1"use strict";(self.webpackChunkmy_website=self.webpackChunkmy_website||[]).push([[14679],{3905:(e,t,n)=>{n.d(t,{Zo:()=>p,kt:()=>f});var o=n(67294);function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,o)}return n}function a(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){r(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function l(e,t){if(null==e)return{};var n,o,r=function(e,t){if(null==e)return{};var n,o,r={},i=Object.keys(e);for(o=0;o<i.length;o++)n=i[o],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(o=0;o<i.length;o++)n=i[o],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var s=o.createContext({}),c=function(e){var t=o.useContext(s),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},p=function(e){var t=c(e.components);return o.createElement(s.Provider,{value:t},e.children)},u="mdxType",d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.createElement(o.Fragment,{},t)}},h=o.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,s=e.parentName,p=l(e,["components","mdxType","originalType","parentName"]),u=c(n),h=r,f=u["".concat(s,".").concat(h)]||u[h]||d[h]||i;return n?o.createElement(f,a(a({ref:t},p),{},{components:n})):o.createElement(f,a({ref:t},p))}));function f(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var l={};for(var s in t)hasOwnProperty.call(t,s)&&(l[s]=t[s]);l.originalType=e,l[u]="string"==typeof e?e:r,a[1]=l;for(var c=2;c<i;c++)a[c]=n[c];return o.createElement.apply(null,a)}return o.createElement.apply(null,n)}h.displayName="MDXCreateElement"},42722:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>s,contentTitle:()=>a,default:()=>d,frontMatter:()=>i,metadata:()=>l,toc:()=>c});var o=n(87462),r=(n(67294),n(3905));const i={id:"Falco",title:"Falco",overview:"Falco is a CNCF-approved container security and Kubernetes threat detection engine that logs illegal container activity at runtime. Shipping your Falco logs to your Cloud SIEM can help you monitor your Kubernetes workloads for potentially malicious behavior. This can help you catch attempts to remove logging data from a container, to run recon tools inside a container, or add potentially malicious repositories to a container.",product:["logs","siem"],os:["windows","linux"],filters:["Security"],logo:"https://logzbucket.s3.eu-west-1.amazonaws.com/logz-docs/shipper-logos/falco-logo.png",logs_dashboards:[],logs_alerts:[],logs2metrics:[],metrics_dashboards:[],metrics_alerts:[],drop_filter:[]},a=void 0,l={unversionedId:"shipping/Security/Falco",id:"shipping/Security/Falco",title:"Falco",description:"Falco is a CNCF-approved container security and Kubernetes threat detection engine that logs illegal container activity at runtime.",source:"@site/docs/shipping/Security/falco.md",sourceDirName:"shipping/Security",slug:"/shipping/Security/Falco",permalink:"/docs/shipping/Security/Falco",draft:!1,editUrl:"https://github.com/logzio/documentation/tree/master/docs/shipping/Security/falco.md",tags:[],version:"current",frontMatter:{id:"Falco",title:"Falco",overview:"Falco is a CNCF-approved container security and Kubernetes threat detection engine that logs illegal container activity at runtime. Shipping your Falco logs to your Cloud SIEM can help you monitor your Kubernetes workloads for potentially malicious behavior. This can help you catch attempts to remove logging data from a container, to run recon tools inside a container, or add potentially malicious repositories to a container.",product:["logs","siem"],os:["windows","linux"],filters:["Security"],logo:"https://logzbucket.s3.eu-west-1.amazonaws.com/logz-docs/shipper-logos/falco-logo.png",logs_dashboards:[],logs_alerts:[],logs2metrics:[],metrics_dashboards:[],metrics_alerts:[],drop_filter:[]},sidebar:"tutorialSidebar",previous:{title:"Fail2Ban",permalink:"/docs/shipping/Security/Fail2Ban"},next:{title:"FortiGate",permalink:"/docs/shipping/Security/FortiGate"}},s={},c=[{value:"Configure Falco rules to enrich observability",id:"configure-falco-rules-to-enrich-observability",level:3},{value:"Rule: Netcat Remote Code Execution in Container",id:"rule-netcat-remote-code-execution-in-container",level:3},{value:"Rule: Delete or rename shell history",id:"rule-delete-or-rename-shell-history",level:3},{value:"Rule: Delete Bash History",id:"rule-delete-bash-history",level:3},{value:"Rule: Clear Log Activities",id:"rule-clear-log-activities",level:3},{value:"Configure Falco to output JSON logs",id:"configure-falco-to-output-json-logs",level:3},{value:"Download the Logz.io public certificate",id:"download-the-logzio-public-certificate",level:3},{value:"Configure Filebeat",id:"configure-filebeat",level:3},{value:"Start Filebeat",id:"start-filebeat",level:3},{value:"Check Logz.io for your logs",id:"check-logzio-for-your-logs",level:3}],p={toc:c},u="wrapper";
