falco-installation.md

Falco Documentation

• Falco docs
• Falco supported field

Steps for installing Falco

curl -s https://falco.org/repo/falcosecurity-3672BA8F.asc | apt-key add -
echo "deb https://dl.bintray.com/falcosecurity/deb stable main" | tee -a /etc/apt/sources.list.d/falcosecurity.list
apt-get -y install linux-headers-$(uname -r)
apt-get update && apt-get install -y falco

Start falco

falco

Test simple falco rule

kubectl run nginx-pod --image=nginx
kubectl exec -it nginx-pod -- bash

mkdir /bin/tmp-1
cat /etc/shadow