In this hands-on workshop, we dive into the unique security challenges of containerised environments and how to detect threats effectively at the container and host level. We’ll explore common attack paths and misconfigurations in containerised infrastructure—like privilege escalation/breakout attempts, unauthorized access to resources and misuse of container runtimes—and how these differ from traditional host-based threats.

You’ll learn how to write practical detection rules tailored to containers, using audit policies, custom Sigma rules or by leveraging existing Falco rules, to spot suspicious behaviour in real-time. We’ll walk through real-world examples and discuss how to interpret alerts in the context of container operations.

By the end of this session, you’ll understand:
• Why investigations in containerized systems require a different mindset and approach
• How to incorporate these practices into your existing detection and response workflow
• The key security issues and attack vectors in containerized environments
• How to write and tune detections for some of the container-specific activity

This workshop is ideal for SOC analysts, detection engineers, and security practitioners who want to enhance their visibility and response capabilities in container-first infrastructures.