mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.9 KiB
2.9 KiB
Workflow - Detecting Container Escape with Falco Rules
Phase 1: Deploy Falco
Install on Kubernetes
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
helm install falco falcosecurity/falco \
--namespace falco --create-namespace \
--set driver.kind=ebpf \
--set falcosidekick.enabled=true \
--set falcosidekick.webui.enabled=true \
--set collectors.containerd.enabled=true
kubectl -n falco rollout status daemonset/falco --timeout=120s
Verify Deployment
kubectl get pods -n falco -o wide
kubectl logs -n falco -l app.kubernetes.io/name=falco --tail=10
Phase 2: Deploy Custom Escape Detection Rules
Create ConfigMap with Custom Rules
kubectl create configmap falco-escape-rules -n falco \
--from-file=container-escape.yaml=/path/to/container-escape.yaml
# Restart Falco to load new rules
kubectl rollout restart daemonset/falco -n falco
Validate Rules Loaded
kubectl exec -n falco $(kubectl get pod -n falco -l app.kubernetes.io/name=falco -o jsonpath='{.items[0].metadata.name}') -- \
falco --list | grep -i escape
Phase 3: Test Detection
Test 1 - Privileged Container
kubectl run escape-test-priv --image=alpine --restart=Never \
--overrides='{"spec":{"containers":[{"name":"test","image":"alpine","command":["sleep","30"],"securityContext":{"privileged":true}}]}}'
# Check alert
kubectl logs -n falco -l app.kubernetes.io/name=falco --tail=5 | grep -i privileged
kubectl delete pod escape-test-priv
Test 2 - Sensitive File Access
kubectl run escape-test-shadow --image=alpine --restart=Never -- cat /etc/shadow
kubectl logs -n falco -l app.kubernetes.io/name=falco --tail=5 | grep -i shadow
kubectl delete pod escape-test-shadow
Test 3 - Shell Spawn
kubectl exec -it deploy/some-app -- /bin/sh
# In Falco logs, should see "Terminal shell in container"
Phase 4: Integrate Alerting
Configure Falcosidekick Outputs
# values-sidekick.yaml
config:
slack:
webhookurl: "https://hooks.slack.com/services/XXX/YYY/ZZZ"
minimumpriority: "warning"
elasticsearch:
hostport: "https://elasticsearch:9200"
index: "falco"
minimumpriority: "notice"
prometheus:
enabled: true
helm upgrade falco falcosecurity/falco -n falco \
-f values-sidekick.yaml
Phase 5: Tune and Maintain
Handle False Positives
# Add exceptions to rules
- rule: Terminal shell in container
append: true
exceptions:
- name: known_shell_spawners
fields: [container.image.repository]
comps: [in]
values:
- [my-debug-image, kubectl-debug]
Regular Maintenance
- Update Falco rules weekly:
falcoctl artifact install falco-rules - Review new maturity_stable rules after each Falco release
- Correlate Falco alerts with Kubernetes audit logs
- Run escape simulation exercises monthly