Detecting container host anomalies with GitLab and Falco
Jan 20, 2022Fernando Diaz
Summary
This post details the integration of Falco for container host security within GitLab. It outlines the steps to deploy Falco using GitLab-Managed Apps and CI/CD pipelines, including the necessary Helmfile and CI configuration. The post also explains how to define custom Falco rules for detecting specific system behaviors (e.g., file integrity checks) and how to configure alerts for rule violations, providing insights into runtime threats in Kubernetes environments.
More from the Log Management and Observability trail
- Green DevOps: Why carbon measurement belongs in your CI/CD pipeline
- Automate detection testing with GitLab CI/CD and Duo
- How to build CI/CD observability at scale
- Track vulnerability remediation with the updated GitLab Security Dashboard
- More granular product usage insights for GitLab Self-Managed and Dedicated