June 2018 Summaries

Prometheus, an open-source cloud-native monitoring tool, is essential for organizations transitioning to Kubernetes, offering a phased approach to observability and monitoring strategy. The adoption process typically involves three phases: experimentation, where developers freely explore the tool's capabilities without budget constraints; instrumentation, where broader deployment involves integrating exporters and custom metrics in the Prometheus format for deeper application observation; and operationalization, which requires addressing scaling, data management, security, and compliance challenges to ensure a production-ready monitoring strategy. As organizations grow, they face critical decisions about whether to build and maintain their monitoring infrastructure in-house or invest in commercial solutions to manage resources efficiently and simplify future operations.

Keegan Riley, the new Senior Vice President of Worldwide Sales at Sysdig, shares his enthusiasm for joining the company, highlighting his previous experience at Nimble Storage and HPE, which provided valuable insights and leadership opportunities. Riley was drawn to Sysdig due to its strong company culture and innovative environment, influenced by his past mentor, former Nimble CEO Suresh Vasudevan. He emphasizes the importance of cultural alignment and the appeal of working with a team of humble and talented individuals driving innovation in cloud-native technologies. The shift from proprietary systems to open, distributed platforms presents a significant market opportunity, and Sysdig's Cloud Native Intelligence Platform addresses the challenges enterprises face when transitioning to multi-cloud environments by providing in-depth monitoring and security insights into containerized applications. Riley is eager to contribute to Sysdig's growth and excited about the future potential of the company's solutions.

Sysdig's Monitor summer 2018 release highlights the introduction of Falco Feeds, a feature designed to enhance the capabilities of Falco by providing open-source companies with continuously updated, expert-written rules to address emerging threats. This release aims to improve cloud security by offering users access to advanced tools and resources, ensuring that they can effectively manage and defend against potential vulnerabilities.

Sysdig has announced the integration of its open-source project, Sysdig Falco, with Google Cloud Security Command Center (SCC) to enhance Kubernetes and container runtime security. This integration allows Sysdig Falco to send Kubernetes security events to Google Cloud SCC, providing a centralized view of security events within Google Cloud infrastructure. The deployment involves using the Sysdig Google Cloud SCC connector and configuring Falco to forward alerts to this connector, enabling real-time security event monitoring. The integration is particularly beneficial for those building their infrastructure and who may not require the full suite of enterprise features offered by Sysdig Secure. Once configured, the system provides detailed information about security events, including asset ID, event timing, Kubernetes pod name, container ID, and the specific security rule triggered, thus enhancing the visibility and management of security threats in cloud environments.

IBM and Sysdig have announced a collaboration to integrate the Sysdig Cloud-Native Intelligence Platform into IBM Cloud, enhancing monitoring, security, and operational capabilities for cloud-native applications. This partnership aims to simplify the complex environment of cloud architectures, particularly in cross-cloud infrastructures, by leveraging Sysdig's expertise in app security and real-time protection. IBM is expanding its cloud offerings with the IBM Cloud Kubernetes Service, which supports containerized applications through multi-zone clusters across global regions, thereby ensuring consistent performance and scalability. The collaboration is developer-driven, focusing on providing tools to improve orchestration, management, and visibility in IBM Cloud, with future plans to deepen integration and expand capabilities, including services like Istio.

Falco is an open-source tool designed for real-time intrusion and anomaly detection in cloud-native platforms like Kubernetes and Docker, allowing users to create security policies to detect attacks and unauthorized activities. It offers a customizable ruleset syntax based on the Sysdig filtering language, which is simple to learn and similar to tcpdump syntax. Users can create specific security profiles for container images, defining which processes, connections, and system calls are permissible, thereby establishing a tightly controlled execution environment. Falco's default ruleset can be tailored to meet specific needs, with metadata from Kubernetes enhancing rule accuracy. Additionally, the tool integrates with Sysdig Inspect for detailed activity analysis and troubleshooting, and it encourages community contributions to its security library through a GitHub repository, fostering a collaborative approach to container security.