Degioanni Loris, Grasso Leonardo. Practical Cloud Native Security with Falco: Risk and Threat Detection for Containers, Kubernetes, and Cloud

O’Reilly Media, 2022. — 227 p. — ISBN: 978-1-098-11857-0.As more and more organizations migrate their applications to the cloud, cloud-native computing has become the dominant way to approach software development and execution. In the meantime, security threats are growing more sophisticated and widespread every day. Protecting your applications from these threats requires the ability to defend them at runtime when they're most vulnerable to attacks. This practical guide introduces you to Falco, the open-source standard for continuous risk and threat detection across Kubernetes, containers, and the cloud. Falco creator Loris Degioanni and core maintainer Leonardo Grasso bring you up to speed on cloud-native threat detection basics and show you how to get Falco up and running. You'll then dive into advanced topics such as deploying Falco in production and writing your security rules. You'll learn how to: Leverage runtime security in cloud-native environments Detect configuration changes and unexpected behavior in the cloud Protect containers, Kubernetes, and cloud applications using Falco Run, deploy, and customize Falco using advanced concepts Deploy, configure, and maintain Falco in a production environment Improve your organization's ability to pass compliance audits Implement threat detection for containers, Kubernetes, and cloud apps.The Basics
Introducing Falco.
Getting Started with Falco on Your Local Machine.
The Architecture of Falco
Understanding Falco’s Architecture.
Data Sources.
Data Enrichment.
Fields and Filters.
Falco Rules.
The Output Framework.
Running Falco in Production
Configuring and Running Falco.
Using Falco for Cloud Security.
Consuming Falco Events.
Extending Falco
Writing Falco Rules.
Falco Development.
How to Contribute.