kubesentry
Available now · 7-day free trial

Catch threats in your
Kubernetes cluster
before they catch you.

Kernel-level runtime threat detection built on Falco, running entirely in your own cluster. No phone-home, no telemetry — nothing leaves except the alerts you tell it to send, to the destinations you pick.

⎈ Helm install 🔒 Self-hosted ⚡ Kernel-level (eBPF) 💾 Perpetual license 🔧 No phone home
install
$ helm repo add kubesentry https://charts.kubesentry.io $ helm repo update $ helm install kubesentry kubesentry/kubesentry \ $ --namespace kubesentry --create-namespace
Start free trial → Read the docs

Installs in minutes · full product for 7 days · no credit card

live
Critical +1
2
High +3
5
Medium −4
12
Suppressed dedup
847

Recent alerts — last 24h

⌘ K
Severity Rule ×
CRIT Reverse shell in container 1
CRIT Crypto mining process detected 3
HIGH Privileged container started 1
HIGH Sensitive file accessed 6
HIGH RBAC role modified 1
MED Unusual outbound connection 2
MED Container drift detected 1
// how it works

From helm install to first alert in under 5 minutes.

01 install
$ helm install kubesentry \
    kubesentry/kubesentry

One-command install

Falco + collector + dashboard + alerter — all deployed via one Helm chart, on any cluster running a kernel Falco supports.

02 detect
Reverse shell in pod/payments-api
Crypto miner process
Privileged container started

Curated rules

14 KubeSentry rules tuned for low false positives — crypto miners, reverse shells, privilege escalation, lateral movement — running on top of Falco's default ruleset.

03 alert
→ Slack
→ Email digest
→ Discord / Teams
→ Custom webhook

Actionable alerts

Critical events fire instantly. Daily digests roll up the noise. All 14 KubeSentry rules — plus 8 of Falco's most common defaults — ship with triage steps, remediation commands, and a MITRE ATT&CK reference.

// what an alert looks like

Falco tells you what happened.
KubeSentry tells you what to do.

The grey block in each card is the raw Falco event — that's what a bare Falco install gives you, at 3am, with no context. Everything around it is KubeSentry: the fields resolved to a pod you recognise, what the detection actually means, how to triage it, and the exact commands to shut it down.

Slack · Block Kit instant
KubeSentry Alerts App 3:55 PM

KubeSentry: Sudoers or passwd modified in container

Priority:
Critical
Cluster:
production-eu
Pod:
payments-api-7d8f
Namespace:
prod
Container:
e263ccbef60c
Image:
ghcr.io/acme/payments-api 
13:55:11.144843182: Critical Sensitive auth file opened for writing (file=/etc/passwd command=sh -c echo 'svc:x:0:0::/root:/bin/sh' >> /etc/passwd process=sh pod=payments-api-7d8f ns=prod container=e263ccbef60c) container_id=e263ccbef60c container_name=payments-api container_image_repository=ghcr.io/acme/payments-api container_image_tag=1.24.0 k8s_pod_name=payments-api-7d8f k8s_ns_name=prod
Fix:
  • kubectl delete pod -n <ns> <pod> --grace-period=0 --force
  • Rotate any credentials the pod could access; set readOnlyRootFilesystem: true
View in dashboard
KubeSentry · cluster production-eu
Email · HTML instant + daily digest
KubeSentry
production-eu
Critical

KubeSentry: Sudoers or passwd modified in container 

13:55:11.144843182: Critical Sensitive auth file opened for writing (file=/etc/passwd command=sh -c echo 'svc:x:0:0::/root:/bin/sh' >> /etc/passwd process=sh pod=payments-api-7d8f ns=prod container=e263ccbef60c) container_id=e263ccbef60c container_name=payments-api container_image_repository=ghcr.io/acme/payments-api container_image_tag=1.24.0 k8s_pod_name=payments-api-7d8f k8s_ns_name=prod
Pod
payments-api-7d8f
Namespace
prod
Container
e263ccbef60c
Image
ghcr.io/acme/payments-api
Time
2026-07-27 13:55:11 UTC

What it means

A process opened /etc/passwd, /etc/shadow, or /etc/sudoers for writing inside a container — a direct attempt to create accounts or escalate privileges.

Triage

  1. 1. This is almost never legitimate at runtime; identify the writing process (proc.cmdline).
  2. 2. Check for new users/sudo entries: kubectl exec -n <ns> <pod> -- cat /etc/passwd /etc/sudoers
  3. 3. Correlate with other alerts from the same pod (recon, reverse shell).

Fix

kubectl delete pod -n <ns> <pod> --grace-period=0 --force
Rotate any credentials the pod could access; set readOnlyRootFilesystem: true

References

https://attack.mitre.org/techniques/T1136/

You're getting this because Critical alerts go to your inbox.
Delivered to: Slack Email Discord Teams Custom webhook

Set a URL and the channel turns on — Discord and Teams get their own native payloads, not a lowest-common-denominator fallback, and the custom webhook gets the whole alert as raw JSON. Instant alerts fan out to every channel you've configured, in parallel; the daily digest is email-only.

