You must complete this task on the following cluster/nodes: Cluster: trace Master node: master Worker node: worker1 You can switch the cluster/configuration context using the following command…

$vim /etc/falco/falco_rules.local.yaml rule: Container Drift Detected (open+create) desc: New executable created in a container due to open+create condition: > evt.type in (open,openat,creat) and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not…

Submitted by salim_om· May 4, 2026Monitoring, Logging, and Runtime Security

Question

You must complete this task on the following cluster/nodes:
Cluster: trace
Master node: master
Worker node: worker1
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context trace
Given: You may use Sysdig or Falco documentation.
Task:
Use detection tools to detect anomalies like processes spawning and executing something weird frequently in the single container belonging to Pod tomcat.
Two tools are available to use:
falco
sysdig

Analyse the container's behaviour for at least 40 seconds, using filters that detect newly spawning and executing processes.
Store an incident file at /home/cert_masters/report, in the following format:
[timestamp],[uuid],[processName]
Note: Make sure to store incident file on the cluster's worker node, don't move it to master node.

Exhibits

Explanation

$vim /etc/falco/falco_rules.local.yaml

rule: Container Drift Detected (open+create) desc: New executable created in a container due to open+create condition: > evt.type in (open,openat,creat) and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities and evt.rawres=>0 output: > %evt.time,%user.uid,%proc.name # Add this/Refer falco documentation priority: ERROR $kill -1 <PID of falco>

[desk@cli] $ ssh node01 [node01@cli] $ vim /etc/falco/falco_rules.local.yaml search for Container Drift Detected & paste in falco_rules.local.yaml [node01@cli] $ vim /etc/falco/falco_rules.local.yaml

rule: Container Drift Detected (open+create) desc: New executable created in a container due to open+create condition: > evt.type in (open,openat,creat) and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities and evt.rawres=>0 output: > %evt.time,%user.uid,%proc.name priority: ERROR

[node01@cli] $ vim /etc/falco/falco.yaml file_output: enabled: true keep_alive: false filename: /home/cert_masters/report

send HUP signal to falco process to re-read the configuration root 10127 1 5 17:12 ? 00:00:35 /usr/bin/falco --pidfile=/var/run/falco.pid -c /etc/falco/falco.yaml root@node01:~~# kill -HUP 10127 root@node01:~~# kill -HUP 10127

Topics

#Falco#Sysdig#Runtime Security#Process Monitoring

Community Discussion

No community discussion yet for this question.

Full CKS Practice