Falco扩展输出与自定义规则

$ helm repo add falcosecurity https://falcosecurity.github.io/charts
 
$ helm repo update
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "falcosecurity" chart repository
...Successfully got an update from the "stable" chart repository
Update Complete. ⎈Happy Helming!⎈
复制

$ helm install falco falcosecurity/falco --set falco.jsonOutput=true --
set falco.httpOutput.enabled=true  --set falco.httpOutput.url=http://falcosidekick:2801 -f howto/falcoCustomRule.yaml -n falco #这里的falcoCustomRule.yaml为自定义规则文件

NAME: falco
LAST DEPLOYED: Mon Nov 9 22:09:28 2020
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Falco agents are spinning up on each node in your cluster. After a few
seconds, they are going to start monitoring your containers looking for
security issues.
No further action should be required.
复制

$ helm ls
$ kubectl get pods
复制

$helm install falcosidekick falcosecurity/falcosidekick --set config.slack.webhookurl=https://hooks.slack.com/services/xxxxxxxx --set webui.enabled=true -n falco

#输出
NAME: falcosidekick
LAST DEPLOYED: Thu Jan 14 23:55:12 2021
NAMESPACE: falco
STATUS: deployed
REVISION: 1
NOTES:
1. Get the application URL by running these commands:
  export POD_NAME=$(kubectl get pods --namespace falco -l "app.kubernetes.io/name=falcosidekick,app.kubernetes.io/instance=falcosidekick" -o jsonpath="{.items[0].metadata.name}")
  kubectl port-forward $POD_NAME 2801:2801
  echo "Visit http://127.0.0.1:2801 to use your application" 
复制

$ kubectl get pod -n falco
NAME READY STATUS RESTARTS AGE
falco-9hftg 1/1 Running 0 89m
falco-gr5q7 1/1 Running 1 90m
falco-lpczj 1/1 Running 0 90m
falcosidekick-586bdb8c6b-j2wdf 1/1 Running 0 5h39m
falcosidekick-586bdb8c6b-zncvq 1/1 Running 0 5h39m
falcosidekick-ui-68f9444cbc-8x9b6 1/1 Running 0 40m
复制

$kubectl logs deployment/falcosidekick -n falco
Found 2 pods, using pod/falcosidekick-586bdb8c6b-j2wdf
2021/12/30 03:42:06 [INFO] : Enabled Outputs : [Slack WebUI]
2021/12/30 03:42:06 [INFO] : Falco Sidekick is up and listening on :2801
2021/12/30 03:48:12 [INFO] : WebUI - Post OK (200)
2021/12/30 03:48:15 [INFO] : Slack - Post OK (200)
复制

#查看svc
$kubectl get svc -n falco
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
falcosidekick ClusterIP XXX.106.191.244   <none>        2801/TCP 5h46m
falcosidekick-ui ClusterIP XXX.99.191.73     <none>        2802/TCP 5h46m

#修改svc类型
$kubectl edit svc -n falco falcosidekick-ui
.......
spec:
 clusterIP: XXX.99.191.73
 externalTrafficPolicy: Cluster
 ports:
 - name: http
   nodePort: 30802 #添加NodePort端口，端口范围30000-32767
   port: 2802
   protocol: TCP
   targetPort: http
 selector:
   app.kubernetes.io/instance: falcosidekick-ui
   app.kubernetes.io/name: falcosidekick-ui
 sessionAffinity: None
 type: NodePort #改为NodePort类型
.......

