Falco custom rules in action - Kubernetes Tutorial

Contents

• Introduction Introduction

  • Kubernetes threat and attack detection: Introduction

    1m 15s
• 1. Ensure Immutability of Containers at Runtime 1. Ensure Immutability of Containers at Runtime

  • (Locked)
    Learning objectives

    40s
  • (Locked)
    Understanding immutability

    6m 2s
  • (Locked)
    Read only filesystem

    5m 34s
  • (Locked)
    Policy enforcement with VAP

    8m 36s
• 2. Use Kubernetes Audit Logs to Monitor Access 2. Use Kubernetes Audit Logs to Monitor Access

  • (Locked)
    Learning objectives

    35s
  • (Locked)
    Auditing in Kubernetes

    7m 44s
  • (Locked)
    Define an audit policy

    12m 56s
  • (Locked)
    Event batching and tuning

    3m 3s
  • (Locked)
    Configure backend log storage

    7m 14s
• 3. Detect Malicious Activity, Threats, and Attacks 3. Detect Malicious Activity, Threats, and Attacks

  • (Locked)
    Learning objectives

    43s
  • (Locked)
    Understanding syscall behavioral analysis

    12m 28s
  • (Locked)
    Using Falco for threat detection

    7m 14s
  • (Locked)
    Falco host installation

    14m
  • (Locked)
    Falco Kubernetes installation

    13m 51s
  • (Locked)
    Falco configuration and rules

    7m 42s
  • (Locked)
    Falco custom rules in action

    19m 17s
• 4. Investigate and Identify Signs of Compromise 4. Investigate and Identify Signs of Compromise

  • (Locked)
    Learning objectives

    40s
  • (Locked)
    MITRE ATT&CK® framework

    11m 39s
  • (Locked)
    Security event log review

    4m 28s
  • (Locked)
    Gathering evidence of compromise

    11m 23s
  • (Locked)
    Practicing Kubernetes security

    8m 9s
• Summary Summary

  • (Locked)
    Kubernetes threat and attack detection: Summary

    1m 14s