All 14 KubeSentry rules — plus 8 of Falco's most common defaults — ship with triage steps, remediation commands, and a MITRE ATT&CK reference, delivered in the alert itself rather than buried in a runbook.

// what gets installed

Everything runs inside your cluster.

One Helm chart installs a Falco DaemonSet on every node, a router, and a single collector Deployment — that's every pod you'll see. Detection, storage, and the dashboard never talk to us. The only thing that ever leaves is an alert you explicitly configured, going to a destination you picked.

your cluster · your infrastructure
node-1 node
payments-api redis
falco
eBPF · reads the kernel
node-2 node
web worker
falco
eBPF · reads the kernel
node-3 node
api-gateway
falco
eBPF · reads the kernel

DaemonSet — one Falco pod per node, privileged, watching syscalls

falcosidekick
routes Falco's output to the collector
collector deployment
aggregate
events from every node land in one place
deduplicate
a crashlooping exploit becomes one alert, not 900
store
SQLite on a PersistentVolume in your cluster
dashboard
Served by the collector. Reach it with kubectl port-forward — not exposed by default.
notifier
Instant on critical, daily digest for the rest. Off until you configure it.
outside your cluster
Email Slack Discord Teams Custom webhook

This is the only thing that ever leaves. If you turn notifications on, the alert goes to the destination you configured — and nowhere else. There is no KubeSentry server in the picture: no telemetry, no phone-home, not even for licensing, which is verified offline against a key compiled into the binary. Air-gap the cluster and everything except these notifications still works.

// why kubesentry

Enterprise security
at enterprise prices.
for €99.

Datadog. Sysdig. Aqua. Built for enterprises with security teams, and sold as subscriptions metered by how much you run — for as long as you run it. KubeSentry is built for the rest of us: the five-to-fifty-person engineering org with real clusters and nobody whose full-time job is security.

You pay once. It runs in your cluster. Nobody meters your hosts.

// pricing

Pay once. Own it.

One-time payment. Yours forever. Every tier includes all future updates — no subscription, no renewals, ever.

7-day free trial · no credit card

Solo

Individuals and very small clusters.

€99 once

perpetual license

Licensed for 1 cluster
  • Full dashboard + alerting
  • Curated ruleset + remediation advice
  • Email, Slack, Discord, Teams
  • All future updates, forever
Buy Solo
most popular

Team

Small teams running a handful of clusters.

€299 once

perpetual license

Licensed for 5 clusters
  • Full dashboard + alerting
  • Curated ruleset + remediation advice
  • Email, Slack, Discord, Teams
  • All future updates, forever
Buy Team

Pro

Larger deployments.

€499 once

perpetual license

Licensed for unlimited clusters
  • Full dashboard + alerting
  • Curated ruleset + remediation advice
  • Email, Slack, Discord, Teams
  • All future updates, forever
Buy Pro

Cluster counts are licence terms, not technical limits. Nothing in the collector checks how many clusters you run — enforcing that would mean phoning home, and we promise never to. So we trust you to buy the tier that fits, and you get to verify that promise by reading the code.

Checkout and invoicing are handled by Lemon Squeezy (our merchant of record); VAT is calculated at checkout. Your license key is emailed to you automatically right after purchase — apply it with --set license=…. Don't want to buy yet? Install and run the 7-day trial first; it's the full product.

// questions

You probably want to know.

Is this just a Falco wrapper? +
Falco is the engine — open source, world-class, and free. KubeSentry is the experience around it: a curated ruleset tuned for low false positives, smart deduplication, a clean dashboard, email digests, multi-channel alerting, and triage + remediation guidance attached to every KubeSentry rule. Think of it as 'managed Falco you actually self-host.'
Is this a subscription? +
No. Pay once, use forever — including all future updates. There is no renewal, no maintenance window, and no recurring charge of any kind. Your license is perpetual: it never expires, on any version.
Is the cluster count enforced? +
No. It's a licence term, not a technical limit — nothing in the collector counts your clusters, and a Solo key works anywhere you paste it. Enforcing it would mean every install reporting back to us, which is exactly the telemetry we promise never to send. You can verify that in the source. We'd rather trust you and keep the promise than police the count and break it.
Does it phone home? +
No. There is no KubeSentry server your cluster talks to — not for telemetry, not even for licensing, which is verified offline with Ed25519 signatures against a public key compiled into the collector. Your alerts and cluster data stay put; the one exception is notifications, which go only to the destinations you configure (your Slack, your inbox). Turn those off and the cluster can be fully air-gapped.
What about Wazuh / Tetragon / Kubescape? +
They're great tools. Wazuh is a full SIEM (heavyweight). Tetragon is powerful but low-level. Kubescape focuses on posture, not runtime. KubeSentry is opinionated and focused: real-time threat detection with zero setup pain. If you want to combine — go for it.
Can I try it before buying? +
Yes. Every install starts with a 7-day free trial — the full product, no restrictions, no credit card. Install the chart and it just works; a banner in the dashboard tracks the trial. Add a license key when you are ready.