Falco Cloud Native Runtime Threat and Security Priority Event Sentinel

id: falco-runtime-security-priority-alert-sentinel
namespace: company.security

inputs:
  - id: falcosidekick_url
    type: STRING
    defaults: "http://falcosidekick.falco:2801"
    description: Base URL of Falcosidekick REST service.

tasks:
  - id: query_falco_events
    type: io.kestra.plugin.scripts.shell.Commands
    commands:
      - |
        # Query Falcosidekick health and metrics
        curl -s "{{ inputs.falcosidekick_url }}/ping" > /dev/null

        # Scrape metrics endpoint for emergency and critical priority event counters
        curl -s -f "{{ inputs.falcosidekick_url }}/metrics" > /tmp/falco_telemetry.txt

        CRITICAL_EVENTS=$(grep -E 'falco_events\{.*priority="Critical".*\}|falco_events\{.*priority="Emergency".*\}' /tmp/falco_telemetry.txt | awk '{sum+=$2} END {print sum+0}')
        echo "::set-output name=critical_events::$CRITICAL_EVENTS::"

  - id: evaluate_threat_events
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.query_falco_events.vars.critical_events | int > 0 }}"
    then:
      - id: notify_soc_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#soc-alerts",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 Falco Critical Runtime Threat Detected",
                "text": "Falco runtime security daemon detected *{{ outputs.query_falco_events.vars.critical_events }} Critical/Emergency threat events*! Potential shell spawned in container, privilege escalation, or unauthorized namespace mount detected.",
                "footer": "Kestra Security Sentinel • Falco"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#soc-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Falco Sentinel Failure",
            "text": "Failed to scrape Falcosidekick metrics endpoint. Verify Falco daemonset and sidekick status.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/10 * * * *"
    disabled: true