Attestkeep
Sign up
Runtime with Falco · Coming in 1.2.0

Falco sees. Attestkeep decides.

Create an account Runtime events today
Falco event Your rules rule, tags, priority, namespace, image Record Notify Block Admission new pods of that digest refused running pods are left alone
Falco reports. The decision is taken at the door. Planned for 1.2.0.
What it does

Runtime with Falco

Falco watches what containers do. From 1.2.0 Attestkeep takes its events, matches them against your rules and acts where it already acts: at admission. Falco is optional, you install and configure it, and we do not ship it.

A block refuses new pods of that image digest; running pods are not touched, and the block is lifted by triage. In 1.1 today, Falco events are already filed against the image that produced them and reported in evidence packages.

How it works

Step by step.

  1. Falco reports an event

    Over its HTTP output, with mutual TLS.

  2. Your rules match it

    On rule, tags, priority, namespace and image.

  3. An action is taken

    Allow, record, notify or block.

  4. A block refuses new pods

    Of that digest, at admission, when your policy enforces blocks.

  5. Triage lifts it

    And the decision is recorded.

What it records

The rule set and its hash, rule changes, event counts, blocks and triage decisions go into the package's runtime section.

Runtime events today

1 clauses across 1 frameworks cite at least one of these statements.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account