Quickstart¶

This walks you from a fresh install to seeing a real alert on the dashboard in a few minutes. It assumes you've completed Installation and all pods are Running.

1. Open the dashboard¶

kubectl port-forward -n kubesentry svc/kubesentry-collector 8080:8080

Open http://localhost:8080/dashboard. On a fresh install you'll see the trial banner (yellow) and an empty alert feed.

2. Trigger a detection¶

Falco flags suspicious runtime behavior. The classic test is spawning an interactive shell inside a running container — something you almost never do in production, which is exactly why it's a detection.

Pick any running pod and exec into it:

kubectl exec -it -n <some-namespace> <some-pod> -- /bin/sh

Type a command or two, then exit. Falco sees the shell being spawned in a container and emits an event.

3. Watch it land¶

Within about 5 seconds, the alert appears in the dashboard feed: the rule that fired, the pod and namespace, the process, and a severity. The path it took:

Falco (on the node) → Falcosidekick → collector → dashboard

If you configured email, a high-severity alert also arrives in your inbox almost immediately. Lower-severity events are rolled into the daily digest.

4. What to do next¶

Set up notifications — wire in email and webhooks so you hear about alerts without watching the dashboard. See Notifications.
Activate your license — remove the trial banner and unlock ongoing updates. See Licensing.
Tune noise — every environment has benign patterns that trip default rules. See Configuration for how to adjust.

Didn't see an alert?¶

Are all Falco pods Running? kubectl get pods -n kubesentry
Did the exec actually land in a container Falco is watching? Try a different pod.
Check the collector logs: kubectl logs -n kubesentry deploy/kubesentry-collector