apiVersion: v1 items: - apiVersion: v1 data: falco.yaml: |- append_output: - extra_fields: - k8s.pod.name - k8s.ns.name - proc.name - proc.cmdline - fd.name match: source: syscall base_syscalls: all: false custom_set: [] repair: false buffer_format_base64: false buffered_outputs: false capture: default_duration: 5000 enabled: false mode: rules path_prefix: /tmp/falco config_files: - /etc/falco/config.d engine: kind: modern_ebpf kmod: buf_size_preset: 4 drop_failed_exit: false modern_ebpf: buf_size_preset: 4 cpus_for_each_buffer: 2 disable_iterators: false drop_failed_exit: false falco_libs: snaplen: 80 thread_table_auto_purging_interval_s: 300 thread_table_auto_purging_thread_timeout_s: 300 thread_table_size: 262144 file_output: enabled: false filename: ./events.txt keep_alive: false http_output: ca_bundle: "" ca_cert: "" ca_path: /etc/falco/certs/ client_cert: /etc/falco/certs/client/client.crt client_key: /etc/falco/certs/client/client.key compress_uploads: false echo: false enabled: true insecure: false keep_alive: false max_consecutive_timeouts: 5 mtls: false url: http://falco-falcosidekick:2801 user_agent: falcosecurity/falco json_include_message_property: false json_include_output_fields_property: true json_include_output_property: true json_include_tags_property: true json_output: true libs_logger: enabled: true severity: info load_plugins: - container log_level: info log_stderr: true log_syslog: true output_timeout: 2000 outputs_queue: capacity: 0 plugins: - init_config: engines: bpm: enabled: true containerd: enabled: true sockets: - /run/host-containerd/containerd.sock cri: enabled: true sockets: - /run/containerd/containerd.sock - /run/crio/crio.sock - /run/k3s/containerd/containerd.sock - /run/host-containerd/containerd.sock docker: enabled: true sockets: - /var/run/docker.sock libvirt_lxc: enabled: true lxc: enabled: true podman: enabled: true sockets: - /run/podman/podman.sock hooks: - create label_max_len: 100 with_size: false library_path: libcontainer.so name: container plugins_hostinfo: true priority: debug program_output: enabled: false keep_alive: false program: 'jq ''{text: .output}'' | curl -d @- -X POST https://hooks.slack.com/services/XXX' rule_matching: all rules_files: - /etc/falco/falco_rules.yaml - /etc/falco/falco_rules.local.yaml - /etc/falco/rules.d stdout_output: enabled: true syscall_event_drops: actions: - log - alert max_burst: 1 rate: 0.03333 simulate_drops: false threshold: 0.1 syscall_event_timeouts: max_consecutives: 1000 syslog_output: enabled: true time_format_iso_8601: true watch_config_files: true webserver: enabled: true k8s_healthz_endpoint: /healthz listen_address: 0.0.0.0 listen_port: 8765 prometheus_metrics_enabled: false ssl_certificate: /etc/falco/falco.pem ssl_enabled: false threadiness: 0 kind: ConfigMap metadata: annotations: meta.helm.sh/release-name: falco meta.helm.sh/release-namespace: falco creationTimestamp: "2026-11-09T06:09:00Z" labels: app.kubernetes.io/instance: falco app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: falco app.kubernetes.io/version: 0.45.0 helm.sh/chart: falco-9.2.0 name: falco namespace: falco resourceVersion: "2916" uid: c1fc04cd-8619-4384-aa4f-86422a575133 - apiVersion: v1 data: falcoctl.yaml: |- artifact: allowedTypes: - rulesfile - plugin follow: every: 168h falcoversions: http://localhost:8765/versions pluginsDir: /plugins refs: - falco-rules:5 rulesfilesDir: /rulesfiles stateDir: /artifactstate install: pluginsDir: /plugins refs: - falco-rules:5 - ghcr.io/falcosecurity/plugins/plugin/container:0.7.4 resolveDeps: true rulesfilesDir: /rulesfiles stateDir: /artifactstate indexes: - name: