Your evidence folder is complete. Meanwhile, someone just opened a shell in your container.

Collecting audit evidence and catching a breach are the same job. How I wired Falco into a Kubernetes admission controller so the runtime alert and the admission record tell one story.