Practical Cloud Native Security with Falco

Chapter 1. Introducing Falco

The goal of this first chapter of the book is to explain what Falco is. Don’t worry, we’ll take it easy! We will first look at what Falco does, including a high-level view of its functionality and an introductory description of each of its components. We’ll explore the design principles that inspired Falco and still guide its development today. We’ll then discuss what you can do with Falco, what is outside its domain, and what you can better accomplish with other tools. Finally, we’ll provide some historical context to put things into perspective.

Falco in a Nutshell

At the highest level, Falco is pretty straightforward: you deploy it by installing multiple sensors across a distributed infrastructure. Each sensor collects data (from the local machine or by talking to some API), runs a set of rules against it, and notifies you if something bad happens. Figure 1-1 shows a simplified diagram of how it works.

Figure 1-1. Falco’s high-level architecture

You can think of Falco like a network of security cameras for your infrastructure: you place the sensors in key locations, they observe what’s going on, and they ping you if they detect harmful behavior. With Falco, bad behavior is defined by a set of rules that the community created and maintains for you and that you can customize or extend for your needs. The alerts generated by your fleet of Falco sensors ...