falcosecurity url: https://falcosecurity.github.io/falcoctl/index.yaml kind: ConfigMap metadata: annotations: meta.helm.sh/release-name: falco meta.helm.sh/release-namespace: falco creationTimestamp: "2026-11-09T06:09:00Z" labels: app.kubernetes.io/instance: falco app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: falco app.kubernetes.io/version: 0.45.0 helm.sh/chart: falco-9.2.0 name: falco-falcoctl namespace: falco resourceVersion: "2915" uid: 5eb595c5-fcdd-4480-b9a8-046dfdd1bfb3 - apiVersion: v1 data: custom_rules.yaml: |2- # -------------------------------------------------------- # Détecter l’exécution de scripts depuis des chemins de conteneur modifiables # # Exemple de comportement CALDERA déjà validé : # # wget .../LinEnum.sh # chmod +x LinEnum.sh # ./LinEnum.sh # # Les règles Falco par défaut n’ont pas généré d’alerte pour ce scénario. # Cette règle ajoute une couverture supplémentaire. # -------------------------------------------------------- - rule: Shell Script Executed From Writable Container Path desc: > Détecter l’exécution d’un shell impliquant des scripts ou des fichiers situés dans des chemins modifiables du conteneur. condition: > spawned_process and container and proc.name in (sh, bash) and ( proc.cmdline contains ".sh" or proc.cmdline contains "/tmp/" or proc.cmdline contains "/var/tmp/" ) output: > Exécution suspecte d’un script shell dans un conteneur (user=%user.name uid=%user.uid command=%proc.cmdline process=%proc.name parent=%proc.pname container=%container.name pod=%k8s.pod.name namespace=%k8s.ns.name) priority: WARNING tags: - container - script_execution - caldera - mitre mitre_custom_rules.yaml: |2- # ======================================================== # T1059.004 - Unix Shell # Détecter les shells non interactifs dans le pod compromis # ======================================================== - rule: Custom T1059.004 Non Interactive Shell desc: Détecter l’exécution inattendue d’un shell non interactif dans cible1 condition: > spawned_process and container and k8s.pod.name = "cible1" and proc.name in (sh, bash) and proc.tty = 0 output: > CUSTOM T1059.004 - Shell non interactif (user=%user.name command=%proc.cmdline parent=%proc.pname container=%container.name pod=%k8s.pod.name) priority: WARNING tags: [custom, mitre, T1059.004] # ======================================================== # T1082 / T1083 - énumération suspecte avec find # ======================================================== - rule: Custom Suspicious Filesystem Enumeration desc: Détecter l’énumération des permissions ou des propriétaires avec find condition: > spawned_process and container and k8s.pod.name = "cible1" and proc.name = find and ( proc.cmdline contains "-perm" or proc.cmdline contains "-user" ) output: > CUSTOM - Découverte du système de fichiers (user=%user.name command=%proc.cmdline container=%container.name pod=%k8s.pod.name) priority: NOTICE tags: [custom, mitre, T1082, T1083] # ======================================================== # T1082 - LinEnum / scripts d’énumération # ======================================================== - rule: Custom T1082 Enumeration Script desc: Détecter l’exécution de scripts d’énumération dans cible1 condition: > spawned_process and container and k8s.pod.name = "cible1" and proc.name in (sh, bash) and ( proc.cmdline contains "LinEnum.sh" or proc.cmdline contains "/tmp/" or proc.cmdline contains "/var/tmp/" ) output: > CUSTOM T1082 - Exécution d’un script d’énumération (user=%user.name command=%proc.cmdline parent=%proc.pname container=%container.name) priority: WARNING tags: [custom, mitre, T1082] # ======================================================== # T1057 - Découverte des processus # ======================================================== - rule: Custom T1057 Process Discovery desc: Détecter l’énumération des processus depuis le pod applicatif compromis condition: > spawned_process and container and k8s.pod.name = "cible1" and proc.name = ps and user.uid = 0 output: > CUSTOM T1057 - Découverte des processus (user=%user.name command=%proc.cmdline parent=%proc.pname container=%container.name) priority: NOTICE tags: [custom, mitre, T1057] # ======================================================== # T1046 - Découverte des services réseau # ======================================================== - rule: Custom T1046 Network Service Discovery desc: Détecter la découverte active de services réseau depuis cible1 condition: > spawned_process and container and k8s.pod.name = "cible1" and ( proc.name = nmap or proc.name in (nc, ncat, netcat) or ( proc.name = python3 and proc.cmdline contains "scanner.py" ) ) output: > CUSTOM T1046 - Découverte des services réseau (user=%user.name processus=%proc.name commande=%proc.cmdline container=%container.name) priority: WARNING tags: [custom, mitre, T1046] # ======================================================== # T1105 - Transfert d’outils # ======================================================== - rule: Custom T1105 Suspicious Tool Transfer desc: Détecter le téléchargement suspect d’un outil ou d’un script dans cible1 condition: > spawned_process and container and k8s.pod.name = "cible1" and proc.name in (curl, wget) and ( proc.cmdline contains ".sh" or proc.cmdline contains "/file/download" or proc.cmdline contains "LinEnum" ) output: > CUSTOM T1105 - Transfert suspect d’un outil (user=%user.name command=%proc.cmdline container=%container.name) priority: WARNING tags: [custom, mitre, T1105] pr10_response_rules.yaml: |2- - rule: PR10 Response Trigger Talon Active Canary desc: Déclencheur inoffensif utilisé pour valider la disponibilité de la chaîne de réponse après l’activation de Talon condition: > spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_TALON_CANARY" output: > PR10 RESPONSE CANARY (pod=%k8s.pod.name namespace=%k8s.ns.name processus=%proc.name commande=%proc.cmdline) priority: NOTICE tags: [pr10_response, readiness] - rule: PR10 Response Trigger PB1 Process Discovery desc: Déclencheur dédié à la réponse PB1 condition: > spawned_process and container and k8s.pod.name = "cible1" and proc.name = ps and proc.cmdline contains "ps aux" output: > PR10 RESPONSE PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name processus=%proc.name commande=%proc.cmdline) priority: WARNING tags: [pr10_response, pb1, mitre, T1057] - rule: PR10 Response Trigger PB2 Tool Transfer desc: Déclencheur déterministe dédié à la réponse PB2 condition: > spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_PB2_RESPONSE=1" and proc.cmdline contains "manual-curl-tool.sh" output: > PR10 RESPONSE PB2 (pod=%k8s.pod.name namespace=%k8s.ns.name processus=%proc.name commande=%proc.cmdline) priority: WARNING tags: [pr10_response, pb2, mitre, T1105] - rule: PR10 Response Trigger PB3 Shell Execution desc: Déclencheur déterministe dédié à la réponse PB3 condition: > spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_PB3_RESPONSE=1" and proc.cmdline contains "manual-response-shell.sh" output: > PR10 RESPONSE PB3 (pod=%k8s.pod.name namespace=%k8s.ns.name processus=%proc.name commande=%proc.cmdline) priority: WARNING tags: [pr10_response, pb3, mitre, T1059.004] pr10_routing_rules.yaml: |2- - rule: PR10 Route S01 PB1 desc: Acheminer le scénario 01 