Falco — NovaPay Security Dashboard

Resumen 24h

2026-06-17 14:47 → 2026-06-18 14:47 UTC

Critical

↑ +2 vs ayer

Error

↑ +4 vs ayer

Warning

↓ −6 vs ayer

Alertas totales

Últimas 24h

Rules activas

128

↑ +7 custom

Falco version

0.39.2

eBPF modern_ebpf

🚨 Alertas recientes — Últimas 24h

61 eventos

Timestamp	Priority	Rule	Container	Namespace	MITRE
14:31:22	● CRITICAL	Crypto Mining Detected	`payments-worker-7d4f`	payments	T1496
13:58:07	● CRITICAL	Privilege Escalation via setuid	`reconciler-v2-3c9a`	data-pipeline	T1068
12:14:43	● ERROR	Read Sensitive File	`api-gateway-9bk2`	auth	T1003
11:47:19	● ERROR	Read Sensitive File	`auth-service-m1p4`	auth	T1003
10:22:51	● WARNING	Shell Spawned in Container	`kafka-consumer-8xz1`	data-pipeline	T1059
09:15:34	● WARNING	Unexpected Outbound Connection	`payments-worker-7d4f`	payments	T1048
08:03:12	● CRITICAL	Crypto Mining Detected	`payments-worker-7d4f`	payments	T1496
07:44:02	● ERROR	K8s ServiceAccount Token Read	`reconciler-v2-3c9a`	data-pipeline	T1528
06:29:48	● WARNING	Shell Spawned in Container	`redis-master-0`	infra	T1059
05:11:27	● WARNING	Unexpected Outbound Connection	`api-gateway-9bk2`	auth	T1048
03:58:14	● ERROR	Read Sensitive File	`payments-worker-7d4f`	payments	T1003
01:22:09	● WARNING	Shell Spawned in Container	`api-gateway-9bk2`	auth	T1059

📊 Distribución por tipo

Critical

(4.9%)

Error

(18%)

Warning

(77%)

🗺 Alertas por Namespace

payments

22 pods

2 critical

auth

18 pods

5 error

data-pipeline

27 pods

1 critical

infra

17 pods

warnings only

📈 Timeline de alertas (24h por hora)

horas UTC

00:0003:0006:0009:00 12:0015:0018:0021:0024:00

Critical Error Warning Sin alertas

Incidentes destacados

CRITICAL

08:03 UTC xmrig detectado en payments-worker — PagerDuty alertado, pod aislado

CRITICAL

13:58 UTC Escalada de privilegios en reconciler-v2 via setuid — IR iniciado

ERROR

07:44 UTC Lectura de ServiceAccount token en data-pipeline — revisión de RBAC recomendada

📋 Reglas personalizadas NovaPay

7 custom · 121 default

Shell Spawned in Container

Shell no autorizada (bash/sh/zsh) ejecutada dentro de contenedor en produccion.

WARNING T1059 mitre_execution

Read Sensitive File

Acceso a /etc/shadow, /etc/passwd, .ssh/id_rsa o ServiceAccount token.

ERROR T1003 mitre_credential_access

Unexpected Outbound Connection

Conexion saliente a IP fuera de allowlist (excluye api.stripe.com, sendgrid).

WARNING T1048 mitre_exfiltration

Crypto Mining Detected

Proceso xmrig/minerd o conexion a pool stratum+tcp detectada en contenedor.

CRITICAL T1496 mitre_resource_hijacking

Privilege Escalation via setuid

Proceso user!=0 obteniendo UID=0 via setuid binario en contenedor.

CRITICAL T1068 mitre_privilege_escalation

🔗 Integraciones (Falcosidekick)

3 outputs activos

📱

Slack — #security-alerts

minimumpriority: warning · NovaPay workspace

ACTIVO

🚒

PagerDuty — SEC-NOVAPAY

minimumpriority: critical · auto-escalate P1

ACTIVO

🔍

Elasticsearch SIEM

es.novapay.internal:9200 · index: falco-alerts

ACTIVO

Estado del Driver

Driver

modern_ebpf

Kernel

6.1.58-gke

Nodos monitorizados

12 / 12

Overhead CPU

0.3%

⚙️ Instalacion NovaPay — Helm

GKE 1.29 · modern_ebpf

# 1. Agregar repo Falco
helm repo add falcosecurity \
  https://falcosecurity.github.io/charts
helm repo update

# 2. Instalar Falco en novapay-prod
helm install falco falcosecurity/falco \
  --namespace falco --create-namespace \
  --set driver.kind=modern_ebpf \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.slack.webhookurl="${SLACK_WEBHOOK}" \
  --set falcosidekick.config.slack.minimumpriority="warning" \
  --set falcosidekick.config.pagerduty.routingKey="${PD_KEY}" \
  --set falcosidekick.config.pagerduty.minimumpriority="critical" \
  --set falcosidekick.config.elasticsearch.hostPort="${ES_HOST}" \
  --set falcosidekick.config.elasticsearch.index="falco-alerts" \
  -f falco_rules.local.yaml

# 3. Verificar
kubectl get pods -n falco
kubectl logs -n falco -l app=falco --tail=50
        

✓ Falco v0.39.2 running · 12/12 nodes · eBPF probes loaded · Falcosidekick healthy

⚠ payments-worker: 2 CRITICAL activos — Incident Response en curso (P1)