What Falco Captures and Why

▶ Watch (0:03)

Falco is a cloud-native real-time threat detection engine. Deployed in a Kubernetes cluster, it monitors system calls and log messages against a rule set and fires an alert on any match. It has run in production for roughly 10 years and is about to mark its 10-year anniversary. The recent addition is a capture feature: when a rule triggers, Falco can now write that activity to a capture file for later investigation.

Stratosark: Wireshark Workflows Applied to System Calls

▶ Watch (0:38)

Stratosark is a sibling application of Wireshark built by Combs. It shares the same user interface and the same dissection engine. Analysts can apply the filter-and-drill workflows familiar from packet analysis directly to system calls and log messages. The goal is to bring to the system-call world the same tooling maturity the networking world has built around libpcap over the past 20 to 25 years.

Configuring Falco Capture

▶ Watch (2:01)

Three changes in falco.yaml enable capture. First, find the capture section and set enabled: true. It ships as false to keep Falco lightweight. Second, choose whether capture applies to all rules or a specific subset. Third, set a path prefix (the default is /falco) and a stop condition. Today that condition is a time duration in milliseconds. A future version will also accept an event count or a maximum file size. When a rule fires, Falco writes a timestamped capture file matching a predictable naming format.

The Observer Effect: Overhead to Know Before Enabling

▶ Watch (3:15)

The KubeCon North America demo required explicitly capturing read and write system calls, which carries significant overhead and is off by default. Combs warned about the observer effect: monitoring a system can degrade its performance. In networking you can buy passive hardware taps to avoid this. No equivalent exists for CPU system calls. Anyone experimenting with full read/write capture should test carefully and measure the performance impact before running it in production. Community feedback on the feature is welcome, as it is still under development.

Where to Go Next

▶ Watch (4:22)

Combs offered a live demo at the Falco booth at KubeCon for anyone who wants to see the full workflow. Additional documentation URLs were shown on screen. A longer Falco presentation was scheduled the following day in room G102 at noon for a deeper treatment of the project.

Notable Quotes

I am Gerald Combmes. Uh I’m more well known as the creator and lead developer of Wireshark, but I am also a Falco maintainer. Gerald Combs · ▶ 0:03

unfortunately, I was very disappointed to learn that you cannot buy passive hardware taps for system calls on a CPU. Gerald Combs · ▶ 3:58

your feedback on this feature would be really useful here. I mean it still is a new thing and it is still under development. Gerald Combs · ▶ 4:15

Key Takeaways

  • Falco’s capture feature saves rule-triggered system-call activity to timestamped files for forensic review.
  • Stratosark applies Wireshark’s dissection engine and UI to system calls and log messages.
  • Capture is disabled by default; enabling it requires three explicit config changes in falco.yaml.
  • Full read/write capture adds overhead; test for the observer effect before running in production.