Security Monitoring

Dynamic Security Controls

Falco Runtime Security

apiVersion: falco.security.dev/v1beta1
kind: FalcoRule
metadata:
  name: detect-privilege-escalation
spec:
  output: Privilege escalation detected (user=%user.name container=%container.name command=%proc.cmdline)
  rule: >
    spawned_process and container and
    proc.name in (sudo, su) and
    not proc.name in (usermod, groupmod, chown)

Audit Policy Configuration

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse
  resources:
  - group: ""
    resources: ["pods", "services", "secrets"]
- level: Metadata
  resources:
  - group: "rbac.authorization.k8s.io"
    resources: ["roles", "clusterroles"]

Monitoring Stack Integration

Prometheus Rules

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: security-alerts
spec:
  groups:
  - name: security
    rules:
    - alert: PodPrivilegedMode
      expr: kube_pod_container_status_running{container!=""} * on(pod,namespace) group_left kube_pod_security_context{privileged="true"} > 0
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: Pod running in privileged mode detected

Grafana Dashboard Example

{
  "title": "Kubernetes Security Overview",
  "panels": [
    {
      "title": "Failed Authentication Attempts",
      "type": "timeseries",
      "targets": [
        {
          "expr": "sum(rate(apiserver_failed_auth_count[5m])) by (reason)"
        }
      ]
    }
  ]
}

Security Response Automation

Automated Response with Kubectl-Kuberhealthy

apiVersion: comcast.github.io/v1
kind: KuberhealthyCheck
metadata:
  name: security-response
spec:
  runInterval: 5m
  timeout: 10m
  podSpec:
    containers:
    - name: security-check
      image: security-checker:latest
      env:
      - name: CHECK_NAMESPACE
        value: "kube-system"

Best Practices

1. Real-time Monitoring
   • Enable Kubernetes audit logging
   • Use Falco for runtime security
   • Implement automated responses
2. Compliance Controls
   • Regular compliance scans
   • Automated policy enforcement
   • Audit trail maintenance
3. Incident Response
   • Automated containment
   • Evidence collection
   • Playbook automation
4. Metrics Collection
   • Security KPIs
   • Compliance metrics
   • Performance impact