May 2018 Summaries

Sysdig Secure and Sysdig Falco users often seek ways to audit container activity, such as detecting the execution of web fetch programs like curl and wget for compliance and security purposes. The text provides a detailed example of how to use Falco, an open-source runtime security tool, to create rules for detecting such activities. This involves defining lists and macros to identify web fetch programs, capturing their execution, and setting exclusions to focus on container environments. Users are guided to integrate and implement these rules within Sysdig Secure, allowing for actions like killing or pausing containers, and recording system activities for analysis. The example concludes with instructions on creating a Sysdig Secure policy to apply these rules to specific infrastructure areas, enhancing security and compliance monitoring. The article encourages community engagement by sharing rules and seeking assistance via Slack.

Eric Carter discusses the integration of Slack with Sysdig Monitor and Sysdig Secure, allowing users to efficiently monitor containers and apps without leaving Slack. By setting up the integration through the settings menu, users can authenticate their Slack domain and choose a channel for receiving alerts. These alerts, which are well-formatted and include links back to Sysdig Monitor or Sysdig Secure, enable users to quickly address issues or events that trigger them. This integration aims to simplify and expedite container monitoring, security, and troubleshooting processes. Users are encouraged to test the integration and provide feedback, and non-users can request a free trial to explore the functionality. Additionally, Sysdig invites users to join their public Slack channel to discuss their open-source technology.

The blog post discusses an integrated approach to enhancing Kubernetes security by using Sysdig Falco, NATS, and Kubeless, leveraging their composable nature to create a real-time detection and response system. It highlights the challenges of detecting and mitigating security breaches in cloud native environments, where containers are ephemeral and attacks increasingly focus on abusive behaviors like unauthorized cryptocurrency mining. The proposed solution involves using Falco to detect abnormal behaviors and send alerts via NATS, which then trigger serverless functions in Kubeless to take corrective actions, such as deleting compromised Kubernetes pods. A practical example is provided, demonstrating how these tools can be orchestrated to respond to critical priority events using Python scripts and Kubernetes operators, ensuring that security measures can be dynamically applied and maintained within a cloud-native architecture. This approach underscores the importance of active security measures capable of responding to the dynamic nature of modern infrastructure.