Falco runtime security, and a fix merged into CNCF Falco

Real-time threat detection in the clusters, tuned against false positives and validated by attack tests, plus a resilience fix shipped upstream.

Context

Admission policies say what may be deployed. A SIEM says what was logged. Neither tells you what a container is doing right now. That is the job of runtime detection.

What I built

Architecture study and driver choice (eBPF), with the alerting pipeline designed end to end.
Kubernetes audit logs from the managed clusters analysed by Falco through the provider’s log platform, on every environment.
Custom rules in their own repository: shell in a container, reverse shell, access to /etc/shadow, privileged containers, access to Kubernetes secrets.
Noise reduction: legitimate processes allow-listed, CI/CD namespaces excluded, rules tuned until alerts were worth reading.
Validation by attack tests (reverse shell, secret access), with a written report.
FalcoSidekick routing alerts to Wazuh, Prometheus and Slack. Falco metrics in Prometheus, and internal documentation.

Open-source contribution

I fixed reliability issues in the OVH audit-log plugin (k8saudit-ovh) upstream: a WebSocket reconnection loop, a retry when a connection attempt fails, and proper JSON error handling. The patch (#1270) was reviewed by the Falco maintainers, merged, and shipped in v0.4.1.

Outcome

Suspicious behaviour in the clusters is detected in real time and lands in the same pipeline as every other security signal. The plugin now survives network hiccups for everyone who uses it.