Investigating server compromises with cgroups: A Linux DFIR primer

This blog post explains how Linux control groups (cgroups) can be used as process-enrichment telemetry for security investigations and detections. It covers cgroup structures under systemd and common container runtimes (Docker, Kubernetes, runc, Podman), shows how cgroup paths reveal context like service names, container/pod IDs and user sessions, demonstrates enrichment via Falco alerts in an investigation scenario, and provides guidance for collecting cgroup data and developing detections to improve investigative confidence and reduce false positives.