https://github.com/Popsiclestick/falco-filebeat-daemonset

Easily deployable daemonset which moves logs from falco with filebeat.
https://github.com/Popsiclestick/falco-filebeat-daemonset

containers daemonset falco filebeat kubernetes security

Last synced: 3 months ago
JSON representation

Easily deployable daemonset which moves logs from falco with filebeat.

• Host: GitHub
• URL: https://github.com/Popsiclestick/falco-filebeat-daemonset
• Owner: Popsiclestick
• License: apache-2.0
• Created: 2019-07-08T19:58:03.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2019-12-02T17:04:40.000Z (almost 5 years ago)
• Last Synced: 2024-07-28T00:37:55.004Z (3 months ago)
• Topics: containers, daemonset, falco, filebeat, kubernetes, security
• Size: 38.1 KB
• Stars: 4
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-falco - falco-filebeat-daemonset by Popsiclestick - Easily deployable daemonset which moves logs from falco with filebeat (Community Repositories / Blogs)

README

        
# Falco-filebeat-daemonset

Daemonset configurations to get falco output scraped and sent by filebeat.

This exists to provide a concrete example for getting falco and filebeat working together. I took [falcosecurity's example daemonset](https://github.com/falcosecurity/falco/tree/dev/integrations/k8s-using-daemonset) and added the necessary filebeat components.

## Run

#### Configure the RBAC, Namespace, etc

```

:; kubectl create -f falco-rbac.yml

```

#### Create ConfigMap to store Falco & Filebeat configurations

```

:; kubectl create configmap --namespace security-system falco-config --from-file=falco-config

:; kubectl create configmap --namespace security-system falcobeat-config --from-file=falcobeat-config

```

#### Deploy the daemonset

```

:; kubectl create -f falco-daemonset-configmap.yml

```

## Verify

#### Find the pod && Peek the logs

```

:; kubectl get pods -A

:; kubectl --namespace security-system logs falco-daemonset-${RANDOM} filebeat

```

## Notes

The configurations are examples/templates. You'll want to change the output of your `falcobeat.yml` as well as tune Falco's rules in `falco-config`.