Skip to content

Quickstart

This walks you from a fresh install to seeing a real alert on the dashboard in a few minutes. It assumes you've completed Installation and all pods are Running.

1. Open the dashboard

kubectl port-forward -n kubesentry svc/kubesentry-collector 8080:8080

Open http://localhost:8080/dashboard. On a fresh install you'll see the trial banner (yellow) and an empty alert feed.

2. Trigger a detection

Falco flags suspicious runtime behavior. The classic test is spawning an interactive shell inside a running container — something you almost never do in production, which is exactly why it's a detection.

Pick any running pod and exec into it:

kubectl exec -it -n <some-namespace> <some-pod> -- /bin/sh

Type a command or two, then exit. Falco sees the shell being spawned in a container and emits an event.

The -it matters

The terminal-shell rule requires an attached TTY. kubectl exec <pod> -- <cmd> without -it won't fire it — that's how most tooling execs, so flagging it would be pure noise.

3. Watch it land

Within about 5 seconds, the alert appears in the dashboard feed: the rule that fired, the pod and namespace, the process, and a severity. The path it took:

Falco (on the node) → Falcosidekick → collector → dashboard

This one lands at Warning severity, so it shows on the dashboard and in the daily digest but doesn't page you — instant notifications are reserved for Critical alerts. To prove your email or Slack wiring end to end, use the Critical trigger in Verify your installation.

4. What to do next

  • Prove the whole path works — a repeatable check with a throwaway pod, including what fires and what deliberately doesn't. See Verify your installation.
  • See what's detected — the full curated ruleset with severities and triggers. See What KubeSentry detects.
  • Set up notifications — wire in email and webhooks so you hear about alerts without watching the dashboard. See Notifications.
  • Activate your license — remove the trial banner and unlock ongoing updates. See Licensing.
  • Tune noise — every environment has benign patterns that trip default rules. See Configuration for how to adjust.

Didn't see an alert?

  • Are all Falco pods Running? kubectl get pods -n kubesentry
  • Did the exec actually land in a container Falco is watching? Try a different pod.
  • Check the collector logs: kubectl logs -n kubesentry deploy/kubesentry-collector

More in Troubleshooting.