# Blog: Install and Test Atomic Red in Kubernetes

DevFeed: [Blog: Install and Test Atomic Red in Kubernetes](<https://devfeed.tech/articles/blog-install-and-test-atomic-red-in-kubernetes-32496.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-atomic-red/>)

Published: 2023-12-12T00:00:00Z

Content type: tutorial

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Falco](<https://devfeed.tech/topics/falco.md>), [threat detection](<https://devfeed.tech/topics/threat-detection.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [deployment](<https://devfeed.tech/tags/deployment.md>), [falco](<https://devfeed.tech/tags/falco.md>), [installation](<https://devfeed.tech/tags/installation.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [mapping](<https://devfeed.tech/tags/mapping.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [security-concept](<https://devfeed.tech/tags/security-concept.md>), [staging](<https://devfeed.tech/tags/staging.md>), [test-lab](<https://devfeed.tech/tags/test-lab.md>), [testing](<https://devfeed.tech/tags/testing.md>), [threat-detection](<https://devfeed.tech/tags/threat-detection.md>)

## AI overview

This tutorial explains how to deploy and test Atomic Red Team in Kubernetes and use the open source Falco to detect simulated threats in real time. It describes evaluating detections against the MITRE ATT&CK framework, identifying coverage gaps, and refining custom rules. The article recommends using a test lab or staging environment rather than production.

## Source excerpt

In cloud-native environments, where applications scale up and down much faster than traditional monolithic application architectures, the ability to proactively identify and respond to threats in real time is paramount. As more organizations embrace cloud-native architectures for application delivery, more robust security measures need to be introduced. In this blog post, we delve into the dynamic realm of Kubernetes threat detection by exploring how open source Falco can seamlessly detect Atomic Red Team tests in real time within Kubernetes environments. Atomic Red Team is a powerful framework designed to simulate real-world attacks, providing organizations with a controlled environment to validate the effectiveness of their security measures. We take this a step further by deploying Atomic Red to Kubernetes with a single command, creating a realistic testing ground for evaluating the responsiveness of Falco. Our journey begins with the effortless deployment of Atomic Red to Kubernetes, showcasing the simplicity and efficiency of orchestrating security testing within containerized environments. Once deployed, we invoke specific Atomic Red Team tests, simulating a range of threat scenarios. The true test lies in Falco's ability to detect these threats in line with the MITRE ATT&CK framework, a globally-recognized matrix mapping adversary techniques to defensive tactics. This exploration is not just about identifying threats; it's a collaborative effort to enhance Falco's coverage. Should we identify any gaps in detection, we dive deeper, revising the executed techniques and crafting custom rules. This iterative process aims to extend our MITRE ATT&CK coverage, aligning Falco with the industry's best practices for threat detection and mitigation. Deploying Atomic Red Team To avoid any potential service disruption in production environments, we recommend installing Atomic Red in a test lab environment, or at least a staging environment of Kubernetes. We have a step-by