A SECURE CI/CD PIPELINE USING FALCO FOR ATTACK DETECTION IN KUBERNETES

This article examines an approach to improving CI/CD pipeline security by integrating the Falco threat detection system into a Kubernetes cluster. The purpose of the work is to investigate whether standard Falco system monitoring can be extended to detect application-layer attacks and whether this verification can be incorporated into an automated pipeline. The experimental environment is built on Kubernetes deployed with Kind and includes the vulnerable OWASP Juice Shop application, an Nginx web server, and Falco. At the first stage, the basic Falco configuration confirmed its ability to register dangerous system activity, including access to the /etc/shadow file, but it did not detect a DOM XSS attack. To analyze application traffic, an Nginx log processing plugin and a specialized ruleset based on request macros and signatures were added to Falco. Testing produced alerts for SQL injection attempts, XSS attacks, path traversal, and access to the confidential /.env file. The environment was then integrated into GitHub Actions: the pipeline automatically creates an isolated cluster, deploys all components, runs test attacks, and checks Falco events. The results confirm that Falco's extensible architecture can be used for web-threat detection in DevOps workflows, while automated pre-deployment validation improves the reproducibility and controllability of security checks.