보안-02. Falco 심화 — K8s 통합, 플러그인, falcosidekick, 커스텀 룰 전략

syscall 이벤트
  └─ pid=1234
      └─ libsinsp가 /proc/1234/cgroup 파싱 → container ID
          └─ container runtime socket에서 container → pod 매핑
              └─ K8s API에서 pod → namespace, labels, deployment 조회
                  └─ k8s.pod.name, k8s.ns.name, k8s.deployment.name 필드 생성

# falco.yaml에 k8saudit 플러그인 설정
load_plugins:
  - name: k8saudit
    library_path: /usr/share/falco/plugins/libk8saudit.so
    init_config:
      sslCertificate: /etc/falco/certs/server.crt
    open_params: "http://0.0.0.0:9765/k8s-audit"

plugins:
  - name: k8saudit
    library_path: /usr/share/falco/plugins/libk8saudit.so

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: RequestResponse   # 요청+응답 모두 기록
    resources:
    - group: ""
      resources: ["secrets", "configmaps", "serviceaccounts"]
  - level: Request
    resources:
    - group: ""
      resources: ["pods", "pods/exec", "pods/log"]
  - level: Metadata           # 나머지는 메타데이터만
    omitStages:
    - RequestReceived

- rule: K8s Cluster-Admin Binding
  desc: 누군가 cluster-admin 권한을 바인딩함 (위험한 과도한 권한)
  condition: >
    ka.target.resource = "clusterrolebindings" and
    ka.verb in (create, update, patch) and
    ka.req.binding.role = "cluster-admin"
  output: >
    ClusterAdmin binding created (user=%ka.user.name binding=%ka.target.name
    role=%ka.req.binding.role subject=%ka.req.binding.subjects)
  priority: WARNING
  source: k8saudit
  tags: [k8s, rbac, privilege_escalation]

- rule: Create Privileged Pod
  desc: privileged 컨테이너가 포함된 Pod 생성
  condition: >
    ka.target.resource = "pods" and
    ka.verb = create and
    ka.req.pod.containers.privileged = true
  output: >
    Privileged pod created (user=%ka.user.name pod=%ka.target.name
    ns=%ka.target.namespace)
  priority: WARNING
  source: k8saudit
  tags: [k8s, container, privilege_escalation]

# values.yaml
driver:
  kind: modern_ebpf

falco:
  json_output: true
  priority: notice   # warning 이상만 처리하면 performance 향상
  
  # 룰 오버라이드 inline으로 정의
  rules:
    - rule: Terminal Shell in Container
      condition: append and not k8s.ns.name = debug
      override:
        condition: append

# 커스텀 룰 파일 ConfigMap으로 마운트
customRules:
  my-rules.yaml: |-
    - rule: My Custom Detection
      desc: 커스텀 탐지 룰
      condition: >
        spawned_process and proc.name = nc and container
      output: netcat spawned in container (container=%container.name)
      priority: WARNING
      tags: [custom]

# falcosidekick 연동
falcosidekick:
  enabled: true
  config:
    slack:
      webhookurl: "https://hooks.slack.com/..."
      minimumpriority: error
    loki:
      hostport: "http://loki:3100"
      minimumpriority: notice

Falco → [HTTP POST json] → falcosidekick → Slack
                                          → PagerDuty
                                          → Elasticsearch
                                          → Loki
                                          → Datadog
                                          → AWS Lambda
                                          → Google Cloud Run
                                          → Webhook (커스텀)

# falcosidekick config.yaml
listenaddress: "0.0.0.0"
listenport: 2801
debug: false

slack:
  webhookurl: "https://hooks.slack.com/services/..."
  channel: "#security-alerts"
  minimumpriority: "error"
  messageformat: "Alert: [%rule%] on %hostname% at %time%"

loki:
  hostport: "http://loki:3100"
  minimumpriority: "notice"
  extralabels: "environment=prod,team=security"

elasticsearch:
  hostport: "http://elasticsearch:9200"
  index: "falco"
  minimumpriority: "notice"

webhook:
  address: "http://my-soar/webhook"
  minimumpriority: "warning"
  checkcert: true

