<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Workload Protection — API Reference

## Falco

### Helm Installation

```bash
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco -n falco --create-namespace \
  --set falcosidekick.enabled=true

# Custom rules
helm install falco falcosecurity/falco -n falco \
  --set-file falco.rules_file[0]=/path/to/custom_rules.yaml
```

### Falco CLI

```bash
# List built-in rules
falco --list

# Dry-run rules
falco -r /etc/falco/falco_rules.yaml --dry-run

# Test with specific event
falco -r rules.yaml -e trace_file.scap
```

## Tetragon

### TracingPolicy CRD

| Field | Type | Description |
|-------|------|-------------|
| `spec.kprobes[].call` | string | Kernel function to trace |
| `spec.kprobes[].args[].type` | string | Argument type (file, int, string) |
| `spec.kprobes[].selectors[].matchArgs` | list | Argument filters |
| `spec.tracepoints[].subsystem` | string | Kernel tracepoint subsystem |

```bash
# List tracing policies
kubectl get tracingpolicy -A

# View Tetragon events
kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon -f
```

## Trivy K8s Scanning

```bash
# Cluster summary
trivy k8s --report summary cluster

# Full report
trivy k8s --report all --format json -o scan.json cluster

# Namespace scan
trivy k8s --namespace production --report all cluster

# Specific resource
trivy k8s --report all deployment/nginx
```

## AWS GuardDuty

```bash
# Create detector
aws guardduty create-detector --enable

# List detectors
aws guardduty list-detectors

# Get findings
aws guardduty list-findings --detector-id ID
aws guardduty get-findings --detector-id ID --finding-ids ID1 ID2

# Enable EKS protection
aws guardduty update-detector --detector-id ID \
  --features '[{"Name":"EKS_RUNTIME_MONITORING","Status":"ENABLED"}]'
```

## GCP Security Command Center

```bash
# List findings
gcloud scc findings list ORGANIZATION_ID --format=json

# List sources
gcloud scc sources list ORGANIZATION_ID
```
