February 2024
Intermediate to advanced
224 pages
9h 59m
Chinese
Content preview from Falco 云原生安全：Falco 原理、实践与扩展
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
152
｜
第
10
章
Falco
将加载哪些规则文件（下一节将详细介绍这些文件）。
插件
你可以启用插件，并通过
load_plugins
和
plugins
配置节点传递设置（请
参阅
10.6
节 ）。
输出通道
各种配置节点允许你配置格式化、日志记录和输出通道选项。有关输出框架
的更多信息，请参阅第
8
章。
嵌入式服务器
Falco
提供了一个嵌入式
Web
服务器，可以暴露一个健康的访问端点
注
3
。容
器编排工具和其他应用程序可以使用这个端点来检查
Falco
是否启动并运
行。通过
webserver
配置节点，你可以启用和配置服务器。
1
Falco
还提供了一个
gRPC
服务器，你可以使用
gRPC
配置节点来启用和配
置它（参见第
8
章和第
12
章 ）。
高级微调设置（仅限系统调用）
系统调用检测可能是
Falco
支持的最复杂的功能，因此配置文件为它提供了
高级设置。这些设置在不同版本的
Falco
中有所不同，所以我们建议你参考
在线文档和配置文件中的内联注释。
此处值得注意的选项包括：
syscall_event_drops
，用于控制被丢弃事件的
检测；
syscall_event_timeout
，用于检测事件的缺失（对于系统调用来说，
这是一种不常见的情况）；
metadata_download
，提供了几个选项来微调从
容器编排工具
API
服务器下载的信息。
10.5
规则集
Falco
提供了一组你可以立即使用的预定义规则。然而，你有充分的理由尽可能
地自定义规则集。默认规则集的设计是为了涵盖主要的攻击类型，但这些规则
注 3 ：Falco 的开发人员最初引入
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.