# docker-compose로 전체 스택 띄우기
docker compose -f docker/docker-compose/docker-compose.yaml up -d
# falco + falcosidekick + falcosidekick-ui + redis 모두 올라옴

# falcoctl로 플러그인 설치
falcoctl artifact install k8saudit:latest
falcoctl artifact install cloudtrail:latest

# cloudtrail 이벤트 소스에서 동작하는 룰
- rule: Console Login Without MFA
  desc: AWS 콘솔에 MFA 없이 로그인
  condition: >
    ct.name = "ConsoleLogin" and
    ct.req.console_login.mfa_used = false
  output: >
    Console login without MFA (user=%ct.user.name ip=%ct.srcip)
  priority: CRITICAL
  source: aws_cloudtrail
  tags: [cloud, aws, authentication]

# kube-system 네임스페이스 제외 패턴
- macro: kube_system_namespace
  condition: (k8s.ns.name = kube-system)

- rule: Unexpected Network Connection
  condition: >
    outbound and container and
    not kube_system_namespace and     # 이 줄 추가
    not proc.name in (known_processes)
  ...

# 구조화된 exception 사용
- rule: Write Below Binary Dir
  desc: /usr/bin, /bin 등 바이너리 디렉터리 아래에 파일 씀
  condition: >
    open_write and bin_dir
  exceptions:
    - name: package_manager
      fields: proc.name
      comps: in
      values: [[dpkg], [rpm], [yum], [apt-get]]
    - name: deployment_scripts
      fields: [proc.name, fd.name]
      comps: [=, startswith]
      values:
        - [deploy.sh, /usr/local/bin/]
  output: Write below binary dir (proc=%proc.name file=%fd.name)
  priority: ERROR

# 어떤 룰이 얼마나 자주 발화하는지 확인
falco --stats-interval 1000 2>&1 | grep "STATS"

# JSON 출력에서 집계
falco --json-output | jq '.rule' | sort | uniq -c | sort -rn | head -20

outputs_queue:
  capacity: 0  # 0 = 무제한 (메모리 허용하는 한)

engine:
  kind: modern_ebpf
  modern_ebpf:
    cpus_for_each_syscall_buffer: 2  # 몇 개 CPU당 버퍼 하나

Falco → falcosidekick → HTTP webhook → Shuffle/TheHive → 플레이북

Falco → falcosidekick → Loki → Grafana (LogQL 알림 룰) → Webhook → 플레이북

import grpc
from falco.outputs.v1 import outputs_pb2, outputs_pb2_grpc

channel = grpc.secure_channel("localhost:5060", creds)
stub = outputs_pb2_grpc.ServiceStub(channel)

for response in stub.Get(outputs_pb2.Request()):
    alert = response
    # LLM에 넘겨서 판단 → 자동 대응
    handle_alert(alert.rule, alert.priority, alert.output_fields)

□ 드라이버 선택: modern_ebpf (커널 5.8+) 또는 kmod
□ Helm values.yaml에 커스텀 룰 ConfigMap 마운트
□ json_output: true 설정
□ falcosidekick 함께 배포 (DaemonSet)
□ falcosidekick → Slack/PagerDuty 연동 (최소 error 이상)
□ falcosidekick → Loki 연동 (notice 이상 전체 보관)
□ Grafana 대시보드 연동
□ K8s Audit 정책 설정 + k8saudit 플러그인 활성화
□ RBAC: Falco ServiceAccount에 필요한 최소 권한만
□ priority 임계값 조정: 처음엔 warning, 안정화 후 notice
□ 주요 FP 룰 오버라이드 파일 작성 (custom_rules.yaml)
□ 성능 모니터링: 이벤트 드랍 여부 주기적 확인