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S01" output: PR10 ROUTE S01 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S01 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s01, mitre, T1082] - rule: PR10 Route S02 PB1 desc: Acheminer le scénario 02 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S02" output: PR10 ROUTE S02 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S02 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s02, mitre, T1082] - rule: PR10 Route S03 PB1 desc: Acheminer le scénario 03 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S03" output: PR10 ROUTE S03 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S03 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s03, mitre, T1057] - rule: PR10 Route S04 PB1 desc: Acheminer le scénario 04 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S04" output: PR10 ROUTE S04 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S04 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s04, mitre, T1057] - rule: PR10 Route S05 PB1 desc: Acheminer le scénario 05 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S05" output: PR10 ROUTE S05 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S05 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s05, mitre, T1057] - rule: PR10 Route S06 PB1 desc: Acheminer le scénario 06 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S06" output: PR10 ROUTE S06 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S06 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s06, mitre, T1057] - rule: PR10 Route S07 PB1 desc: Acheminer le scénario 07 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S07" output: PR10 ROUTE S07 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S07 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s07, mitre, T1083] - rule: PR10 Route S08 PB1 desc: Acheminer le scénario 08 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S08" output: PR10 ROUTE S08 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S08 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s08, mitre, T1083] - rule: PR10 Route S09 PB1 desc: Acheminer le scénario 09 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S09" output: PR10 ROUTE S09 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S09 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s09, mitre, T1083] - rule: PR10 Route S10 PB1 desc: Acheminer le scénario 10 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S10" output: PR10 ROUTE S10 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S10 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s10, mitre, T1046] - rule: PR10 Route S11 PB1 desc: Acheminer le scénario 11 vers PB1 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S11" output: PR10 ROUTE S11 PB1 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S11 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb1, scenario_s11, mitre, T1046] - rule: PR10 Route S12 PB2 desc: Acheminer le scénario 12 vers PB2 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S12" output: PR10 ROUTE S12 PB2 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S12 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb2, scenario_s12, mitre, T1105] - rule: PR10 Route S13 PB2 desc: Acheminer le scénario 13 vers PB2 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S13" output: PR10 ROUTE S13 PB2 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S13 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb2, scenario_s13, mitre, T1105] - rule: PR10 Route S14 PB3 desc: Acheminer le scénario 14 vers PB3 condition: spawned_process and container and k8s.pod.name = "cible1" and proc.name = sh and proc.cmdline