Falco can be used for thread detection. Before activating Falco, please first check which Driver to use. If you know which driver should be selected, activate Falco, go to the
Values, select the
Driver and submit changes. No
Select the driver to use:
- ebpf (default)
Adjust default provided resource requests and limits for Falco and Falco Exporter.
When Falco is installed, Otomi will add a set of rules to
white-list all known behaviour. These rules are added using the Raw Values.