detecting-container-escape-with-falco-rules

Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list, condition, priority, falco_rules.local.yaml, tuning,

Install

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• observability-and-instrumentation 117,221 ★
  Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing,
• honeycomb-tracing 113,505 ★
  Trace Paperclip runs, requests, and full CI suites in Honeycomb. Use to find traces, diagnose latency, design
• Netdata 81,392 ★
  Real-time infrastructure monitoring with metrics, logs, alerts, and ML-based anomaly detection.
• azure-monitor-opentelemetry-ts 49,672 ★
  Auto-instrument Node.js applications with distributed tracing, metrics, and logs.
• devops-troubleshooter 49,672 ★
  Expert DevOps troubleshooter specializing in rapid incident response, advanced debugging, and modern observabi