> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ahmadraza.in/llms.txt
> Use this file to discover all available pages before exploring further.

# FALCO X

# Falco + Prometheus + Grafana Setup on Minikube

This guide walks through setting up Falco for runtime security monitoring in a Minikube cluster, exporting Falco alerts to Prometheus, and visualizing them in Grafana. It includes steps to verify functionality using Falco's event generator.

***

## Prerequisites

* Minikube cluster up and running
* Helm installed
* `kubectl` configured to use Minikube context

***

## 1. Install Falco with gRPC and gRPC Output Enabled

```bash theme={null}
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update

helm upgrade --install falco falcosecurity/falco \
  --set falco.grpc.enabled=true \
  --set falco.grpc_output.enabled=true \
  --set falco.grpc.unixSocketPath=/run/falco/falco.sock
```

***

## 2. Install Falco Exporter (anyone)

```bash theme={null}
helm install falco-exporter falcosecurity/falco-exporter
---
kubectl apply -f https://raw.githubusercontent.com/falcosecurity/falco-exporter/main/deploy/kubernetes/falco-exporter.yaml
```

Make sure the exporter can access the Falco socket. If not, deploy exporter as a sidecar or mount `/run/falco` using a `hostPath` volume.

***

## 3. Verify Falco Exporter Metrics

```bash theme={null}
kubectl port-forward svc/falco-exporter 9376:9376
curl http://localhost:9376/metrics
```

You should see Prometheus-formatted metrics like `falco_alerts_total{...}`.

***

## 4. Install Prometheus

```bash theme={null}
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

helm upgrade --install prometheus prometheus-community/prometheus
```

***

## 5. Configure Prometheus to Scrape Falco Exporter (optional)

Patch the Prometheus config:

```bash theme={null}
kubectl edit configmap prometheus-server
```

Add under `scrape_configs:`:

```yaml theme={null}
  - job_name: 'falco'
    static_configs:
      - targets: ['falco-exporter:9376']
```

Then restart Prometheus:

```bash theme={null}
kubectl delete pod -l app=prometheus,component=server
```

***

## 6. Install Grafana

```bash theme={null}
helm install grafana grafana/grafana
kubectl get secret --namespace default grafana -o jsonpath="{.data.admin-password}" | base64 --decode ; echo
```

Expose Grafana:

```bash theme={null}
kubectl port-forward svc/grafana 3000:80
```

Login: `admin / admin`

***

## 7. Connect Grafana to Prometheus

1. Go to **Settings → Data Sources → Add data source**
2. Choose **Prometheus**
3. Set URL: `http://prometheus-server.default.svc.cluster.local`
4. Click **Save & Test**

***

## 8. Import Falco Dashboard

1. Go to **Dashboards → Import**
2. Use Dashboard ID: `11914` & `15310` (per-pod-filter)
3. Select Prometheus as data source
4. Click **Import**

***

## 9. Test with Falco Event Generator

Run a test event generator:

```bash theme={null}
docker run -it --rm falcosecurity/event-generator run syscall --loop
```

Within moments, Falco will detect the syscalls and trigger alerts. These alerts-metrics will appear in Prometheus and Grafana.

> \[IMP]
> If needed more Details of Logs We can add Loki which collect the logs of falco pod or use `falco-sidekick` ([https://github.com/falcosecurity/falcosidekick](https://github.com/falcosecurity/falcosidekick)) for more robust metrics and detailed view in dashboard.

***

## ✅ Completed Setup

You now have a full Falco security monitoring stack running on Minikube, integrated with Prometheus and Grafana for real-time alerting and visualization.