From asi
Deploys and manages Falco YAML rules via gRPC API for runtime threat detection in Kubernetes and containers, monitoring syscalls for shell spawns, file tampering, and privilege escalations. Parses alerts for forensics.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When conducting security assessments that involve performing cloud native forensics with falco
Deploys and manages Falco YAML rules for runtime threat detection in Kubernetes and containers via syscalls, parses alerts with gRPC API and Python for forensics and incident response.
Detects runtime threats in containers and Kubernetes using Falco YAML rules, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalations. Manages rules via gRPC API and parses alerts.
Detects container escape attempts in real-time using Falco rules monitoring syscalls, host filesystem mounts, file access, and privilege escalations in Kubernetes or Docker.
Share bugs, ideas, or general feedback.
Deploy and manage Falco rules for runtime security detection in containerized environments. Parse Falco alerts for incident response.
# Custom Falco rule for detecting shell in container
- rule: Shell Spawned in Container
desc: Detect shell process started in a container
condition: >
spawned_process and container
and proc.name in (bash, sh, zsh, dash, csh)
and not proc.pname in (docker-entrypo, supervisord)
output: >
Shell spawned in container
(user=%user.name command=%proc.cmdline container=%container.name
image=%container.image.repository)
priority: WARNING
tags: [container, shell, mitre_execution]
Key detection rules:
# Run Falco with custom rules
falco -r /etc/falco/custom_rules.yaml -o json_output=true
# Parse JSON alerts
cat /var/log/falco/alerts.json | python3 -c "import json,sys; [print(json.loads(l)['output']) for l in sys.stdin]"