#查看svc
$ kubectl get svc -n falco
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
falcosidekick NodePort XXX.106.191.244   <none>        2801:30801/TCP 5h46m
falcosidekick-ui NodePort XXX.99.191.73     <none>        2802:30802/TCP 5h46m
复制

- rule: shell_in_container #规则名称
 desc: notice shell activity within a container #规则注释
 condition: container.id != host and proc.name = bash #条件过滤表达式（非常规主机下使用bash）
 output: shell in a container (user=%user.name container_id=%container.id container_name=%container.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)
 #匹配时输出信息
 priority: WARNING #事件等级
复制

- macro: in_container #宏名称
 condition: container.id != host and proc.name = bash #条件过滤表达式
复制

- rule: shell_in_container #规则名称
 desc: notice shell activity within a container #规则注释
 condition: (in_container) #条件过滤表达式（非常规主机下使用bash）
 output: shell in a container (user=%user.name container_id=%container.id container_name=%container.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)
 #匹配时输出信息
 priority: WARNING #事件等级
复制

- list: shell_binaries #列表名
 items: [bash, csh, ksh, sh, tcsh, zsh, dash] #包含值

- list: userexec_binaries
 items: [sudo, su]

- list: known_binaries
 items: [shell_binaries, userexec_binaries] #包含其他列表

- macro: safe_procs condition: proc.name in (known_binaries) #条件（进程名为列表包含值）
复制

$ helm install falco falcosecurity/falco -f falcoCustomRule.yaml -n falco
复制

falcoCustomRule.yaml
复制

customRules:
 falco_custom_network_rule.yaml: |-
   - list: website_ips
     items: ['"197.255.20.45"']
   
   - rule: Connection to test or releaes
     desc: Detect attempts to connect to yjp website 
     condition: outbound and fd.sip in (website_ips)
     output: Outbound connection to yjp website http://www.release.yijiupidev.com or http://www.test.yijiupidev.com/(command=%proc.cmdline connection=%fd.name container_id=%container.id container_name=%container.name %container.info image=%container.image)
     priority: WARNING
     tags: [network]
复制

falco -r /etc/falco/falco_rules.yaml -r /etc/falco/falco_rules.local.yaml
复制

/etc/falco/falco_rules.yaml
复制

- list: my_programs
 items: [ls, cat, pwd]

- rule: my_programs_opened_file
 desc: track whenever a set of programs opens a file
 condition: proc.name in (my_programs) and evt.type=open
 output: a tracked program opened a file (user=%user.name command=%proc.cmdline file=%fd.name) priority: INFO
复制

/etc/falco/falco_rules.local.yaml
复制

- list: my_programs #附加至my_programs列表名
 append: true
 items: [cp]
复制

/etc/falco/falco_rules.yaml
复制

- macro: access_file
 condition: evt.type=open

- rule: program_accesses_file
 desc: track whenever a set of programs opens a file
 condition: proc.name in (cat, ls) and (access_file)
 output: a tracked program opened a file (user=%user.name command=%proc.cmdline file=%fd.name) priority: INFO
复制

/etc/falco/falco_rules.local.yaml
复制

- macro: access_file #宏名称
 append: true
 condition: or evt.type=openat #附加规则条件
复制

/etc/falco/falco_rules.yaml
复制

- rule: program_accesses_file
 desc: track whenever a set of programs opens a file
 condition: proc.name in (cat, ls) and evt.type=open
 output: a tracked program opened a file (user=%user.name command=%proc.cmdline file=%fd.name)
 priority: INFO
复制

/etc/falco/falco_rules.local.yaml
复制

- rule: program_accesses_file #规则名称
 append: true
 condition: and not user.name=root #附加条件（user.name为root不触发）
复制

- rule: my_rule
 desc: ...
 condition: evt.type=open and proc.name=apache
 output: ...

- rule: my_rule
 append: true
 condition: or proc.name=nginx
复制

- macro: consider_all_outbound_conns
 condition: (always_true)
复制

-D <substring>                Disable any rules with names having the substring <substring>. Can be specified multiple times.

-T <tag>                      Disable any rules with a tag=<tag>. Can be specified multiple times.
                              Can not be specified with -t.

