Lead Image © dunord, 123RF.com

Proactive threat detection

Silent Observer

Article from ADMIN 89/2025

By Martin Loschwitz

The Falco tool promises comprehensive threat detection for Docker, Podman, and Kubernetes from network traffic streams.

Regular checks and comprehensive compliance are no longer enough to guarantee security in data centers. Because criminals are getting more savvy and their attacks are becoming increasingly complex and sophisticated, defenses need to keep pace. Proactive monitoring of network traffic has been the order of the day for some time now. Partly in the wake of AI, this approach involves identifying unusual activity from suspicious data packets in network traffic and taking preventive measures before an attacker can exploit the opportunity.

Many services of this kind are on the market, Coroot [1] being just one that has made a name for itself (Figure 1). However, this tool is currently facing some reservations, particularly among European customers, because it can only be used if you are prepared to upload comprehensive information about your own data traffic to the cloud, where the AI part of the application is located.

Figure 1: Coroot performs security analyses with AI but uploads a large volume of data to the cloud for this purpose, whereas Falco is exclusively local in this respect.

A far more down-to-earth solution by the name of Falco

...

Use Express-Checkout link below to read the full article (PDF).