Skill UI

Detects container escape attempts via runtime monitoring using Falco, Sysdig, and custom audit rules. Monitors syscalls, mounts, kernel modules, and Docker socket accesses so SOC teams can hunt escapes and validate detection coverage.

Falco container escape detection rules monitor syscalls, file writes, namespace access, and privileged launches to catch breakout attempts across Kubernetes or standalone containerd/Docker hosts, helping SOC analysts hunt escapes and validate monitoring coverage.

Analyzes Kubernetes pod configurations using the Python client to spot privileged containers, dangerous capabilities, host namespaces and mounts that could signal container escape attempts during audits or incident response.