-t <tag>                      Only run those rules with a tag=<tag>. Can be specified multiple times.
                              Can not be specified with -T/-D.
复制

- rule: User mgmt binaries
 append: true
 enabled: false
复制

- rule: User mgmt binaries
 condition: and (never_true)
 append: true
复制

- rule: File Open by Privileged Container
 desc: Any open by a privileged container. Exceptions are made for known trusted images.
 condition: (open_read or open_write) and container and container.privileged=true and not trusted_containers
 output: File opened for read/write by privileged container (user=%user.name command=%proc.cmdline %container.info file=%fd.name)
 priority: WARNING
 tags: [container, cis]
复制

Rule no_evttype: warning (no-evttype):
proc.name=foo
    did not contain any evt.type restriction, meaning that it will run for all event types.
    This has a significant performance penalty. Consider adding an evt.type restriction if possible.
复制

Rule evttype_not_equals: warning (trailing-evttype):
evt.type!=execve
    does not have all evt.type restrictions at the beginning of the condition,
    or uses a negative match (i.e. "not"/"!=") for some evt.type restriction.
    This has a performance penalty, as the rule can not be limited to specific event types.
    Consider moving all evt.type restrictions to the beginning of the rule and/or
    replacing negative matches with positive matches if possible.
复制

- rule: Any Open Activity by Systemd
 desc: Detects all open events by systemd.
 condition: evt.type=open and proc.name="(systemd)" or proc.name=systemd
 output: "File opened by systemd (user=%user.name command=%proc.cmdline file=%fd.name)"
 priority: WARNING
复制

- list: systemd_procs
 items: [systemd, '"(systemd)"']

- rule: Any Open Activity by Systemd
 desc: Detects all open events by systemd.
 condition: evt.type=open and proc.name in (systemd_procs)
 output: "File opened by systemd (user=%user.name command=%proc.cmdline file=%fd.name)"
 priority: WARNING
复制

access alarm brk capget clock_getres clock_gettime 
clock_nanosleep clock_settime close container cpu_hotplug 
drop epoll_create epoll_create1 epoll_ctl epoll_pwait 
epoll_wait eventfd eventfd2 exit_group fcntl fcntl64 
fdatasync fgetxattr flistxattr fstat fstat64 fstatat64 
fstatfs fstatfs64 fsync futex get_robust_list 
get_thread_area getcpu getcwd getdents getdents64 getegid 
geteuid getgid getgroups getitimer getpeername getpgid 
getpgrp getpid getppid getpriority getresgid getresuid 
getrlimit getrusage getsid getsockname getsockopt gettid 
gettimeofday getuid getxattr infra io_cancel io_destroy 
io_getevents io_setup io_submit ioprio_get ioprio_set k8s 
lgetxattr listxattr llistxattr llseek lseek lstat lstat64 
madvise mesos mincore mlock mlockall mmap mmap2 mprotect 
mq_getsetattr mq_notify mq_timedreceive mq_timedsend mremap 
msgget msgrcv msgsnd munlock munlockall munmap nanosleep 
newfstatat newselect notification olduname page_fault pause 
poll ppoll pread pread64 preadv procinfo pselect6 pwrite 
pwrite64 pwritev read readv recv recvmmsg remap_file_pages 
rt_sigaction rt_sigpending rt_sigprocmask rt_sigsuspend 
rt_sigtimedwait sched_get_priority_max 
sched_get_priority_min sched_getaffinity sched_getparam 
sched_getscheduler sched_yield select semctl semget semop 
send sendfile sendfile64 sendmmsg setitimer setresgid 
setrlimit settimeofday sgetmask shutdown signaldeliver 
signalfd signalfd4 sigpending sigprocmask sigreturn splice 
stat stat64 statfs statfs64 switch sysdigevent tee time 
timer_create timer_delete timer_getoverrun timer_gettime 
timer_settime timerfd_create timerfd_gettime timerfd_settime times ugetrlimit umask uname ustat vmsplice wait4 waitid waitpid write writev
复制