contains "PR10_SCENARIO=S14" output: PR10 ROUTE S14 PB3 (pod=%k8s.pod.name namespace=%k8s.ns.name scenario=S14 commande=%proc.cmdline) priority: WARNING tags: [pr10_route, pb3, scenario_s14, mitre, T1059.004] kind: ConfigMap metadata: annotations: meta.helm.sh/release-name: falco meta.helm.sh/release-namespace: falco creationTimestamp: "2026-11-09T06:09:00Z" labels: app.kubernetes.io/instance: falco app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: falco app.kubernetes.io/version: 0.45.0 helm.sh/chart: falco-9.2.0 name: falco-rules namespace: falco resourceVersion: "2917" uid: 2f8a4ee1-c4ae-4d53-88bb-127160656844 - apiVersion: v1 data: rules.yaml: |2- - action: Terminate Pod actionner: kubernetes:terminate - action: Label Pod as Suspicious actionner: kubernetes:label parameters: labels: analysis/status: "suspicious" # PR10_STACK_VERSION: v17-response-truth # PR10_TALON_RULESET_ID: active-v17-response-truth # ============================================================ # PLAYBOOKS FALCO TALON ACTIFS # # Ces playbooks correspondent volontairement aux règles Falco dédiées # à la réponse déjà présentes dans valeurs-personnalisees.yaml. # # Les règles Falco réservées à la réponse sont exclues du résultat de détection # des 14 scénarios pendant le traitement des preuves. # ============================================================ # ------------------------------------------------------------ # CANARI DE DISPONIBILITÉ DU MODE ACTIF # ------------------------------------------------------------ - action: PR10 Active Canary Marker actionner: kubernetes:label parameters: level: pod labels: falco-talon-active: "true" - rule: PR10 Active Canary Playbook description: Preuve inoffensive de disponibilité du mode actif. match: rules: - PR10 Response Trigger Talon Active Canary actions: - action: PR10 Active Canary Marker # ------------------------------------------------------------ # PB1 - Collecte de preuves # ------------------------------------------------------------ - action: PB1 Marker Triggered actionner: kubernetes:label continue: true parameters: level: pod labels: falco-pb1-triggered: "true" - action: PB1 Collect Runtime Evidence actionner: kubernetes:script continue: true parameters: shell: /bin/sh script: | set +e # IMPORTANT : Falco Talon v0.3.0 appelle os.ExpandEnv() sur le script # avant de le copier dans le pod cible. Éviter les variables shell ordinaires # comme $DIR, $p, $i, etc., puisque Talon les développerait # d’abord dans son propre environnement (souvent vers une chaîne vide). rm -rf /tmp/falco-response/pb1 mkdir -p /tmp/falco-response/pb1 || exit 40 { echo "STACK_VERSION=v17-response-truth" echo "PLAYBOOK=PB1" echo "ACTION=EVIDENCE_COLLECTION" printf 'TIMESTAMP=' date -u '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null || true printf 'HOSTNAME_RUNTIME=' hostname 2>/dev/null || true printf 'IDENTITY=' id 2>/dev/null || true printf 'KERNEL=' uname -a 2>/dev/null || true } > /tmp/falco-response/pb1/00-context.txt # Collecter les preuves des processus sans réexécuter `ps aux`. Une nouvelle exécution # redéclencherait la règle de réponse PB1 de Falco et créerait une boucle. { echo "=== RÉPERTOIRES PROC ===" find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' -print 2>/dev/null | head -200 || true echo "=== LIGNES DE COMMANDE ===" grep -aH '' /proc/[0-9]*/cmdline 2>/dev/null | head -200 || true } > /tmp/falco-response/pb1/01-processes.txt { echo "=== TCP ===" cat /proc/net/tcp 2>/dev/null || true echo "=== TCP6 ===" cat /proc/net/tcp6 2>/dev/null || true echo "=== UDP ===" cat /proc/net/udp 2>/dev/null || true } > /tmp/falco-response/pb1/02-connections.txt