About

Imported from mukul975/anthropic-cybersecurity-skills (skills/performing-cloud-native-forensics-with-falco/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill performing-cloud-native-forensics-with-falco. Copyright stays with the author (Apache-2.0).

Performing Cloud Native Forensics with Falco

Name: performing-cloud-native-forensics-with-falco
Author: mukul975

When to Use

When conducting security assessments that involve performing cloud native forensics with falco
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with cloud security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Deploy and manage Falco rules for runtime security detection in containerized environments. Parse Falco alerts for incident response.

# Custom Falco rule for detecting shell in container
- rule: Shell Spawned in Container
  desc: Detect shell process started in a container
  condition: >
    spawned_process and container
    and proc.name in (bash, sh, zsh, dash, csh)
    and not proc.pname in (docker-entrypo, supervisord)
  output: >
    Shell spawned in container
    (user=%user.name command=%proc.cmdline container=%container.name
     image=%container.image.repository)
  priority: WARNING
  tags: [container, shell, mitre_execution]

Key detection rules:

Shell spawn in non-interactive containers
Sensitive file access (/etc/shadow, /etc/passwd)
Outbound connections from unexpected containers
Privilege escalation via setuid/setgid
Container escape via mount or ptrace

Examples

# Run Falco with custom rules
falco -r /etc/falco/custom_rules.yaml -o json_output=true
# Parse JSON alerts
cat /var/log/falco/alerts.json | python3 -c "import json,sys; [print(json.loads(l)['output']) for l in sys.stdin]"

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-performing-cloud-1b0fb5/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-performing-cloud-1b0fb5.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-performing-cloud-1b0fb5",
  "kind": "skill",
  "name": "performing-cloud-native-forensics-with-falco",
  "description": "Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "cloud-security",
      "falco",
      "runtime-threat-detection",
      "container-forensics",
      "kubernetes-security",
      "syscall-monitoring",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/performing-cloud-native-forensics-with-falco/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/performing-cloud-native-forensics-with-falco/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/performing-cloud-native-forensics-with-falco/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Performing Cloud Native Forensics with Falco\n\n\n## When to Use\n\n- When conducting security assessments that involve performing cloud native forensics with falco\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with cloud security concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n",
  "cost": {
    "context_tokens": 443
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-performing-cloud-1b0fb5/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.