Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments
Kubernetes Goat is a security training environment designed for practicing the identification and exploitation of common vulnerabilities within an intentionally insecure cluster. It provides a controlled setting to simulate system exploitations, including container escapes, role misconfigurations, and server-side requests. The project utilizes scenario-based vulnerability deployment to create specific security flaws. It includes utilities for environment management that allow the cluster to be restored to a clean baseline by removing vulnerable scenarios, service accounts, and role bindings.
Freelens is a graphical web dashboard for Kubernetes cluster administration and monitoring. It provides a centralized interface for managing container orchestration environments, featuring a log aggregator for simultaneous multi-pod log viewing, a resource visualizer for mapping system dependencies via force-directed graphs, and a security auditor for reviewing vulnerability reports and certificate expiration dates. The project integrates a generative artificial intelligence operator to automate complex administrative tasks and translate requests into cluster configurations. It further distin
Kube-hunter is a security scanner and vulnerability hunter for Kubernetes clusters. It operates as a cloud-native penetration tool designed to identify security weaknesses, infrastructure misconfigurations, and exploitable gaps by simulating attacker techniques. The tool distinguishes itself through a dual-mode scanning engine that executes both remote external probes and internal network scans. It features identity-based impersonation, allowing it to use service account tokens and pod identities to simulate security access from specific cluster roles and determine the potential blast radius
Kubernetes Security Scanner - Part of NullSec Linux
The main features of bad-antics/nullsec-k8sscan are: Kubernetes Security.
Open-source alternatives to bad-antics/nullsec-k8sscan include: falcosecurity/falco — Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and… freelensapp/freelens — Freelens is a graphical web dashboard for Kubernetes cluster administration and monitoring. It provides a centralized… madhuakula/kubernetes-goat — Kubernetes Goat is a security training environment designed for practicing the identification and exploitation of… aquasecurity/kube-hunter — Kube-hunter is a security scanner and vulnerability hunter for Kubernetes clusters. It operates as a cloud-native… clastix/capsule — Multi-tenancy and policy-based framework for Kubernetes. armosec/kubescape — Kubescape is a security platform for Kubernetes that provides tools for scanning clusters, configurations, and…