Skill UI

Provides a Falco-based runtime detection workflow that monitors syscalls, proc paths, cgroups, kernel modules, and namespace actions to catch container escape attempts in Kubernetes and Docker environments before they reach the host.

Detect container escape attempts in real time with Falco runtime rules that watch syscalls, host mounts, privileged launches, kernel modules, cgroups, and sensitive files on Kubernetes or standalone Linux hosts.

Provides a procedure to harden the Docker daemon by tightening /etc/docker/daemon.json, enforcing TLS authentication, remapping user namespaces, running rootless, and applying CIS-inspired limits to prevent privilege escalation and container escape.

Implements eBPF-powered runtime security monitoring and enforcement for Kubernetes via Cilium Tetragon, covering tracing policies, enforcement actions, CLI workflows, and integrations to detect container escapes, sensitive file access, and crypto mining attempts.

Analyzes Kubernetes pod specs to flag privileged containers, dangerous capabilities, host namespace sharing, writable hostPath mounts, and Docker socket exposures, letting security teams audit escape vectors or investigate incidents.

Provides a systematic Kubernetes penetration testing workflow covering reconnaissance, automated scanning (kube-hunter, kube-bench, Kubescape), RBAC/secret checks, and pod exploitation to validate defense posture before remediation.