Module 06 · Lesson 01
Behavioral Analytics
Detect what a workload does at runtime, and tell normal from suspicious.
- Establish what normal looks like for a workload.
- Spot a process that does not belong and stop it precisely.
- Explain why manual inspection does not scale.
Detection needs a baseline
"Suspicious" only means anything relative to expected behaviour. A web server container should run one process tree belonging to the web server. A shell in it, an outbound connection to an address nothing should be calling, or a compiler running are all anomalies precisely because the normal set is small and knowable.
Containers make this far easier than traditional hosts: a single-purpose container has a tiny expected behaviour set, which is what makes runtime detection practical here at all.
Stop the anomaly, not the workload
Killing the pod would also work and would destroy the evidence along with any chance of understanding how the process got there. Terminating precisely keeps the service up and the rest of the container intact for investigation.
Reading process lists by hand, once, after being told to look, is not detection. Falco watches every syscall a container makes through eBPF, compares it against rules for known-suspicious patterns such as spawning a shell or writing to a sensitive path, and alerts within seconds. The lab teaches you what the anomaly looks like; the tool is what finds it at three in the morning.
Why is behavioural detection more tractable for containers than for general-purpose servers?
On a shared server almost anything could legitimately run, which makes a baseline nearly useless. A container that should only ever run nginx makes a shell an obvious signal.
You find an unexpected process in a running container. Why not just delete the pod?
The controller gives you a clean pod and no answers. Whatever access was used to start that process is still available, so the same thing recurs on the replacement.
What does Falco use to observe container behaviour?
The audit log covers API calls, which is a different surface entirely. Runtime detection watches what the workload does on the node, which is where a shell spawn or an unexpected write shows up.
Detection needs a baseline, and containers have small ones. Terminate the anomaly precisely rather than deleting the pod, so you keep both the service and the evidence. Automate it with a syscall-level tool. Next: threats to the infrastructure underneath.