Exercise: override a Falco rule and prove the alert

Host: worker (root) · Time: 10 min · Domain: Monitoring, Logging and Runtime Security

Task

Override Write below etc so the output contains the container id and image.
Send alerts to /var/log/falco/events.log and disable stdout output.
Trigger the rule from a Pod.

Acceptance criteria

A shell writing to /etc produces a line in /var/log/falco/events.log containing the container id.
falco_rules.yaml is unmodified.
The Falco service is active.

Solution

# /etc/falco/falco_rules.local.yaml — the WHOLE rule, same name
- rule: Write below etc
  desc: an attempt to write to any file below /etc
  condition: write_etc_common
  output: "Write below /etc (user=%user.name container=%container.id image=%container.image.repository file=%fd.name)"
  priority: ERROR
  tags: [filesystem, mitre_persistence]

# /etc/falco/falco.yaml
stdout_output: {enabled: false}
file_output:
  enabled: true
  keep_alive: false
  filename: /var/log/falco/events.log

sudo mkdir -p /var/log/falco && sudo systemctl restart falco
kubectl exec -n prod web -- sh -c 'echo x >> /etc/probe'
sudo tail -3 /var/log/falco/events.log

Never edit falco_rules.yaml — it is replaced on upgrade and the marker may check
it. The override is matched by rule name and must be complete.