Falco: Must-know for the CKS Exam
What you need to know about Falco, the runtime security tool, for the CKS exam.
This is a short summary. Read the full article on Substack →
Falco is the open-source runtime security tool you’ll meet in the CKS exam. I cover how its rules work, how to detect suspicious container behaviour, and the kind of exam scenarios that ask you to customise Falco and analyse its logs.
Key takeaways
- Falco rules need a condition, an output and a priority; the default rules live in /etc/falco/falco_rules.yaml.
- Expect to run Falco on worker nodes and use crictl to track down the offending container.
- Falco’s documentation on macros and supported event fields is available during the exam.
- It falls under the Monitoring, Logging and Runtime Security domain, about 20% of the CKS.