Runtime Security

Container Runtime Threat Detection & Falco Migration

You do not need to deploy or maintain standalone Falco agents — BlackShield's native eBPF runtime engine captures container and host threats out of the box, while also importing existing Falco JSON/NDJSON or SARIF exports while you switch.

Migration & native runtime configuration

Set BLACKSHIELD_API_URL to the API origin, such as https://api.blackshield.chaplau.com. Do not use the console dashboard URL. When migrating from an existing Falco deployment, point the collector at your exported JSONL/SARIF stream:

BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com
BLACKSHIELD_API_KEY=sp_xxx
RUNTIME_ALERTS_ENABLED=true
RUNTIME_ALERTS_FILE=/var/log/runtime_events.jsonl
RUNTIME_MAX_ALERTS_PER_SCAN=5000

Behavior

  • Captures kernel and container runtime anomalies natively or imports legacy JSON/NDJSON/SARIF event exports during migration.
  • Normalizes alerts into runtime_threat findings.
  • Preserves process, syscall, and container fields under source.extra.output_fields.
  • Publishes results through the platform ingestion API with connector telemetry.

Rollout guidance

  • Start in non-production namespaces to baseline workload behavior.
  • Set alert retention and rotation when forwarding exported event files.
  • Correlate with Kyverno and SIEM controls for preventive plus detective coverage.
Container Runtime Threat Detection & Falco Migration