zoom_in Click to enlarge

Falco

▲ ▼

language

description Falco Overview

Falco is an open-source runtime security project designed to protect containerized applications. It monitors system calls within containers and their host environment, identifying deviations from expected behavior. This detection capability makes it useful for DevOps teams, security engineers, and anyone managing Kubernetes or other container runtimes seeking proactive threat identification and improved operational visibility.

help Falco FAQ

What does Falco monitor inside Kubernetes?

Falco watches runtime behavior such as Linux system calls and container activity, then compares that behavior against security rules. In Kubernetes, it is often used to detect events like a shell spawning inside a container, unexpected file writes, or suspicious network tools.

Is Falco a vulnerability scanner?

No, Falco is mainly a runtime threat detection tool rather than an image vulnerability scanner. Tools such as Trivy or Grype inspect packages and CVEs, while Falco looks for suspicious behavior after workloads are running.

Who originally created Falco?

Falco was originally created by Sysdig and later became part of the cloud native security ecosystem. It is open source and commonly deployed in Kubernetes clusters as a DaemonSet.

How are Falco detection rules written?

Falco rules are written in YAML and describe conditions based on events, fields, and macros. A rule can match concrete behavior such as writing below /etc, running package managers in a container, or launching a terminal process where that should not happen.

swap_horiz

Looking for Falco alternatives? Compare top competitors ranked & scored

arrow_forward