Practical Cloud Native Security with Falco

Chapter 4. Data Sources

In this chapter we’ll take a deep dive into the kernel of the operating system and Falco’s data collection stack. You’ll learn how Falco captures the different types of events that feed its rule engine, how its data collection process compares to alternative approaches, and why it was built the way it is. You’ll get to understand the details well enough that you will be able to pick and deploy the right drivers and plugins for your needs by the end of this chapter.

The first order of business is understanding what data sources you can use in Falco. Falco’s data sources can be grouped into two main families: system calls and plugins. System calls are Falco’s original data source. They come from the kernel of the operating system and offer visibility into the activities of processes, containers, virtual machines, and hosts. Falco uses them to protect workloads and applications. The second family of data sources, plugins, is relatively new: support was added in 2022. Plugins connect various types of inputs to Falco, such as cloud logs and APIs.

Falco previously supported Kubernetes audit logs as a third, separate source type; starting from Falco 0.32, however, this data source has been reimplemented as a plugin, so we won’t cover it in this chapter.

System Calls

As we’ve stated several times already, system calls are a key source of data for Falco and one of the ingredients that make it unique. But what exactly is a system call? Let’s start with a high-level ...