Installing Falco on Linux: Benefits, Usage, and Basic Configuration Rules

Falco is an open-source container security software that uses eBPF (Extended Berkeley Packet Filter) technology to monitor system activities for suspicious behavior. In this article, we will guide you through the installation process of Falco on Linux, discuss its benefits and why it should be used, and provide some basic configuration rules to get you started.

Benefits of Falco:

• Falco provides real-time alerting and detection of suspicious behavior.
• It allows for proactive response to potential security breaches.
• Falco is highly customizable, allowing users to define their own rules and alerts.
• It can be used in both container and non-container environments.

Installation:

1.- Install the necessary dependencies:

For Debian/Ubuntu: sudo apt-get install -y bison flex git make gcc libpcap-dev

For CentOS/RHEL: sudo yum install -y epel-release && sudo yum install -y bison flex git make

gcc libpcap-devel

2.- Install Falco from the official Falco repository:

For Debian/Ubuntu:

wget -qO - https://falco.org/repo/falcosecurity-3672BA8F.asc | sudo apt-key add -
echo "deb https://download.falco.org/packages/deb stable main" | sudo tee -a /etc/apt/sources.list.d/falcosecurity.list
sudo apt-get update && sudo apt-get -y install falco

For CentOS/RHEL:

wget -qO - https://falco.org/repo/falcosecurity-3672BA8F.asc | sudo rpm --import -
echo "[falcosecurity]
name=Falco CentOS-7 - local packages for x86_64
baseurl=https://download.falco.org/packages/rpm
enabled=1
gpgcheck=1
gpgkey=https://falco.org/repo/falcosecurity-3672BA8F.asc" | sudo tee -a /etc/yum.repos.d/falcosecurity.repo
sudo yum update && sudo yum -y install falco

3.- Start the Falco service:

• For systemd: sudo systemctl start falco
• For SysVinit: sudo /etc/init.d/falco start

Basic Configuration:

By default, Falco comes with a set of rules defined in its configuration file (/etc/falco/falco.yaml).

in Falco, the default configuration includes generating logs for all alerts and events that are detected. These logs are stored in a specific file on the system, which is specified in the Falco configuration.

To enable Falco logs, you need to make sure that the Falco configuration is set up correctly for log generation. To do this, you should check that in the Falco configuration file, /etc/falco/falco.yaml, the json_output option is set to true. If this option is not configured, simply add or edit it to look like this:

json_output: true

Once you have enabled Falco logs, you can view them using various methods. Some options include:

Checking the log file directly: The Falco log file is located at /var/log/falco.log on most Linux distributions. You can use tools like less or tail to view the contents of the file in real-time.

Using Falco as a data source in other monitoring tools: Falco is compatible with many monitoring tools, such as Fluentd, Elasticsearch, and Prometheus. Configure Falco as a data source in these tools to collect and visualize log data.

Using the Falco command-line interface: Falco also includes a command-line interface (falcoctl) that allows you to interact with Falco to get information about detected events and alerts.

Falco comes too with a set of rules defined in its configuration file (/etc/falco/falco.yaml).

Users can define their own rules and alerts by modifying the configuration file.

A basic rule might look like this:

- rule: MyFirstRule
  desc: This is my first custom rule
  condition: >
    container.id != host and
    fd.name = /etc/passwd and
    evt.type in (open, read)
  output: >
    An attempt to access /etc/passwd from a container was detected

In summary, enabling Falco logs is easy and can be very useful for monitoring and analyzing system activity. With a bit of configuration, you can view logs directly on the system or integrate them with other tools for even more insight.

By default, Falco comes with a set of rules defined in its configuration file (/etc/falco/falco.yaml).
Users can define their own rules and alerts by modifying the configuration file.
A basic rule might look like this: