Loading…
Attending this event?
Seattle, WA
December 10–13, 2018
Click Here for More Information & Registration
View Venue Map
View analytic
Thursday, December 13 • 3:40pm - 4:15pm
Deep Dive: Falco - Mark Stemm, Sysdig

Sign up or log in to save this to your schedule and see who's attending!

Log in to leave feedback.
In any Cloud Native architecture, there’s a seemingly endless stream of events that happen at each layer. These events can be used to detect abnormal activity and possible security incidents, as well as providing an audit trail of activity. In this talk, we’ll cover how we extended Falco to ingest events beyond just host system calls, such as Kubernetes audit events or even application level events. We will also show how to create Falco rules to detect behaviors in these new event streams. We show how we implemented Kubernetes audit events in Falco, and how to configure the event stream. Finally, we will cover how to create additional event streams leveraging the generic implementation Falco provides. Attendees will gain a deep understanding of Falco’s architecture, and how it custom Falco for additional events sources. 

Speakers
avatar for Mark Stemm

Mark Stemm

Senior Security Engineer, Sysdig
Mark is a Software Engineer with 20 years experience using data and analysis to solve hard problems and build great products.He has a B.S. in Mathematics/Computer Science from Carnegie Mellon University and a M.S. and Ph.D. in Computer Science from the University of California, Berkeley.He's... Read More →



Thursday December 13, 2018 3:40pm - 4:15pm
Tahoma 5 @ TCC The Conference Center (TCC) - Separate from WSCC building