poprhythm
ba925fe734
Detects unauthorized miners (and other runtime threats) via Falco's syscall/eBPF monitoring, following the 2026-08-06 gitea/xmrig compromise. Wired into netdata rather than a new notification channel: Falco exposes a Prometheus /metrics endpoint, netdata scrapes it, and a new health.d alarm pages through netdata's already-configured Telegram bot - no new alerting infra needed. Includes a custom process-name rule for known miner binaries (the stock Stratum-protocol rule wouldn't have caught the actual gitea incident, which used a bare host:port with no scheme prefix), an outbound miner-pool-port rule as a second layer, and rule_matching: all in the Falco config - without it, Falco silently drops all but the first matching rule per event, which would have suppressed our custom rule whenever a stock rule also matched the same process.
35 lines
1003 B
YAML
35 lines
1003 B
YAML
networks:
|
|
default:
|
|
# Falco's own default bridge network, plus netdata's network so netdata
|
|
# can scrape http://falco:8765/metrics by container name.
|
|
netdata_default:
|
|
external: true
|
|
|
|
services:
|
|
falco:
|
|
image: falcosecurity/falco:0.44.1
|
|
container_name: falco
|
|
restart: always
|
|
cap_drop:
|
|
- all
|
|
cap_add:
|
|
- sys_admin
|
|
- sys_resource
|
|
- sys_ptrace
|
|
security_opt:
|
|
- apparmor:unconfined
|
|
networks:
|
|
- default
|
|
- netdata_default
|
|
ports:
|
|
- "127.0.0.1:8765:8765"
|
|
volumes:
|
|
- /sys/kernel/tracing:/sys/kernel/tracing:ro
|
|
- /var/run/docker.sock:/host/var/run/docker.sock:ro
|
|
- /proc:/host/proc:ro
|
|
- /etc:/host/etc:ro
|
|
- ./config/falco.yaml:/etc/falco/config.d/telemetry.yaml:ro
|
|
- ./rules/miner-detect.yaml:/etc/falco/rules.d/miner-detect.yaml:ro
|
|
- ./rules/miner-pool-ports.yaml:/etc/falco/rules.d/miner-pool-ports.yaml:ro
|
|
- ./rules/tune-noise.yaml:/etc/falco/rules.d/tune-noise.yaml:ro
|