poprhythm
ba925fe734
Detects unauthorized miners (and other runtime threats) via Falco's syscall/eBPF monitoring, following the 2026-08-06 gitea/xmrig compromise. Wired into netdata rather than a new notification channel: Falco exposes a Prometheus /metrics endpoint, netdata scrapes it, and a new health.d alarm pages through netdata's already-configured Telegram bot - no new alerting infra needed. Includes a custom process-name rule for known miner binaries (the stock Stratum-protocol rule wouldn't have caught the actual gitea incident, which used a bare host:port with no scheme prefix), an outbound miner-pool-port rule as a second layer, and rule_matching: all in the Falco config - without it, Falco silently drops all but the first matching rule per event, which would have suppressed our custom rule whenever a stock rule also matched the same process.
24 lines
904 B
YAML
24 lines
904 B
YAML
# Overrides merged on top of Falco's built-in default config.
|
|
# Enables the Prometheus /metrics endpoint so netdata can scrape rule-trigger
|
|
# counts and alert via the existing Telegram notifier.
|
|
webserver:
|
|
enabled: true
|
|
listen_port: 8765
|
|
k8s_healthz_endpoint: /healthz
|
|
prometheus_metrics_enabled: true
|
|
|
|
metrics:
|
|
enabled: true
|
|
interval: 15s
|
|
output_rule: true
|
|
rules_counters_enabled: true
|
|
|
|
# Falco's default is "first rule wins" per event type, for performance -
|
|
# confirmed by testing: an execve matching both the stock "Drop and execute
|
|
# new binary in container" rule AND our custom miner-detect rule only
|
|
# emitted the stock rule's alert, silently. `all` disables that
|
|
# short-circuit so every matching rule fires independently (added in
|
|
# Falco 0.36.0). Accepting the modest extra CPU cost - a security tool
|
|
# silently dropping the alert it exists to send is worse.
|
|
rule_matching: all
|