Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Performing Cloud Native Forensics with Falco · mukul975 | DecimalAI

Performing Cloud Native Forensics With Falco

SkillScore26Maintained

performing-cloud-native-forensics-with-falco

Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/performing-cloud-native-forensics-with-falco/SKILL.md

decimalai skills pull performing-cloud-native-forensics-with-falco --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/performing-cloud-native-forensics-with-falco/SKILL.md https://app.decimal.ai/s/performing-cloud-native-forensics-with-falco/SKILL.md

Raw file: /s/performing-cloud-native-forensics-with-falco/SKILL.md ↗ · machine-readable summary at /s/performing-cloud-native-forensics-with-falco.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +22% lift-19% tokens0% turns26% of whole cases pass with skill (6/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-14	✗→✓	▲ Improved	—	—
case-04	✗→✓	▲ Improved	—	—
case-11	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-16	✗→✓	▲ Improved	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/performing-cloud-native-forensics-with-falco/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Performing Cloud Native Forensics with Falco

When to Use

When conducting security assessments that involve performing cloud native forensics with falco
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with cloud security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Deploy and manage Falco rules for runtime security detection in containerized environments. Parse Falco alerts for incident response.

yaml
# Custom Falco rule for detecting shell in container
- rule: Shell Spawned in Container
  desc: Detect shell process started in a container
  condition: >
    spawned_process and container
    and proc.name in (bash, sh, zsh, dash, csh)
    and not proc.pname in (docker-entrypo, supervisord)
  output: >
    Shell spawned in container
    (user=%user.name command=%proc.cmdline container=%container.name
     image=%container.image.repository)
  priority: WARNING
  tags: [container, shell, mitre_execution]

Key detection rules:

Shell spawn in non-interactive containers
Sensitive file access (/etc/shadow, /etc/passwd)
Outbound connections from unexpected containers
Privilege escalation via setuid/setgid
Container escape via mount or ptrace

Examples

bash
# Run Falco with custom rules
falco -r /etc/falco/custom_rules.yaml -o json_output=true
# Parse JSON alerts
cat /var/log/falco/alerts.json | python3 -c "import json,sys; [print(json.loads(l)['output']) for l in sys.stdin]"

Illustrative Want to see what performing-cloud-native-forensics-with-falco would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 10:33 UTC · 23 cases

Lift

+22%

26% vs 4%

Agent turns

1.0 vs 1.0

Tokens

-19%

1,447 vs 1,780.82

fail → pass · 5pass → pass · 1fail → fail · 17

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-20 We are running static vulnerability scans on container images prior to deployment using Trivy. How should we configure Falco custom rules to block vulnerable base images at build time in our CI pipeline?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When writing a quick CLI command using python3 -c to parse Falco JSON logs from standard input, which standard library modules must be imported in the script string?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Where are standard Falco alert JSON logs typically written on a Linux system when configured for local file logging in forensic investigations?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 We want to enforce ingress network traffic blocking between pods in our Kubernetes cluster at the Linux kernel packet filtering level. How do we configure Falco rules to drop non-whitelisted inbound TCP packets?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 We need to capture a full physical RAM image from a compromised Linux node for post-mortem volatile memory analysis using LiME or AVML. What Falco command line option produces a raw memory dump file of kernel memory?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 Which tag in the Falco shell detection rule maps the alert directly to the MITRE ATT&CK execution tactics category?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 When creating a Falco rule for shell processes spawned inside a container, what priority level should be assigned according to standard cloud native forensics practices, and what MITRE technique tag should be attached? Choose between priority CRITICAL, WARNING, or NOTICE, and specify the tag.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 In container forensic monitoring, why is shell spawning specifically targeted in non-interactive application containers? What condition macro combination in Falco specifies a spawned process inside a container?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We need to parse AWS CloudTrail S3 management event logs to detect unauthorized IAM role assumption across AWS accounts. How do we configure Falco custom YAML rules on Linux nodes to ingest S3 bucket CloudTrail streams directly?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When filtering out legitimate container initialization processes in a Falco shell detection rule, which Falco syntax field should be checked against parent process names, proc.name or proc.pname, and what parent name strings should be excluded?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Name two security assessment and auditing scenarios where deploying runtime detection like Falco is appropriate according to cloud native security guidance.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Which executable bit permissions on binaries represent a key privilege escalation detection rule category in Falco runtime monitoring?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When formatting the 'output' field of a Falco container shell detection rule, which Falco field placeholders should be included to identify the user, command line, container name, and container image repository? Show the output string format.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 When writing a custom Falco rule in YAML, what top-level keys are required to define the rule identifier, description, filter logic, message output, priority, and metadata tags?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I am setting up threat detection in our Kubernetes cluster and need a runtime alert configuration to flag interactive shells starting inside containers. Please supply a complete custom Falco rule in YAML format that excludes common entrypoint parent processes, along with the terminal command to run Falco using custom rule definitions and structured JSON log formatting.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 When configuring Falco detection rules for cloud native incident response, which specific sensitive Linux system files should be explicitly monitored for unauthorized container access? Provide the paths.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-10 How should outbound network detection rules in Falco be scoped to minimize false positives in microservice environments? Should they monitor all container connections equally or target unexpected outbound connections from specific non-network containers?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When setting up custom Python script parsers for Falco alert response pipelines, what minimum Python version is required for modern cloud native forensics toolchains?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 In a Falco rule designed to catch common interactive shells spawned in a container, should we check proc.name against bash, sh, zsh, dash, and csh, or should we match any process ending in 'sh'? Provide the exact proc.name check for these five shells.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 I need to execute Falco against a custom rule set stored at /etc/falco/custom_rules.yaml while ensuring the output is formatted as JSON. I was planning to pass --json-output on the command line. Provide the correct command to load the custom rules file and enable JSON output.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We store Falco alert logs at /var/log/falco/alerts.json with one JSON record per line. I want a Python one-liner shell command fed by stdin to extract and print only the 'output' string from each JSON line, rather than using jq. Provide the exact shell command pipeline using python3.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 When auditing Falco rules for container escape detection, which system call / mechanism vectors are primary indicators of a container escape attempt? Contrast mount and ptrace against network socket creation.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 When categorizing a Falco rule detecting spawned shells in containers, what set of tags should be included in the rule YAML definition?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 22 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +22 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.4%
Pass rate with the skill: 26.1%
Cases attempted: 23
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 10:33 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run26

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-40% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 56 days ago

Other measured skills in the registry, with their headline benchmark lift.