Trivy, Falco und Kubescape im Vergleich

# Trivy installieren (Linux/macOS)
brew install trivy
# oder
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# Container-Image scannen
trivy image nginx:1.25
trivy image --severity HIGH,CRITICAL registry.example.com/myapp:v2.1

# Nur fixbare Vulnerabilities anzeigen
trivy image --ignore-unfixed --severity HIGH,CRITICAL nginx:1.25

# Filesystem scannen (z.B. im CI)
trivy fs --security-checks vuln,secret,misconfig ./

# Kubernetes-Manifest pruefen
trivy config ./k8s-manifests/

# Trivy Operator installieren
helm repo add aquasecurity https://aquasecurity.github.io/helm-charts/
helm repo update

helm install trivy-operator aquasecurity/trivy-operator \
  --namespace trivy-system \
  --create-namespace \
  --set trivy.severity=CRITICAL,HIGH,MEDIUM \
  --set trivy.ignoreUnfixed=true \
  --set operator.scanJobTimeout=10m

# Vulnerability Reports abfragen
kubectl get vulnerabilityreports -A

# Details fuer ein bestimmtes Image
kubectl get vulnerabilityreport -n production \
  -l trivy-operator.resource.name=my-app \
  -o jsonpath='{.items[0].report.summary}'

# .gitlab-ci.yml (Auszug)
security-scan:
  stage: test
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 1 --severity CRITICAL ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA}
    - trivy fs --exit-code 1 --severity HIGH,CRITICAL --security-checks secret .
  allow_failure: false

# Falco via Helm installieren
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update

helm install falco falcosecurity/falco \
  --namespace falco-system \
  --create-namespace \
  --set falco.jsonOutput=true \
  --set falco.httpOutput.enabled=true \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.slack.webhookurl="https://hooks.slack.com/YOUR/WEBHOOK"

# custom-falco-rules.yaml
customRules:
  custom-rules.yaml: |-
    # Shell in Produktions-Container erkennen
    - rule: Shell in Production Container
      desc: Jemand hat eine Shell in einem Produktions-Container geoeffnet
      condition: >
        spawned_process
        and container
        and proc.name in (bash, sh, zsh, ash)
        and k8s.ns.name = "production"
      output: >
        Shell geoeffnet in Produktions-Container
        (user=%user.name pod=%k8s.pod.name ns=%k8s.ns.name cmd=%proc.cmdline)
      priority: CRITICAL
      tags: [container, shell, mitre_execution]

    # Sensitive Dateien lesen
    - rule: Read Sensitive Files
      desc: Zugriff auf sensitive Dateien wie /etc/shadow oder private Keys
      condition: >
        open_read
        and container
        and (fd.name startswith /etc/shadow
             or fd.name startswith /root/.ssh
             or fd.name contains id_rsa)
      output: >
        Sensitive Datei gelesen
        (user=%user.name file=%fd.name pod=%k8s.pod.name)
      priority: WARNING
      tags: [container, filesystem, mitre_credential_access]

    # Unerwartete ausgehende Verbindung
    - rule: Unexpected Outbound Connection
      desc: Container stellt Verbindung zu unbekannter externer IP her
      condition: >
        outbound
        and container
        and not fd.rip in (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
        and not k8s.ns.name in (kube-system, monitoring)
      output: >
        Unerwartete ausgehende Verbindung
        (pod=%k8s.pod.name ns=%k8s.ns.name remote=%fd.rip:%fd.rport)
      priority: WARNING
      tags: [container, network, mitre_command_and_control]

helm upgrade falco falcosecurity/falco \
  --namespace falco-system \
  -f custom-falco-rules.yaml

# Letzte Events aus den Falco-Logs
kubectl -n falco-system logs -l app.kubernetes.io/name=falco --tail=50

# Oder ueber Falcosidekick UI (falls aktiviert)
kubectl -n falco-system port-forward svc/falco-falcosidekick-ui 2802:2802

# Kubescape installieren
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | bash

# Cluster gegen NSA/CISA Framework scannen
kubescape scan framework nsa

# CIS Benchmark
kubescape scan framework cis-v1.23-t1.0.1

# Einzelnes Manifest scannen
kubescape scan ./k8s-manifests/deployment.yaml

# Nur einen Namespace pruefen
kubescape scan framework nsa --include-namespaces production

# Ergebnis als JSON exportieren (fuer CI/CD)
kubescape scan framework nsa --format json --output results.json

# Kubescape Operator installieren
helm repo add kubescape https://kubescape.github.io/helm-charts/
helm repo update

helm install kubescape kubescape/kubescape-operator \
  --namespace kubescape \
  --create-namespace \
  --set clusterName=production-cluster

# GitHub Actions Beispiel
- name: Kubescape Scan
  uses: kubescape/github-action@v3
  with:
    format: sarif
    outputFile: kubescape-results.sarif
    frameworks: nsa,mitre
    severityThreshold: high
    failedThreshold: 0

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: kubescape-results.sarif

Developer Commit
       |
       v
  +---------+
  |  CI/CD  |
  +---------+
       |
  +----v----+     +----------+
  |  Trivy  |--*/}| Image    |  Bricht ab bei CRITICAL CVEs
  |  Scan   |     | Registry |
  +---------+     +----------+
       |
  +----v-------+
  | Kubescape  |  Prueft Manifest gegen NSA/CIS
  | Scan       |
  +------------+
       |
       v
  +---------+
  | Deploy  |
  +---------+
       |
       v
  +----------+
  |  Falco   |  Ueberwacht Runtime-Verhalten
  | (always) |
  +----------+
       |
       v
  +--------------+
  | Alertmanager |  Slack, PagerDuty, etc.
  +--------------+

# security-prometheus-rules.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: security-scanning-alerts
  namespace: monitoring
  labels:
    release: monitoring
spec:
  groups:
    - name: security-scanning
      rules:
        - alert: CriticalVulnerabilityFound
          expr: trivy_image_vulnerabilities{severity="Critical"} > 0
          for: 10m
          labels:
            severity: critical
          annotations:
            summary: "Kritische Vulnerability in {{ $labels.image_repository }}:{{ $labels.image_tag }}"
            description: "{{ $value }} kritische CVEs gefunden. Sofortige Aktualisierung empfohlen."

        - alert: FalcoCriticalEvent
          expr: rate(falco_events{priority="Critical"}[5m]) > 0
          for: 1m
          labels:
            severity: critical
          annotations:
            summary: "Falco Critical Event: {{ $labels.rule }}"
            description: "Kritisches Security-Event in Namespace {{ $labels.k8s_ns_name }}"

        - alert: ComplianceDrift
          expr: kubescape_compliance_score < 70
          for: 1h
          labels:
            severity: warning
          annotations:
            summary: "Compliance-Score unter 70% fuer Framework {{ $labels.framework }}"

# secure-pod-template.yaml
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: registry.example.com/myapp:v1.0
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 500m
          memory: 256Mi