Kubernetes Security - Detect syscall, file malicious activities using Falco & Slack Alerts - 22

Поділитися
Вставка
  • Опубліковано 26 лис 2024

КОМЕНТАРІ • 24

  • @aireddy
    @aireddy 2 роки тому +1

    It is very important to understand behavioral analytics. Your explanation is very detailed enough to understand Falco rules and how to implement. Thank you Ramana!!

  • @illthizamnazar626
    @illthizamnazar626 Рік тому

    i see here the first time one youtube explained all in one. bravo superb .

  • @SaravanaKumar-km2lb
    @SaravanaKumar-km2lb 2 роки тому

    It’s very useful and ur content of explanation is very awesome and get cleared thanks for ur cks

  • @humayunsabid3188
    @humayunsabid3188 Рік тому

    thank you, sir, for making the nice video regarding Falco, it was really helpful, I would like to ask you a question about the Falco rule of "Analyse the container behavior for at least 20 seconds, using filters that detect newly spawning and executing processes in a single container of Nginx", could you please help me with it?

  • @kumar.jayanti9700
    @kumar.jayanti9700 Рік тому

    Sir, excellent video and great demo. My question what is your K8;s cluster setup like ?. Is it minikube running on your Apple laptop or is it an AWS EKS cluster with a Master and Node. If i want to setup on my Apple Laptop with minikube just for demo will it work.

    • @learnwithgvr
      @learnwithgvr  Рік тому +1

      Yes you can use minikube single node Kubernetes cluster for practice. Otherwise other approach is 2 or more node k8s cluster using vargrant. Github Link is in the description. For CKS practice need to modify control plane hence vagrant cluster is best

    • @kumar.jayanti9700
      @kumar.jayanti9700 Рік тому

      ​@@learnwithgvr do you have the instructions for creating a 2 node cluster with vagrant ?

    • @learnwithgvr
      @learnwithgvr  Рік тому

      @@kumar.jayanti9700 github.com/ramanagali/k8s-cluster
      Use this to create your own cluster

  • @AmirRezaNazarizadeh
    @AmirRezaNazarizadeh Рік тому

    Thanks for great video. Is there any way to log kubernetes user who exec to a pod an executed soma commands?

    • @learnwithgvr
      @learnwithgvr  Рік тому

      Not that I know of. For such requirements falco kind of malicious activity monitoring tools will. Example If only exec, we make use of falco rule by tweaking some indicator from shell. Another way is if you know golang build custom plugin which will help to do require operation/event

  • @sunnyraj7749
    @sunnyraj7749 10 місяців тому

    SIR , in cks exam how do we know which rule to copy from /etc/Falco/falco_rules.yaml to /etc/Falco/falco_rules.local.yaml .. will they give which rule to copy in the question or how does that work sir... Please just tell me if they will give it in question or how it works .. please do reply it sir ... I will be waiting

    • @learnwithgvr
      @learnwithgvr  10 місяців тому

      In the question they will give you title...we need to search similar one in falco.yaml also keep in mind its INFO, Warning or ERROR etc...based on that you need copy existing

  • @varunr3049
    @varunr3049 2 роки тому

    sir,how hot get output to file for falco as daemonset,i configured falco.yaml file-out put =true but not getting,should i create file in path or automatically created when configure file_output=true
    please respond

    • @learnwithgvr
      @learnwithgvr  2 роки тому +1

      If you are using falco as daemonset(using helm), your falco configuration is in configmap. Check configmap and modify/override accordingly. Remember falco.yaml is applicable when you use linux service based approach. Check my video again and/or read documentation

    • @varunr3049
      @varunr3049 2 роки тому

      @@learnwithgvr thank you sir

  • @LaVidaEnUnaGota
    @LaVidaEnUnaGota 2 роки тому

    which zsh theme are you using?

    • @learnwithgvr
      @learnwithgvr  2 роки тому

      i am using powerlevel10k & kubecolor

  • @aashie_p
    @aashie_p 2 роки тому

    How to download and set up slack and containers to monitor using Falco in Kali Linux software.

    • @learnwithgvr
      @learnwithgvr  2 роки тому

      Refer its official documentation, falco.org/docs/getting-started/installation/ , if not install using daemonset

    • @aashie_p
      @aashie_p 2 роки тому

      @@learnwithgvr okay, thank you. Do I set up and connect the master node and slave node in Kubernetes and then start working with Falco installation and next steps?

    • @learnwithgvr
      @learnwithgvr  2 роки тому

      Yes correct, once your cluster is ready, follow the documentation steps. Refer my video steps