pal-e-docs

Phase 20b: Runtime Security (Falco)

phase-platform-20b-runtime-security Phase

phase
Project

Phase 20b: Runtime Security (Falco)

Goal: Deploy Falco as daemonset for runtime syscall monitoring and security event alerting. Detects container escapes, crypto mining, unexpected shells, and anomalous network activity.
Owner: Dev agent
Repo: forgejo_admin/pal-e-platform
Depends on: Phase 3 (Alertmanager — Falco alerts route through existing alert pipeline)
DORA: MTTR — runtime detection reduces time to detect security incidents. A compromised container detected in 30 seconds vs discovered next week is the difference.

Scope

  • Deploy Falco via Helm as daemonset (runs on every node, monitors syscalls via eBPF)
  • Custom rules tuned for k3s:
  • Alertmanager integration: Falco → falcosidekick → Alertmanager → Telegram
  • Grafana dashboard for Falco events: severity, rule, namespace, pod
  • Tune false positives — k3s has different syscall patterns than full k8s

Deliverables

  • TBD — filled after completion
  • phase-platform-20-security-deepening — parent phase
  • phase-pal-e-platform-network-security — Phase 8, Falco complements network-layer with runtime-layer
  • plan-pal-e-platform — parent plan