cat /proc/mounts 2>/dev/null > /tmp/falco-response/pb1/03-mounts.txt || true if command -v find >/dev/null 2>&1; then find /tmp /var/tmp -maxdepth 2 -type f -ls 2>/dev/null \ | head -150 > /tmp/falco-response/pb1/04-files.txt || true else echo "commande find non disponible dans l’image cible" \ > /tmp/falco-response/pb1/04-files.txt fi if [ -s /tmp/falco-response/pb1/00-context.txt ] && \ [ -s /tmp/falco-response/pb1/01-processes.txt ] && \ [ -s /tmp/falco-response/pb1/02-connections.txt ] && \ [ -s /tmp/falco-response/pb1/03-mounts.txt ]; then echo "COLLECTED" > /tmp/falco-response/pb1/STATUS exit 0 fi echo "EVIDENCE_FAILED" > /tmp/falco-response/pb1/STATUS exit 42 - action: PB1 Collect Container Logs actionner: kubernetes:log continue: true parameters: tail_lines: 100 - action: PB1 Marker Complete actionner: kubernetes:label continue: true parameters: level: pod labels: falco-pb1-complete: "true" - rule: PB1 Evidence Collection Playbook description: Collecter les preuves après le déclencheur déterministe de réponse PB1. match: rules: - PR10 Response Trigger PB1 Process Discovery actions: - action: PB1 Marker Triggered - action: PB1 Collect Runtime Evidence - action: PB1 Collect Container Logs - action: PB1 Marker Complete # ------------------------------------------------------------ # PB2 - Mise en quarantaine d’un fichier # ------------------------------------------------------------ - action: PB2 Marker Triggered actionner: kubernetes:label continue: true parameters: level: pod labels: falco-pb2-triggered: "true" - action: PB2 Quarantine Artifact actionner: kubernetes:script continue: true parameters: shell: /bin/sh script: | set +e # Même contrainte os.ExpandEnv() de Talon que pour PB1 : utiliser des chemins littéraux et # éviter les références à des variables shell ordinaires dans ce script. rm -rf /tmp/falco-response/pb2 mkdir -p /tmp/falco-response/pb2 /tmp/falco-quarantine || exit 40 { echo "STACK_VERSION=v17-response-truth" echo "PLAYBOOK=PB2" echo "ACTION=FILE_QUARANTINE" echo "SOURCE=/tmp/manual-curl-tool.sh" echo "DESTINATION=/tmp/falco-quarantine/manual-curl-tool.sh" printf 'TIMESTAMP=' date -u '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null || true } > /tmp/falco-response/pb2/00-context.txt # Falco se déclenche au démarrage de curl. Attendre que le fichier téléchargé devienne # non vide sans utiliser de variable compteur shell que Talon pourrait # développer avant l’exécution. for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do [ -s /tmp/manual-curl-tool.sh ] && break sleep 0.5 done if [ ! -s /tmp/manual-curl-tool.sh ]; then echo "SOURCE_NOT_FOUND_OR_EMPTY" > /tmp/falco-response/pb2/STATUS exit 41 fi sleep 1 ls -l /tmp/manual-curl-tool.sh \ > /tmp/falco-response/pb2/01-file-before.txt 2>&1 || true mv /tmp/manual-curl-tool.sh /tmp/falco-quarantine/manual-curl-tool.sh 2>/dev/null if [ -f /tmp/falco-quarantine/manual-curl-tool.sh ] && \ [ ! -e /tmp/manual-curl-tool.sh ]; then chmod 0400 /tmp/falco-quarantine/manual-curl-tool.sh 2>/dev/null || true ls -l /tmp/falco-quarantine/manual-curl-tool.sh \ > /tmp/falco-response/pb2/03-file-after.txt 2>&1 || true echo "QUARANTINED" > /tmp/falco-response/pb2/STATUS exit 0 fi ls -l /tmp/manual-curl-tool.sh /tmp/falco-quarantine/manual-curl-tool.sh \ > /tmp/falco-response/pb2/03-file-after.txt 2>&1 || true echo "QUARANTINE_FAILED" > /tmp/falco-response/pb2/STATUS exit 42 - action: PB2 Marker Complete actionner: kubernetes:label continue: true parameters: level: pod labels: falco-pb2-complete: "true" - rule: PB2 File Quarantine Playbook description: Mettre en quarantaine l’artefact contrôlé de réponse T1105. match: