# Wednesday Poll - Which Detection Would You Build First?

**URL:** <https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697>\
**Category:** Falco\
**Created:** [October 22, 2025, 6:15pm UTC](https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697 "2025-10-22T18:15:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bodhi](https://sea1.discourse-cdn.com/sysdig/user_avatar/community.sysdig.com/bodhi/32/94_2.png) [@Bodhi](https://community.sysdig.com/u/Bodhi)\
**Post date:** [October 22, 2025, 6:15pm UTC](https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697/1 "2025-10-22T18:15:40Z")

</div>

If you’re just starting out with Falco or cloud threat detection:  
Which type of detection rule would you build first? 🥇

A) Kubernetes exec into container

B) Suspicious network outbound

C) File change to critical path

D) Other (comment below) 👇

---

<div class="post-metadata">

**Author:** ![Huck](https://avatars.discourse-cdn.com/v4/letter/h/b5a626/32.png) [@Huck](https://community.sysdig.com/u/Huck)\
**Post date:** [October 22, 2025, 7:45pm UTC](https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697/2 "2025-10-22T19:45:21Z")

</div>

D) Terminal shell in container.

This would allow detection of interactive sessions via kube exec, and RCE \> shell in the event of workload compromise. If someone is actively interacting with my containers I want to know!

Interested to hear what everyone else thinks!

---

<div class="post-metadata">

**Author:** ![Maddie](https://sea1.discourse-cdn.com/sysdig/user_avatar/community.sysdig.com/maddie/32/118_2.png) [@Maddie](https://community.sysdig.com/u/Maddie)\
**Post date:** [October 22, 2025, 11:21pm UTC](https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697/3 "2025-10-22T23:21:47Z")

</div>

B) No one comes in without wanting to send something out.

---

<div class="post-metadata">

**Author:** ![leogr](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@leogr](https://community.sysdig.com/u/leogr)\
**Post date:** [October 23, 2025, 9:44am UTC](https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697/4 "2025-10-23T09:44:40Z")

</div>

A) Kubernetes exec into container

It would provide immediate value in understanding runtime visibility! With this, one can quickly distinguish between legitimate and suspicious exec patterns.

---

<div class="post-metadata">

**Author:** ![edsoncelio](https://sea1.discourse-cdn.com/sysdig/user_avatar/community.sysdig.com/edsoncelio/32/107_2.png) [@edsoncelio](https://community.sysdig.com/u/edsoncelio)\
**Post date:** [October 23, 2025, 9:55am UTC](https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697/5 "2025-10-23T09:55:09Z")

</div>

A) Kubernetes exec into container  
It looks like a small thing but it’s a good way to identify patterns and best (or bad) practices!

---

<div class="post-metadata">

**Author:** ![MOD\_Crystal\_Ball](https://sea1.discourse-cdn.com/sysdig/user_avatar/community.sysdig.com/mod_crystal_ball/32/111_2.png) [@MOD\_Crystal\_Ball](https://community.sysdig.com/u/MOD_Crystal_Ball)\
**Post date:** [October 23, 2025, 1:52pm UTC](https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697/6 "2025-10-23T13:52:24Z")

</div>

D) Known malicious IOCs like for malware and cryptominers. Simple enough to get your feet wet, but effective 🙂