February 2024
Intermediate to advanced
224 pages
9h 59m
Chinese
Content preview from Falco 云原生安全：Falco 原理、实践与扩展
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Falco
事件
｜
175
储和分析大量日志数据的系统，如
Elasticsearch
和
Splunk
。因为你可能会在后
面的分析中使用这种方法，所以我们建议保留
Falco
发出的所有事件，不进行额
外的过滤。
你可能还需要收集指标，因为这可以帮助你检测应用程序中的错误和异常。例
如，一个指标报告说某台机器上经常触发
Falco
规则，这可能是运行中的应用程
序存在安全问题、配置错误或部署缺陷。
falco-exporter
是一个可靠的工具，它
可以暴露指标并将
Falco
连接到
Prometheus
，还提供了现成的
Grafana
仪表板
（如图
12-3
所 示 ）。
图 12-3：预置 Grafana 仪表板
—
由 falco-exporter 提供的 Falco 事件指标
12.3
获取通知
虽然存储和聚合
Falco
事件对于可观测性来说很好，但当你需要及时对安全事件
做出响应时，它就没有那么有帮助了。你可能希望立即在正确的位置收到重要
通知，以便你或者你的团队可以采取对策或立即展开调查。
Falco
内置的输出通道没有提供即时通知的特定机制，但
Falcosidekick
允许你
只转发重要的通知。例如，假设你希望在某个事件触发
Sudo Potential Privilege
Escalation
规则（设有
priority: CRITICAL
）时获得通知，但你并不需要其他
具有较低优先级的噪声规则。
Falcosidekick
允许你配置发送事件到特定目标的
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.