Falco

EKS_CLUSTER_NAME="skills-eks-cluster" EKS_NODE_GROUP_NAME="skills-app-nodegroup" EKS_NODE_ROLE_NAME=$(aws eks describe-nodegroup --cluster-name $EKS_CLUSTER_NAME --nodegroup-name $EKS_NODE_GROUP_NAME --query "nodegroup.nodeRole" --output text | cut -d'/' -f2-)

cat << EOF > iam_role_policy.json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*" ] } ] } EOF

aws iam create-policy --policy-name EKS-CloudWatchLogs --policy-document file://iam_role_policy.json

aws iam attach-role-policy --role-name $EKS_NODE_ROLE_NAME --policy-arn `aws iam list-policies | jq -r '.[][] | select(.PolicyName == "EKS-CloudWatchLogs") | .Arn'`

apiVersion: v1 kind: ConfigMap metadata: name: fluent-bit-config labels: app.kubernetes.io/name: fluentbit data: fluent-bit.conf: | [SERVICE] Parsers_File parsers.conf [INPUT] Name tail Tag falco.* Path /var/log/containers/falco*.log Parser falco DB /var/log/flb_falco.db Mem_Buf_Limit 5MB Skip_Long_Lines On Refresh_Interval 10 [OUTPUT] Name cloudwatch Match falco.** region ap-northeast-2 log_group_name falco log_stream_name alerts auto_create_group true parsers.conf: | [PARSER] Name falco Format json Time_Key time Time_Format %Y-%m-%dT%H:%M:%S.%L Time_Keep Off # Command | Decoder | Field | Optional Action # =============|==================|================= Decode_Field_As json log --- apiVersion: apps/v1 kind: DaemonSet metadata: name: fluentbit labels: app.kubernetes.io/name: fluentbit spec: selector: matchLabels: name: fluentbit template: metadata: labels: name: fluentbit spec: serviceAccountName: fluent-bit containers: - name: aws-for-fluent-bit image: amazon/aws-for-fluent-bit:latest volumeMounts: - name: varlog mountPath: /var/log - name: varlibdockercontainers mountPath: /var/lib/docker/containers readOnly: true - name: fluent-bit-config mountPath: /fluent-bit/etc/ - name: mnt mountPath: /mnt readOnly: true resources: limits: memory: 500Mi requests: cpu: 500m memory: 100Mi volumes: - name: varlog hostPath: path: /var/log - name: varlibdockercontainers hostPath: path: /var/lib/docker/containers - name: fluent-bit-config configMap: name: fluent-bit-config - name: mnt hostPath: path: /mnt --- apiVersion: v1 kind: ServiceAccount metadata: name: fluent-bit --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: pod-log-reader rules: - apiGroups: [""] resources: - namespaces - pods verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: pod-log-crb roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: pod-log-reader subjects: - kind: ServiceAccount name: fluent-bit namespace: default

kubectl apply -f fluent-bit-configuration.yaml

cat << EOF > values.yaml tty: true falcosidekick: enabled: true webui: enabled: true user: "admin:admin" service: type: LoadBalancer redis: storageEnabled: false # config: # aws: # cloudwatchlogs: # loggroup: "falco-log" # logstream: "detect-events" # minimumpriority: "" EOF

helm repo add falcosecurity https://falcosecurity.github.io/charts helm repo update helm upgrade --install falco --namespace falco --create-namespace -f values.yaml falcosecurity/falco

kubectl get svc -n falco

kubectl get pods -n falco

kubectl logs -n falco -l app.kubernetes.io/instance=falco -c falco

kubectl logs -n falco -l app.kubernetes.io/instance=falco -c falco -f

kubectl run falco-demo -n falco --rm -ti --image busybox /bin/sh

touch /etc/2

customRules: disable-contacts-k8s.yaml: |- - rule: Contact K8S API Server From Container override: enabled: replace enabled: false

helm upgrade falco falcosecurity/falco -n falco --reuse-values -f update-default-rule.yaml

customRules: allow-terminal-shell.yaml: |- - macro: user_expected_terminal_shell_in_container_conditions condition: (k8s.ns.name in (default, kube-system))

customRules: detect-nc-port-scan.yaml: |- - rule: Netcat port scan attempt desc: Detect use of netcat for port scanning inside a Kubernetes container condition: > spawned_process and container and proc.name = nc and proc_name_exists output: > ALERT: Netcat port scan detected (command=%proc.cmdline user=%user.name pod=%k8s.pod.name ns=%k8s.ns.name image=%container.image.repository) priority: WARNING tags: [custom, container, network-scan, netcat, k8s] enabled: true

helm upgrade falco falcosecurity/falco -n falco --reuse-values -f custom-rule1.yaml

customRules: detect-chmod-all-open.yaml: |- - rule: chmod 777 detect desc: Detect file permission all open condition: > spawned_process and container and proc.name = chmod and (proc.args contains "777") and proc_name_exists output: > ALERT: chmod 777 detected (command=%proc.cmdline user=%user.name pod=%k8s.pod.name ns=%k8s.ns.name image=%container.image.repository) priority: WARNING tags: [custom, container, chmod, all-open, k8s] enabled: true

helm upgrade falco falcosecurity/falco -n falco --reuse-values -f custom-rule2.yaml

customRules: detect-outside-domain-call.yaml: |- - rule: Curl to external domain desc: Detect use of curl to call external public domains or IPs from a container condition: > spawned_process and container and proc.name = curl and not proc.args contains ".svc" and not proc.args contains "cluster.local" and not proc.args contains "10." and not proc.args contains "192.168." and not proc.args contains "127." and not proc.args contains "localhost" and proc_name_exists output: > ALERT: External curl request detected (cmd=%proc.cmdline user=%user.name pod=%k8s.pod.name ns=%k8s.ns.name image=%container.image.repository) priority: WARNING tags: [curl, egress, public-access, container] enabled: true

helm upgrade falco falcosecurity/falco -n falco --reuse-values -f custom-rule3.yaml

kubectl run -it --rm test-pod --image=curlimages/curl -- sh curl http://example.com

customRules: write_binary_dir.yaml: |- - macro: open_write condition: > (evt.type=open or evt.type=openat) and fd.typechar='f' and (evt.arg.flags contains O_WRONLY or evt.arg.flags contains O_RDWR or evt.arg.flags contains O_CREAT or evt.arg.flags contains O_TRUNC) - macro: package_mgmt_binaries condition: proc.name in (dpkg, dpkg-preconfigu, rpm, rpmkey, yum) - macro: bin_dir condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin) - rule: write_binary_dir desc: an attempt to write to any file below a set of binary directories condition: evt.dir = < and open_write and not proc.name in (package_mgmt_binaries) and bin_dir output: "File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)" priority: WARNING

helm upgrade falco falcosecurity/falco -n falco --reuse-values -f custom-rule4.yaml

kubectl run -it --rm test-write -n default --image=ubuntu -- bash apt update && apt install -y bash echo "test" > /usr/bin/testfile