1function d(e){let{components:t,...n}=e;return(0,r.kt)(u,(0,o.Z)({},p,n,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,"Falco is a ",(0,r.kt)("a",{parentName:"p",href:"https://www.cncf.io/blog/2020/01/08/toc-votes-to-move-falco-into-cncf-incubator/"},"CNCF-approved")," container security and Kubernetes threat detection engine that logs illegal container activity at runtime."),(0,r.kt)("p",null,"Shipping your Falco logs to your Cloud SIEM can help you monitor your Kubernetes workloads for potentially malicious behavior. This can help you catch attempts to remove logging data from a container, to run recon tools inside a container, or add potentially malicious repositories to a container. ",(0,r.kt)("a",{parentName:"p",href:"https://logz.io/blog/k8s-security-with-falco-and-cloud-siem/"},"Learn more in our blog \ud83d\udd17")),(0,r.kt)("p",null,"Once your Falco logs are coming into your account, you can review the preconfigured ",(0,r.kt)("a",{parentName:"p",href:"https://app.logz.io/#/dashboard/security/rules/rule-definitions?from=0&sortBy=updatedAt&sortOrder=DESC&search=falco"},"Falco security rules")," and ",(0,r.kt)("a",{parentName:"p",href:"https://app.logz.io/#/dashboard/security/research/dashboards?"},"dashboards")," in your Cloud SIEM account."),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Before you begin, you'll need"),":"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Falco installed on the host"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html"},"Filebeat")),(0,r.kt)("li",{parentName:"ul"},"Root access")),(0,r.kt)("h3",{id:"configure-falco-rules-to-enrich-observability"},"Configure Falco rules to enrich observability"),(0,r.kt)("p",null,"Open Falco\u2019s configuration file with your preferred text editor. See Falco's ",(0,r.kt)("a",{parentName:"p",href:"https://falco.org/docs/"},"documentation"),"\nif you need help finding the file."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"$nano /etc/falco/falco_rules.yaml\n")),(0,r.kt)("p",null,"In the configuration file,\nfind the line that begins ",(0,r.kt)("inlineCode",{parentName:"p"},"- macro: network_tool_procs"),".\nCopy the following directly below it:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"- list: network_tool_binaries\n append: true\n items: [fierce, dnsenum, amass, dnsrecon, sublist3r, theharvester, recon-ng, netdiscover, amap, enum4linux, onesixtyone]\n")),(0,r.kt)("h3",{id:"rule-netcat-remote-code-execution-in-container"},"Rule: Netcat Remote Code Execution in Container"),(0,r.kt)("p",null,"In the configuration file, find the line that begins ",(0,r.kt)("inlineCode",{parentName:"p"},"- rule: Netcat Remote Code Execution in Container"),".\nReplace the entire content of the rule with the following:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'- rule: Netcat Remote Code Execution in Container\n desc: Netcat Program runs inside container that allows remote code execution\n condition: >\n spawned_process and container and\n ((proc.name = "nc" and (proc.args contains "-e" or proc.args contains "-c")) or\n (((proc.name = netcat) or ( proc.name = "ncat")) and (proc.args contains "--sh-exec" or proc.args contains "--exec" or proc.args contains "-e "\n or proc.args contains "-c " or proc.args contains "--lua-exec"))\n )\n output: >\n Netcat runs inside container that allows remote code execution (user=%user.name\n command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)\n priority: WARNING\n tags: [network, process, mitre_execution]\n')),(0,r.kt)("h3",{id:"rule-delete-or-rename-shell-history"},"Rule: Delete or rename shell history"),(0,r.kt)("p",null,"In the configuration file, find the line that begins ",(0,r.kt)("inlineCode",{parentName:"p"},"- rule: Delete or rename shell history"),".\nReplace the entire content of the rule with the following:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'- rule: Delete or rename shell history\n desc: Detect shell history deletion\n condition: >
