2026-11-09T06:13:00Z INF init category=kubernetes status=success
2026-11-09T06:13:00Z INF init result="4 rule(s) has/have been successfully loaded"
2026-11-09T06:13:00Z INF init result="watch of rules enabled"
2026-11-09T06:13:00Z INF http result="Falco Talon is up and listening on 0.0.0.0:2803"
2026-11-09T06:13:00Z INF nats result="new leader detected '192.168.0.142'"
2026-11-09T06:13:12Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:12.404904326+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203385420700812 proc_exe_ino_mtime=1794203384969698646 proc_exe_ino_ctime_duration_proc_start=1406983834214 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=e03436ba1ecd05570a1421453f1fccf4
2026-11-09T06:13:12Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:12.393418452+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/loopback proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203387120708973 proc_exe_ino_mtime=1794203387113708939 proc_exe_ino_ctime_duration_proc_start=1405272328235 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=loopback proc_exepath=/opt/cni/bin/loopback parent=containerd command=loopback terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=669c8a0512d52925170362c244cf69ea
2026-11-09T06:13:12Z INF event event="Contact K8S API Server From Container" output="2026-11-09T06:13:12.499699318+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:39788->10.96.0.1:443 lport=443 rport=39788 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0" priority=Notice source=syscall trace_id=e0cf2c0efd9f0a348cdab725ff9a0ada
2026-11-09T06:13:12Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:12.586546677+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico-ipam proc_sname= gparent=containerd proc_exe_ino_ctime=1794203386863707739 proc_exe_ino_mtime=1794203385745702372 proc_exe_ino_ctime_duration_proc_start=1405721586897 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=db5f33091e27a7b1e4792a3ff9e152e1
2026-11-09T06:13:12Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:12.938780774+0000: Critical Executing binary not part of base image | proc_exe=umount proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1555547057692 proc_cwd=./ container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=umount proc_exepath=/usr/bin/umount parent=<NA> command=umount /var/lib/kubelet/pods/e4457eac-86ff-4c07-b665-c5f849c7621b/volumes/kubernetes.io~projected/kube-api-access-c7dgb terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=8175f5f02e4bbbb0f310e1334f6dbd0a
2026-11-09T06:13:13Z INF event event="Contact K8S API Server From Container" output="2026-11-09T06:13:12.703900380+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:39804->10.96.0.1:443 lport=443 rport=39804 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0" priority=Notice source=syscall trace_id=2c976f25bb10cd29d88c5fcc3484d616