Falco — runtime security — Arcivéo

Falco

Aktiv

Hendelser siste 24 t: 40

Kritiske

Hendelser siste 24 t

Advarsler

Merknader: 5

Topp regler

Totalt: 40

Topp regler

Read sensitive file untrusted 6

Write below etc 3

Terminal shell in container 0

Detect outbound connections to common miner pools 0

Run shell untrusted 0

Siste hendelser 40

                            warning
                            2026-08-13T22:49:19 warning A Write below etc (user=root command=sh pid=1434)
                        

                            notice
                            2026-08-13T22:14:56 notice A Read sensitive file untrusted (user=root command=sh pid=6540)
                        

                            warning
                            2026-08-13T21:20:01 warning A Read sensitive file untrusted (user=root command=sh pid=8459)
                        

                            warning
                            2026-08-13T20:29:31 warning A Terminal shell in container (user=root command=sh pid=3108)
                        

                            notice
                            2026-08-13T21:15:59 notice A Terminal shell in container (user=root command=sh pid=2228)
                        

                            notice
                            2026-08-13T21:50:09 notice A Read sensitive file untrusted (user=root command=sh pid=3124)
                        

                            notice
                            2026-08-13T21:21:07 notice A Read sensitive file untrusted (user=root command=sh pid=4501)
                        

                            warning
                            2026-08-13T17:52:52 warning A Run shell untrusted (user=root command=sh pid=6894)
                        

                            warning
                            2026-08-13T20:15:19 warning A Detect outbound connections to common miner pools (user=root command=sh pid=2675)
                        

                            warning
                            2026-08-13T21:21:43 warning A Run shell untrusted (user=root command=sh pid=8262)
                        

                            warning
                            2026-08-13T19:40:19 warning A Detect outbound connections to common miner pools (user=root command=sh pid=4250)
                        

                            notice
                            2026-08-13T16:18:49 notice A Write below etc (user=root command=sh pid=3937)
                        

Tuning: demp falsk positiv

Panelet endrer ikke Falco-konfigurasjonen – det viser bare et utsnitt og kommandoene du kjører på serveren via SSH.

1. Opprett en overstyringsfil med unntaket:

# /etc/falco/rules.d/local-tuning.yaml
- rule: <NØYAKTIG REGELNAVN fra listen over>
  condition: and not fd.name = /path/to/exclude
  append: true

2. Kontroller og start Falco på nytt:

sudo nano /etc/falco/rules.d/local-tuning.yaml
sudo falco --validate /etc/falco/rules.d/local-tuning.yaml
sudo systemctl restart falco 2>/dev/null || sudo systemctl restart falco-modern-bpf

Bruk det nøyaktige regelnavnet. Hvis listen viser meldingsteksten i stedet for navnet, aktiver JSON-utdata i falco.yaml (json_output: true), da får panelet de nøyaktige regelnavnene.

Demomodus