1\n (modify and (\n evt.arg.name contains "bash_history" or\n evt.arg.name contains "zsh_history" or\n evt.arg.name contains "fish_read_history" or\n evt.arg.name endswith "fish_history" or\n evt.arg.oldpath contains "bash_history" or\n evt.arg.oldpath contains "zsh_history" or\n evt.arg.oldpath contains "fish_read_history" or\n evt.arg.oldpath endswith "fish_history" or\n evt.arg.path contains "bash_history" or\n evt.arg.path contains "zsh_history" or\n evt.arg.path contains "fish_read_history" or\n evt.arg.path endswith "fish_history")) or\n (open_write and (\n fd.name contains "bash_history" or\n fd.name contains "zsh_history" or\n fd.name contains "fish_read_history" or\n fd.name endswith "fish_history") and evt.arg.flags contains "O_TRUNC")\n output: >\n Shell history had been deleted or renamed (user=%user.name type=%evt.type command=%proc.cmdline fd.name=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath=%evt.arg.oldpath %container.info image=%container.image.repository)\n priority:\n WARNING\n tags: [process, mitre_defense_evation]\n')),(0,r.kt)("h3",{id:"rule-delete-bash-history"},"Rule: Delete Bash History"),(0,r.kt)("p",null,"In the configuration file, find the line that begins ",(0,r.kt)("inlineCode",{parentName:"p"},"- rule: Delete Bash History"),".\nReplace the entire content of the rule with the following:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'- rule: Delete Bash History\n desc: Detect bash history deletion\n condition: >\n ((spawned_process and proc.name in (shred, rm, mv) and proc.args contains "bas
1h_history") or\n (open_write and fd.name contains "bash_history" and evt.arg.flags contains "O_TRUNC"))\n output: >\n Shell history had been deleted or renamed (user=%user.name type=%evt.type command=%proc.cmdline fd.name=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath>\n priority:\n WARNING\n tags: [process, mitre_defense_evation]\n\n- macro: consider_all_chmods\n condition: (always_true)\n\n- list: user_known_chmod_applications\n items: [hyperkube, kubelet]\n')),(0,r.kt)("h3",{id:"rule-clear-log-activities"},"Rule: Clear Log Activities"),(0,r.kt)("p",null,"In the configuration file, find the line that begins ",(0,r.kt)("inlineCode",{parentName:"p"},"- rule: Clear Log Activities"),".\nReplace the entire content of the rule with the following:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'- rule: Clear Log Activities\n desc: Detect clearing of critical log files\n condition: >\n open_write and\n access_log_files and\n evt.arg.flags contains "O_TRUNC" and\n not trusted_logging_images and\n not allowed_clear_log_files\n output: >\n Log files were tampered (user=%user.name command=%proc.cmdline file=%fd.name container_id=%container.id image=%container.image.repository:%container.image.tag)\n priority:\n WARNING\n tags: [file, mitre_defense_evasion]\n')),(0,r.kt)("h3",{id:"configure-falco-to-output-json-logs"},"Configure Falco to output JSON logs"),(0,r.kt)("p",null,"Open Falco\u2019s configuration file with your preferred text editor. The default location is ",(0,r.kt)("inlineCode",{parentName:"p"},"/etc/falco/falco.yaml")," but it depends on your installation."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"$nano /etc/falco/falco.yaml\n")),(0,r.kt)("p",null,"In the configuration file, set the output format to JSON.\nFind the line ",(0,r.kt)("inlineCode",{parentName:"p"},"json_output: true"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'# Whether to output events in json or text\njson_output: true\n\n# When using json output, whether or not to include the "output" property\n# itself (e.g. "File below a known binary directory opened for writing\n# (user=root ....") in the json output.\njson_include_output_property: true\n')),(0,r.kt)("p",null,"Next, look up the filepath to Falco's logs."),(0,r.kt)("p",null,"In the same configuration file, find the line that begins ",(0,r.kt)("inlineCode",{parentName:"p"},"filename:"),". Its value points to Falco's event logs and will be needed in a future step to replace the placeholder ",(0,r.kt)("inlineCode",{parentName:"p"},"<<filepath-to-falco-events.txt>>"),".\nCopy the filepath and save it for the next step. You'll need it to configure Filebeat."