Overview

Falco is a cloud native runtime security tool for Linux hosts, containers, Kubernetes and cloud environments. Originally created by Sysdig and now a graduated project of the Cloud Native Computing Foundation (CNCF), it is a monitoring and detection agent that observes kernel events — primarily syscalls — and raises real-time alerts when the observed behaviour matches a rule.

Falco parses the Linux syscall stream at runtime, asserts it against a rules engine and alerts when a rule is violated. Events are enriched with contextual metadata from the container runtime and Kubernetes, and the resulting alerts can be logged, forwarded to an HTTP endpoint, or shipped to a SIEM or data lake for investigation. Because the monitoring capability is not limited to syscalls, plugins let Falco ingest events from additional sources such as Kubernetes audit logs and cloud provider logs.

Key Features

• Runtime detection from kernel events — syscalls are captured with a modern eBPF probe (or the kernel module driver) and evaluated in real time, with no application instrumentation.
• Powerful rules engine — detections are expressed as YAML rules combining a condition and an output message; Falco ships with a maintained default ruleset and supports your own rules and rule files.
• Default detections for common attacks — privileged containers and privilege escalation, namespace changes, reads and writes to well-known directories such as /etc, /usr/bin and /usr/sbin, symlink creation, ownership and mode changes, spawned shells (sh, bash, zsh…), SSH binaries, and unexpected network connections or socket mutations.
• Context enrichment — events are augmented with container runtime and Kubernetes metadata so an alert identifies the workload, not just the host.
• Flexible alerting outputs — stdout, a file, syslog, a spawned program, or an HTTP(S) endpoint; the same event stream feeds dashboards and SIEM pipelines.
• Plugins — ingest data beyond syscalls (Kubernetes audit events, cloud logs, and third-party sources) with the plugin framework.
• MITRE ATT&CK tagging — the default rules carry tags that map detections to known attacker techniques.
• Cloud native deployment — official container images and Helm charts, with falcoctl for managing rules and artefacts.

Why Use It

Most host security tooling either watches the network from the outside or the application from the inside. Falco sits closer to the source of truth: the kernel. That means it can flag suspicious behaviour — a process that suddenly spawns a shell, a write into /etc, a container that escalates to privileged — without instrumenting a single application, and it does so at the moment the syscall happens rather than after the fact.

It is also unusually easy to adopt for what it does: a single agent on a host or a DaemonSet in Kubernetes, a configuration file and a ruleset written in plain YAML. Because it is a CNCF graduated project with an Apache-2.0 userspace codebase and a strong plugin ecosystem, it integrates with the rest of the cloud native stack instead of replacing it.

Use Cases

• Host intrusion detection — detect shell spawns, credential file reads and file tampering on servers and workstations.
• Container and Kubernetes security — spot containers running as privileged, unexpected execs into a pod, or crypto-mining style behaviour.
• Compliance monitoring — alert on writes to security-relevant paths and unexpected binaries, with an audit trail for reviews.
• Incident detection and triage — stream alerts to Falcosidekick, a SIEM or a data lake so analysts get a live view of what changed on the estate.
• Custom threat hunting — write rules for the specific behaviours that matter in your own applications and environments.

Platforms

Linux only for the kernel-level driver — x86_64 and aarch64 — running on bare metal or virtual machines, inside containers, on Kubernetes clusters and in cloud environments. Falco is deployed as a daemon on the host or as a DaemonSet in Kubernetes; the plugin framework extends visibility to log-based sources that are not tied to the Linux kernel.

Licence

Open source. The Falco userspace code is released under the Apache License 2.0; the kernel module driver is distributed under a dual GPL-2.0/Apache-2.0 licence, since it must link against the Linux kernel. Licence verified from the project’s LICENSE file in the upstream repository.

Website

falco.org — documentation at falco.org/docs, source at github.com/falcosecurity/falco.

Looking for more? Browse the full directory of free and open source tools, or submit a tool we should add.