<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Container Runtime Threat Detection — API Reference

## Falco Rules Syntax

### Rule Structure

| Field | Type | Description |
|-------|------|-------------|
| `rule` | string | Rule name |
| `desc` | string | Description |
| `condition` | string | Sysdig filter expression |
| `output` | string | Alert output template |
| `priority` | string | EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG |
| `tags` | list | Classification tags |
| `enabled` | bool | Enable/disable rule |

### Common Condition Fields

| Field | Description |
|-------|-------------|
| `spawned_process` | New process created |
| `container` | Event from a container |
| `proc.name` | Process name |
| `proc.pname` | Parent process name |
| `proc.cmdline` | Full command line |
| `fd.name` | File descriptor name/path |
| `fd.sip.name` | Server IP hostname |
| `user.name` | User name |
| `container.name` | Container name |
| `container.image.repository` | Image repository |

### Falco CLI

```bash
# List rules
falco --list

# Validate rules
falco -r rules.yaml --dry-run

# Run with specific rules
falco -r /etc/falco/falco_rules.yaml -r custom_rules.yaml

# Output as JSON
falco -o json_output=true
```

## Tetragon TracingPolicy

### Kprobe Spec

| Field | Description |
|-------|-------------|
| `spec.kprobes[].call` | Kernel function name |
| `spec.kprobes[].syscall` | Is this a syscall (bool) |
| `spec.kprobes[].args[].index` | Argument index |
| `spec.kprobes[].args[].type` | Type: file, int, string, sock |
| `spec.kprobes[].selectors[].matchArgs` | Filter on argument values |
| `spec.kprobes[].selectors[].matchNamespaces` | Filter on PID/mount/etc namespaces |

### Tetragon CLI

```bash
# Get events
kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon -f

# List policies
kubectl get tracingpolicy -A

# Describe policy
kubectl describe tracingpolicy POLICY_NAME

# tetra CLI (if installed)
tetra getevents -o compact
```

## Kubernetes Audit Log Events

```bash
# Key audit events for container threats
# - pods/exec — shell execution
# - secrets — credential access
# - pods — privileged pod creation

# Fetch audit logs (cloud-dependent)
# EKS
aws eks describe-cluster --name CLUSTER --query 'cluster.logging'

# GKE
gcloud logging read 'resource.type="k8s_cluster" AND protoPayload.methodName="io.k8s.core.v1.pods.exec.create"'
```
