mcpField
P
performing-cloud-native-forensics-with-falco

performing-cloud-native-forensics-with-falco

github.com/mukul975Security35.2k51 installsUpdated 8w ago
Repository

About performing-cloud-native-forensics-with-falco

A skill guide for security and incident response practitioners using Falco for cloud-native forensics in containerized environments. It covers runtime detection rule management and parsing Falco alerts.

Key features

  1. 01Deploy and manage Falco rules
  2. 02Detect shells spawned in containers
  3. 03Monitor sensitive file access
  4. 04Spot unexpected outbound connections
  5. 05Detect privilege escalation and container escapes

Use cases

  1. 01Investigate container security alerts
  2. 02Identify suspicious processes in containers
  3. 03Review sensitive file access
  4. 04Examine unexpected network connections

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill performing-cloud-native-forensics-with-falco

After installing, type/performing-cloud-native-forensics-with-falcoin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Performing Cloud Native Forensics with Falco

When to Use

  • When conducting security assessments that involve performing cloud native forensics with falco
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Familiarity with cloud security concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

Deploy and manage Falco rules for runtime security detection in containerized environments. Parse Falco alerts for incident response.

# Custom Falco rule for detecting shell in container
- rule: Shell Spawned in Container
  desc: Detect shell process started in a container
  condition: >
    spawned_process and container
    and proc.name in (bash, sh, zsh, dash, csh)
    and not proc.pname in (docker-entrypo, supervisord)
  output: >
    Shell spawned in container
    (user=%user.name command=%proc.cmdline container=%container.name
     image=%container.image.repository)
  priority: WARNING
  tags: [container, shell, mitre_execution]

Key detection rules:

  1. Shell spawn in non-interactive containers
  2. Sensitive file access (/etc/shadow, /etc/passwd)
  3. Outbound connections from unexpected containers
  4. Privilege escalation via setuid/setgid
  5. Container escape via mount or ptrace

Examples

# Run Falco with custom rules
falco -r /etc/falco/custom_rules.yaml -o json_output=true
# Parse JSON alerts
cat /var/log/falco/alerts.json | python3 -c "import json,sys; [print(json.loads(l)['output']) for l in sys.stdin]"

Comments

Markdown supported