => { "event_type" => "falco_security" }
13    }
14    
15    if [priority] == "CRITICAL" {
16      mutate {
17        add_tag => [ "security_critical" ]
18      }
19    }
20    
21    date {
22      match => [ "time", "ISO8601" ]
23    }
24  }
25}
26
27output {
28  elasticsearch {
29    hosts => ["elasticsearch:9200"]
30    index => "falco-security-%{+YYYY.MM.dd}"
31  }
32}

 1# custom-k8s-rules.yaml
 2- macro: sensitive_mount
 3  condition: >
 4    (container.mount.dest[/proc*] != "N/A" or
 5     container.mount.dest[/var/run/docker.sock] != "N/A" or
 6     container.mount.dest[/] != "N/A" or
 7     container.mount.dest[/etc] != "N/A")
 8
 9- rule: Privileged Container Started
10  desc: Detect privileged containers
11  condition: >
12    container_started and container and
13    (container.privileged=true or sensitive_mount)
14  output: >
15    Privileged container started (user=%user.name 
16    container_id=%container.id container_name=%container.name 
17    image=%container.image.repository)
18  priority: WARNING
19
20- rule: Cryptocurrency Mining Activity
21  desc: Detect potential cryptocurrency mining
22  condition: >
23    spawned_process and container and
24    (proc.name in (xmrig, cpuminer, cgminer, bfgminer) or
25     proc.cmdline contains "stratum+tcp" or
26     proc.cmdline contains "mining.pool")
27  output: >
28    Cryptocurrency mining detected (user=%user.name 
29    container_id=%container.id process=%proc.name 
30    cmdline=%proc.cmdline)
31  priority: CRITICAL

 1# filesystem-rules.yaml
 2- rule: Write to /tmp from Container
 3  desc: Detect writes to /tmp directory
 4  condition: >
 5    open_write and container and
 6    fd.name startswith /tmp and
 7    not proc.name in (trusted_tmp_writers)
 8  output: >
 9    File write to /tmp (user=%user.name file=%fd.name 
10    container_id=%container.id process=%proc.name)
11  priority: INFO
12
13- rule: Sensitive File Access
14  desc: Monitor access to sensitive files
15  condition: >
16    open and container and
17    (fd.name in (/etc/passwd, /etc/shadow, /etc/sudoers, 
18                /root/.ssh/authorized_keys, /home/*/.ssh/id_rsa))
19  output: >
20    Sensitive file accessed (user=%user.name file=%fd.name 
21    container_id=%container.id process=%proc.name)
22  priority: WARNING

 1# Проверка статуса Falco
 2sudo systemctl status falco
 3
 4# Просмотр логов
 5sudo journalctl -u falco -f
 6
 7# Тестирование правил
 8sudo falco --dry-run
 9
10# Проверка загруженных правил
11sudo falco --list
12
13# Валидация конфигурации
14sudo falco --validate /etc/falco/falco.yaml