rules: - PR10 Response Trigger PB2 Tool Transfer actions: - action: PB2 Marker Triggered - action: PB2 Quarantine Artifact - action: PB2 Marker Complete # ------------------------------------------------------------ # PB3 - Isolement du pod # S’EXÉCUTE EN DERNIER dans executer-tests-reponse.sh. # ------------------------------------------------------------ - action: PB3 Marker Triggered actionner: kubernetes:label continue: true parameters: level: pod labels: falco-pb3-triggered: "true" - action: PB3 Collect Container Logs actionner: kubernetes:log continue: true parameters: tail_lines: 100 - action: PB3 Isolate Pod # Confinement : une NetworkPolicy deny-all précréée sélectionne # security-state=quarantined. Cette action de label accomplit donc deux # tâches de réponse de façon atomique : elle active l’isolement réseau bidirectionnel # et retire le pod compromis du sélecteur du Service normal. actionner: kubernetes:label continue: true parameters: level: pod labels: security-state: "quarantined" service-state: "quarantined" - action: PB3 Marker Complete actionner: kubernetes:label continue: true parameters: level: pod labels: falco-pb3-complete: "true" - rule: PB3 Pod Isolation Playbook description: Mettre le pod contrôlé PB3 en quarantaine tout en le conservant pour l’analyse forensique. match: rules: - PR10 Response Trigger PB3 Shell Execution actions: - action: PB3 Marker Triggered - action: PB3 Collect Container Logs - action: PB3 Isolate Pod - action: PB3 Marker Complete kind: ConfigMap metadata: annotations: meta.helm.sh/release-name: falco-talon meta.helm.sh/release-namespace: falco creationTimestamp: "2026-11-09T06:02:55Z" labels: app.kubernetes.io/instance: falco-talon app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: falco-talon app.kubernetes.io/part-of: falco-talon app.kubernetes.io/version: 0.3.0 helm.sh/chart: falco-talon-0.4.2 name: falco-talon-rules namespace: falco resourceVersion: "3565" uid: ea87d3c6-2c83-4112-9b6d-cbfe6151a7b7 - apiVersion: v1 data: ca.crt: | -----BEGIN CERTIFICATE----- MIIDBTCCAe2gAwIBAgIIKwuHlYrnlUMwDQYJKoZIhvcNAQELBQAwFTETMBEGA1UE AxMKa3ViZXJuZXRlczAeFw0yNjExMDkwNTQyMThaFw0zNjExMDYwNTQ3MThaMBUx EzARBgNVBAMTCmt1YmVybmV0ZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK AoIBAQDbSpazLdo3lmIkCCKbtfQyj5mob0+aJSH5IVDbR4v76SPsLdj3bxdcElaO 3hjgoRLfRMkEjICTaLZeLvCVPMRRWAstfBD4aNMdvxy5h3KMfTleJzxWUFyGDG3T VGgFRky3h0AzGZqKxbVkQyoxzGBZiSBa5VhCmjPBvsAlCh+ky5YFmWCXQMLxwS4Q 6rVLw+hw1EHEwkP1PIA2lR4TZOfU6QUOxArHTe6n6GDP+lwH+ud2ISVrJuryTVyu Xg6EwoOnoGTKPqcDwYJUQx75bqbKHeTWH0ww/SSr4/Ou+27S5lIL83LLUvyqD2kv aLfIGDPLFKqsfTUrcHIelwrd26QdAgMBAAGjWTBXMA4GA1UdDwEB/wQEAwICpDAP BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTAfXH7fyr3sUvFPwYYebu4dD3CRTAV BgNVHREEDjAMggprdWJlcm5ldGVzMA0GCSqGSIb3DQEBCwUAA4IBAQAi1O87zISX l7jQOnvjCLHil3BWUENMdbTspsayaogY5SerEYBmU2FzfP8FPxR9jo4kqHafWwGV fa0it0IDtydWMK+v5Rz2RXvthMack9ByKyAl8KNHA0o882G4D5ZnSo8RCsHLDiMk jIpKXzwAiqlV/FowR11XWw7VDU0oTBTs1csA3g/L7QcCC1U7GZz4l8/MAowc6sra srJURB7ouprnqzcy3DjpJ6Tduics9bfICAyl0HMhWLRjmR0jIaqhXr6G5CYnbigc GzH5FMhdByxHWRApWjhg8SgXk6cgVLQ9+dGbA+L+eciosZg4AbS+xRqwtLLo6Jz0 anh94F7sknaY -----END CERTIFICATE----- kind: ConfigMap metadata: annotations: kubernetes.io/description: Contains a CA bundle that can be used to verify the kube-apiserver when using internal endpoints such as the internal service IP or kubernetes.default.svc. No other usage is guaranteed across distributions of Kubernetes clusters. creationTimestamp: "2026-11-09T06:02:55Z" name: kube-root-ca.crt namespace: falco resourceVersion: "2021" uid: 42133ba7-37b0-4788-9a2f-21cd1fc36ed0 kind: List metadata: resourceVersion: ""