‍Sysdig, a leader in Cloud-Native Application Protection Platforms (CNAPP), provides organizations with end-to-end visibility across runtime, compliance, and vulnerability management. Falco, the CNCF-graduated open-source project, is a robust security tool for Kubernetes. Headquartered in San Francisco, Sysdig’s innovative offerings are trusted by businesses globally to secure cloud-native applications. 

Nigel Douglas, Senior Cloud Security Strategist at Sysdig and key community advocate for Falco, champions its adoption through education and enablement initiatives like hands-on workshops.

Challenge

"With Instruqt, users get the right environment, one that’s supported for installation, and they see the value of the technology early on, which is so important for engagement." – Nigel Douglas, Senior Cloud Security Strategist at Sysdig

Sysdig looked to host an engaging and informative workshop at KubeCon + CloudNativeCon North America 2024 in Salt Lake City, UT, USA about Kubernetes threat detection using Falco to an audience with varying levels of expertise. This required delivering an immersive experience that catered to beginners while maintaining technical depth to satisfy advanced users. The challenge was compounded by the need for a scalable solution that minimized the typical hurdles associated with setting up hands-on workshops. Requirements included:

• Beginner-friendly approach: Workshop content needed to balance foundational knowledge with advanced concepts, ensuring both newcomers and experienced users could fully engage.‍
• Hands-on threat detection: Attendees needed an interactive environment to test default Falco rules, create their own rules, and analyze Kubernetes system calls effectively.‍
• Consistency for participants: A uniform environment was critical to eliminate issues caused by misconfigurations or differing skill levels, ensuring every participant could focus on learning.‍
• Post-workshop engagement: Sysdig wanted attendees to revisit the labs to reinforce their knowledge and explore new concepts at their own pace, extending the session’s value.‍
• Scalability for future labs: This workshop was envisioned as the first step toward a broader series of labs for the Falco community, requiring a platform capable of supporting this vision.

Solution

"Instruqt really allowed us to create a safe, constructed process where users were able to copy and paste the commands, but also had the flexibility to run something arbitrary and really break their environment." – Nigel Douglas, Senior Cloud Security Strategist at Sysdig

Sysdig leveraged Instruqt’s interactive platform to create a seamless, scalable, and highly engaging workshop experience at KubeCon. The team carefully created an environment that prioritized hands-on learning, flexibility, and ease of use, ensuring every participant gained practical knowledge of Falco’s capabilities.

• Pre-configured lab environments: Instruqt provided a ready-to-use Kubernetes environment, eliminating time-intensive setups and ensuring participants could dive straight into the hands-on exercises.‍
• Curated learning tracks: Tracks were divided into two sections: exploring Falco’s default rules and creating customized rules. Step-by-step guidance kept users on track while allowing room for experimentation.
• ‍Safe exploratory design: The workshop encouraged attendees to experiment and make mistakes, fostering a deep understanding of Falco’s functionality without risking their progress.‍
• Post-event accessibility: Participants could revisit the labs at a later time, enabling asynchronous learning and ensuring the workshop’s impact extended far beyond KubeCon.‍
• Feedback and analytics: Detailed metrics from Instruqt helped Sysdig refine future lab content, addressing pain points and tailoring tracks to maximize participant engagement.

Results

"The nice thing about Instruqt is that people could go back to a previous track or revisit the session later, getting the same consistent experience, which is invaluable for ongoing learning." – Nigel Douglas, Senior Cloud Security Strategist at Sysdig

Sysdig achieved positive outcomes from their workshop at KubeCon, validating the effectiveness of hands-on learning and paving the way for future initiatives. The workshop not only showcased Falco’s capabilities but also deepened participant engagement with Kubernetes security.

• Strong engagement: The session attracted 88+ participants who actively completed hands-on exercises, leaving with a strong understanding of Kubernetes threat detection.‍
• Extended learning: Instruqt’s accessibility allowed participants to revisit the labs, reinforcing concepts and enabling further exploration beyond the workshop.‍
• Improved retention: Feedback and completion metrics revealed key opportunities for optimizing the content, ensuring future workshops deliver even greater value.‍
• Community growth: The hands-on approach sparked increased interest in Falco, fostering stronger community engagement and encouraging ongoing exploration of Kubernetes security.‍
• Scalability proven: The workshop demonstrated Instruqt’s scalability, giving Sysdig a reliable platform to expand its educational initiatives and develop advanced labs for the Falco community.

Outlook

Sysdig plans to expand its use of Instruqt by creating additional labs for intermediate and advanced users within the Falco community. Future initiatives include leveraging Instruqt to host targeted workshops and embedding hands-on content directly into falco.org to foster continuous learning.

‍Check out Sysdig’s upcoming hands-on workshops here, and learn more about Falco here.