<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Runtime Application Protection — API Reference

## Falco CLI

```bash
# Run with custom rules
falco -r custom-rules.yaml

# Validate rules
falco --validate rules.yaml

# Output to JSON
falco -o json_output=true -o json_include_output_property=true

# Dry run
falco --dry-run -r rules.yaml

# List fields
falco --list

# List installed plugins
falco --list-plugins
```

## Falco Helm

```bash
# Install with eBPF
helm install falco falcosecurity/falco -n falco --create-namespace \
  --set driver.kind=ebpf

# With sidekick
helm install falco falcosecurity/falco -n falco \
  --set falcosidekick.enabled=true

# Custom rules
helm install falco falcosecurity/falco -n falco \
  --set-file customRules."rules\.yaml"=custom-rules.yaml

# Upgrade
helm upgrade falco falcosecurity/falco -n falco
```

## Falco Rule Fields

| Field | Description |
|-------|-------------|
| `proc.name` | Process name |
| `proc.cmdline` | Full command line |
| `proc.pname` | Parent process name |
| `container.name` | Container name |
| `container.image.repository` | Image repository |
| `fd.name` | File descriptor name |
| `user.name` | Username |
| `evt.type` | System call type |
| `k8s.pod.name` | Kubernetes pod name |
| `k8s.ns.name` | Kubernetes namespace |

## Kubernetes Network Policies

```yaml
# Default deny all ingress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
    - Ingress

# Default deny all egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes:
    - Egress
```

## eBPF Tools

```bash
# Cilium Hubble (network observability)
hubble observe --namespace production --verdict DROPPED

# Tetragon (runtime enforcement)
kubectl logs -n kube-system ds/tetragon -c export-stdout -f | \
  jq 'select(.process_exec.process.binary == "/bin/sh")'

# bpftrace (custom tracing)
bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("%s %s\n", comm, str(args->filename)); }'
```
