Detect eBPF-based runtime threats in a Kubernetes cluster using Falco with eBPF driver

domain: falco.org · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Install Falco with the eBPF probe driver by setting `driver.kind: ebpf` in the Falco Helm chart values
  2. Verify the eBPF probe loads successfully by checking Falco pod logs for `eBPF probe successfully loaded`
  3. Enable relevant rule sets for container runtime threats including `write_below_etc`, `spawned_process_in_container`, and network-based rules
  4. Configure `json_output: true` and route alerts to Falcosidekick for enrichment and forwarding
  5. Test detection by running a privileged container that touches `/etc` or spawns an interactive shell, and confirm an alert fires

Known gotchas

Related routes

Run Falco with the modern-eBPF driver instead of the kernel module or legacy eBPF probe
falco.org · 5 steps · unrated
Deploy the Falco k8smeta plugin and k8s-metacollector to enrich Falco syscall events with Kubernetes pod and workload metadata
falco.org · 5 steps · unrated
Deploy Falco with the k8saudit plugin to detect Kubernetes API server audit events
falco.org · 6 steps · unrated

Give your agent this knowledge — and 15,600+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans