PalC implements security at the platform and toolchain level - Falco syscall detection rules, Semgrep SAST in CI, Cilium network policies for Kubernetes, and Wazuh SIEM with custom detection rules for infrastructure events.
Container Runtime Security - Falco Syscall Detection
Runtime threat detection at the syscall level
Falco monitors kernel syscalls against rule sets - detecting privilege escalation, shell spawning in containers, sensitive file reads, and unexpected outbound connections before they become breaches.
# Falco rule - shell spawned inside container
- rule: Terminal shell in container
condition: evt.type in (execve) and container and shell_procs and not proc.name in (shell_binaries)
output: Shell spawned (user=%user.name container=%container.name image=%container.image.repository cmd=%proc.cmdline)
priority: Warning
ToolFalco (CNCF)LayerKernel syscallOutputSIEM / Slack / PDMITREATT&CK tagged
Hardening Automation - CIS Level 2 via Ansible
Automated CIS benchmark hardening at scale
Ansible roles apply CIS Level 2 controls idempotently - kernel parameters, SSH config hardening, auditd rules, filesystem permissions, and unnecessary service removal across the fleet, with drift detection on every run.
# Ansible - CIS kernel hardening (sysctl)
- name: CIS 5.1.1 - disable IPv6 packet forwarding
ansible.posix.sysctl:
name: net.ipv6.conf.all.forwarding
value: '0'
state: present
reload: yes
# ... more CIS controls ...FrameworkCIS Benchmark L2AutomationAnsible idempotentMACSELinux enforcingAuditauditd rules
Network Security - Cilium L7 Network Policy
Identity-aware L7 HTTP policy enforcement with eBPF
Cilium enforces network policy at L7 - allowing only specific HTTP methods and paths between labelled pods, while blocking all other traffic by default, with visibility logs for every allow and deny decision.
# CiliumNetworkPolicy - L7 HTTP enforcement
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
spec:
endpointSelector:
matchLabels:
app: api-server
egress:
- toEndpoints:
- matchLabels:
app: service-b
toPorts:
- ports:
- port: "8080"
protocol: TCP
rules:
http:
- method: GET
path: "/api/v1/.*"EngineCilium eBPFLayerL3/L4/L7IdentityLabel-basedVisibilityHubble flow logs
AppSec Pipeline - SAST + SCA in CI/CD
Shift-left security - findings block PR before merge
Semgrep SAST and Trivy SCA run on every pull request - high-severity findings fail the pipeline before code merges. Syft generates a CycloneDX SBOM attached to every release artifact.
# GitHub Actions - shift-left AppSec pipeline
- name: SAST - Semgrep
run: semgrep --config=auto --severity=ERROR --json > semgrep-results.json
- name: SCA - Trivy image scan
run: trivy image --exit-code 1 --severity HIGH,CRITICAL myregistry/app:latest
- name: SBOM - Syft CycloneDX
run: syft . -o cyclonedx-json > sbom.json
SASTSemgrep / CodeQLSCATrivy / GrypeSBOMSyft / CycloneDXGateFail on HIGH+
