Using the runtime detection tool Falco,  Analyse the container behavior for at least 20 seconds,...

Using the runtime detection tool Falco,  Analyse the container behavior for at least 20 seconds, using filters that detect newly spawning and executing processes in a single container of Nginx.

store the incident file art /opt/falco-incident.txt, containing the detected incidents. one per line, in the format

[timestamp],[uid],[processName]