A SECURE PRE-DEPLOYMENT CI CHECK USING FALCO FOR ATTACK DETECTION IN KUBERNETES

This article examines an approach to improving the security of a pre-deployment CI check by integrating the Falco threat detection system into a Kubernetes cluster. The relevance of the study is determined by the growing number of attacks against containerized web applications and the need to identify suspicious activity not only at the system call level, but also at the application interaction level. The main problem is that the standard Falco configuration is primarily focused on monitoring actions inside containers and on the host system; therefore, its capabilities are insufficient for detecting web attacks such as SQL injections, XSS, path traversal, and attempts to access sensitive files. To solve this problem, the article proposes extending Falco functionality by using a custom plugin for analyzing Nginx logs and specialized detection rules. During the study, an experimental Kubernetes-based environment was developed, including the vulnerable OWASP Juice Shop web application, the Nginx web server, and the Falco monitoring system. In addition, an automated CI check based on GitHub Actions was implemented to deploy the test environment and verify the correctness of the configured rules. The obtained results show that the proposed approach makes it possible to detect various types of web attacks in real time and can be used as an element for improving the security of DevOps processes when operating containerized applications.