Anthropic-Cybersecurity-Skills/skills/detecting-container-escape-with-falco-rules/assets/template.md

Falco Container Escape Detection Runbook

Alert Triage Template

Alert Details

Field	Value
Alert Time
Rule Name
Priority
Container Name
Container Image
Pod Name
Namespace
Node
User
Process Command
MITRE Technique

Triage Steps

Immediate Actions (0-5 minutes)

• Acknowledge alert in SIEM/SOAR
• Verify alert is not a false positive (check known exceptions list)
• Identify the affected pod and node
• Check if the container is still running

Investigation (5-30 minutes)

• Capture pod spec: kubectl get pod <name> -n <ns> -o yaml
• Review container security context
• Check if container is privileged
• Review mounted volumes for host paths
• Examine process tree from Falco output
• Check for other alerts from same container/node
• Review Kubernetes audit logs for the same timeframe

Containment (if confirmed)

• Isolate pod with network policy deny-all
• Cordon affected node: kubectl cordon <node>
• Capture forensic data from container
• Kill compromised container: kubectl delete pod <name> -n <ns>
• Review other pods on same node for compromise

Recovery

• Scan node for rootkits
• Rebuild node if compromise confirmed
• Patch vulnerable container image
• Update network policies
• Uncordon node after verification

False Positive Exceptions

Container Image	Rule	Justification	Approved By	Date

Escalation Matrix

Priority	Response Time	Notify
CRITICAL	Immediate	Security On-Call + Engineering Lead
WARNING	15 minutes	Security On-Call
NOTICE	1 hour	Security Team queue
INFO	Next business day	Review in daily standup