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"file_output:\n enabled: true\n keep_alive: false\n filename: ./events.txt\n")),(0,r.kt)("p",null,"Save and exit the falco.yaml file."),(0,r.kt)("h3",{id:"download-the-logzio-public-certificate"},"Download the Logz.io public certificate"),(0,r.kt)("p",null,"For HTTPS shipping, download the Logz.io public certificate to your certificate authority folder."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-shell"},"sudo curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o /etc/pki/tls/certs/AAACertificateServices.crt\n")),(0,r.kt)("h3",{id:"configure-filebeat"},"Configure Filebeat"),(0,r.kt)("p",null,"Open the Filebeat configuration file (/etc/filebeat/filebeat.yml) with your preferred text editor. Copy and paste the code block below, overwriting the previous content. (You want to replace the file's content with this code block.)"),(0,r.kt)("p",null,"This code block adds Falco as an input and sets Logz.io as the output."),(0,r.kt)("admonition",{type:"note"},(0,r.kt)("p",{parentName:"admonition"},"Filebeat requires a file extension specified for the log input.")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-yaml"},"# ...\nfilebeat.inputs:\n- type: filestream\n paths:\n - <<filepath-to-falco-events.txt>>\n fields:\n logzio_codec: json\n token: <<LOG-SHIPPING-TOKEN>>\n type: falco\n fields_under_root: true\n encoding: utf-8\n ignore_older: 3h\n\nfilebeat.registry.path: /var/lib/filebeat\n\noutput.logstash:\n hosts: [\"<<LISTENER-HOST>>:5015\"]\n ssl:\n certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']\n")),(0,r.kt)("p",null,"If you're running Filebeat 7 to 8.1, paste the code block below instead:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-yaml"},'# ...\nfilebeat.inputs:\n- type: log\n paths:\n - <<filepath-to-falco-events.txt>>\n fields:\n logzio_codec: json\n token: <<LOG-SHIPPING-TOKEN>>\n type: falco\n fields_under_root: true\n encoding: utf-8\n ignore_older: 3h\n\nfilebeat.registry.path: /var/lib/filebeat\n\n#The following processors are to ensure compatibility with version 7\nprocessors:\n- rename:\n fields:\n - from: "agent"\n to: "beat_agent"\n ignore_missing: true\n- rename:\n fields:\n - from: "log.file.path"\n to: "
1source"\n ignore_missing: true\n\n# ...\noutput.logstash:\n hosts: ["<<LISTENER-HOST>>:5015"]\n ssl:\n certificate_authorities: [\'/etc/pki/tls/certs/AAACertificateServices.crt\']\n')),(0,r.kt)("p",null,"Replace the placeholders to match your specifics. (They are indicated by the double angle brackets ",(0,r.kt)("inlineCode",{parentName:"p"},"<< >>"),"):"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("p",{parentName:"li"},"Replace ",(0,r.kt)("inlineCode",{parentName:"p"},"<<LOG-SHIPPING-TOKEN>>")," with the token of the account you want to ship to.")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("p",{parentName:"li"},"Replace ",(0,r.kt)("inlineCode",{parentName:"p"},"<<LISTENER-HOST>>")," with the host ",(0,r.kt)("a",{parentName:"p",href:"https://docs.logz.io/docs/user-guide/admin/hosting-regions/account-region/#available-regions"},"for your region"),".")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("p",{parentName:"li"},"Replace the placeholder ",(0,r.kt)("inlineCode",{parentName:"p"},"<<filepath-to-falco-events.txt>>")," with the filepath from the previous step."))),(0,r.kt)("admonition",{type:"note"},(0,r.kt)("p",{parentName:"admonition"},"One last validation - make sure Logz.io is the only output and appears only once.\nIf the file has other outputs, remove them.")),(0,r.kt)("h3",{id:"start-filebeat"},"Start Filebeat"),(0,r.kt)("p",null,(0,r.kt)("a",{parentName:"p",href:"https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-starting.html"},"Start or restart Filebeat")," for the changes to take effect."),(0,r.kt)("h3",{id:"check-logzio-for-your-logs"},"Check Logz.io for your logs"),(0,r.kt)("p",null,"Give your logs some time to get from your system to ours, and then open ",(0,r.kt)("a",{parentName:"p",href:"https://app.logz.io/#/dashboard/osd"},"Open Search Dashboards"),"."),(0,r.kt)("p",null,"If you still don't see your logs, see ",(0,r.kt)("a",{parentName:"p",href:"https://docs.logz.io/docs/user-guide/log-management/troubleshooting/troubleshooting-filebeat/"},"Filebeat troubleshooting"),"."))}d.isMDXComponent=!0}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.