Home
Blog
Security
April 25, 2023
min

How to deploy sysdig Falco on an EKS cluster

Deploying Sysdig Falco on an Amazon EKS (Elastic Kubernetes Service) cluster
Stream Team
No items found.
No items found.

TL;DR

Step-by-Step Guide

Update kubeconfigMake sure your kubeconfig is set up to interact with your EKS cluster.

You can update it using the AWS CLI:

aws eks --region <region> update-kubeconfig --name <cluster_name>

‍

Add the Sysdig Helm repository

  1. helm repo add falcosecurity https://falcosecurity.github.io/charts
    helm repo update

Install Falco

‍Deploy Falco to your EKS cluster using Helm:

  1. helm install falco falcosecurity/falco
  2. You can customize the installation by creating a custom values file and passing it with -f <your-values-file.yaml>.
  3. Ensure you review and adjust the configuration to suit your security and monitoring needs.

Verify InstallationCheck if Falco pods are running:

  1. kubectl get pods -l app=falco
  2. This command lists the Falco pods, ensuring they are running.

Configure Rules (Optional)Falco comes with a default set of rules, but you might want to customize them according to your use case. You can do this by editing the Falco configuration files or custom rules files.

Set Up Alerts (Optional)For production use, you'll likely want to set up alerting. Falco can send alerts to different destinations like email, Slack, or a custom HTTP endpoint. Configure this in the Falco settings.

‍

Read more here - https://falco.org/docs/install-operate/deployment/

‍

About Stream Security

Stream Security leads in Cloud Detection and Response, modeling all cloud activities and configurations in real-time to uncover adversary intent. The platform correlates activities by principles, helping security teams connect the dots and understand correlations among cloud operations. It reveals each alert's exploitability and blast radius to predict the adversary's next move, enabling security teams to detect, investigate, and respond with confidence, outpacing the adversary.

Stream Team
Related Articles
All
Security
articles >
A Layered Approach to Reducing False Positives in Cloud Security
Security
A Layered Approach to Reducing False Positives in Cloud Security
Tal Shladovsky
Sep 18, 2024
4
min
How to Outpace the Adversary with Stream Security
Security
How to Outpace the Adversary with Stream Security
As organizations increasingly migrate to the cloud, the landscape of cybersecurity evolves, presenting new and complex challenges for security teams. The dynamic nature of cloud environments, coupled with the scale and sophistication of potential threats, demands a proactive and context-driven approach to threat detection. Traditional security measures often fall short, requiring security teams to adapt and develop strategies that can effectively identify, prioritize, and neutralize threats in the cloud. In this blog, we’ll review threat detection challenges in the cloud, and how Stream Security can help overcome these challenges.
Tal Shladovsky
Aug 28, 2024
6
min
Why Cloud Security Tools Have So Many False Positives?
Security
Why Cloud Security Tools Have So Many False Positives?
Struggling with cloud security false positives? Learn how to overcome alert fatigue and focus on real threats by understanding the root causes of false alarms in dynamic cloud environments. Explore specific examples and discover how Stream Security can help you drastically reduce false positives and streamline your security response. Prioritize real risks and improve your cloud security posture today.
Tal Shladovsky
Aug 20, 2024
6
min