Falco topics
12 short topics in Security Operations and Infrastructure Defense. Each one is a single focused exercise with a clear piece of evidence at the end.
12 topics, one exercise each.
Work through them in order, or jump to the one you need.
These are draft topic outlines (draft; instructor review pending). Full lessons follow after review; ask Ajay if you need a topic sooner.
- 01
Runtime event sources
Inspect evidence for runtime event sources in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 02
Process and identity context
Inspect evidence for process and identity context in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 03
File and network activity signals
Inspect evidence for file and network activity signals in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 04
Detection-rule representation
Inspect evidence for detection-rule representation in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 05
Event filtering and noise control
Inspect evidence for event filtering and noise control in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 06
Workload metadata correlation
Inspect evidence for workload metadata correlation in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 07
Privilege and exposure evidence
Inspect evidence for privilege and exposure evidence in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 08
Alert routing and escalation
Inspect evidence for alert routing and escalation in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 09
Detection performance budgets
Inspect evidence for detection performance budgets in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 10
Sensitive-event data handling
Inspect evidence for sensitive-event data handling in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 11
Synthetic detection tests
Inspect evidence for synthetic detection tests in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course → - 12
Incident investigation integration
Inspect evidence for incident investigation integration in Falco; explain the diagnosis and verify a proposed correction in a lab. Keep the exercise bounded and record the behavior supported by the chosen version.
Open micro-course →
Learn the same ideas beyond Falco.
These courses share topics with this one, so you can compare how each language or tool handles the same concept.
More in Security identity and secrets.
You have the curiosity.
Let’s turn it into capability.
Start with a practical workshop or bring a specific question to Ajay.