github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-17 23:37:51 +00:00
Code Issues Projects Releases Wiki Activity

Updated K8s Audit Event Support (markdown)

Mark Stemm
2019-02-14 11:55:03 -08:00
parent d4a2201c60
commit a9a6e8384a
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
K8s-Audit-Event-Support.md

@@ -6,6 +6,12 @@ As of Falco 0.13.0, falco supports a second source of events in addition to syst
* Creating/updating/removing config maps or secrets
* Attempts to subscribe to changes to any endpoint
We also added additional falco rules that look for notable or suspicious activity, including:
* Creating pods that are privileged, mount sensitive host paths, or use host networking.
* Granting overly broad permissions such as `cluster-admin` to users.
* Creating configmaps with sensitive information.
Once you've configured your cluster with audit logging and selected which events you'd like to pass along to falco, you can write falco rules that read these events and send notifications for suspicious or other notable activity.
# Falco Changes