Falco is a cloud native runtime security tool for Linux operating systems that detects and alerts on abnormal behavior and potential security threats in real-time.
Falco operates as a kernel monitoring and detection agent that observes system events, primarily syscalls, and evaluates them against custom rules. It enriches these events with metadata from container runtimes and Kubernetes, enabling context-aware threat detection. The collected events can be forwarded to SIEM or data lake systems for off-host analysis, allowing security teams to investigate and respond to incidents at scale.
Falco suits organizations running containerized workloads on Linux that need runtime visibility into potential security threats. It is particularly valuable for teams managing Kubernetes clusters or other container orchestration platforms where traditional host-based monitoring falls short. The tool's modular architecture, with separate repositories for core libraries, detection rules, plugins, and deployment charts, allows teams to adopt components incrementally and customize their security posture. The official ruleset provides pre-built detection rules for common threats, though users can define custom rules tailored to their environment. Falco's integration with container runtime and Kubernetes metadata distinguishes it from generic syscall monitoring tools by providing the context needed to correlate events with specific workloads and containers.
The project maintains a distributed development model across specialized repositories within the falcosecurity organization, with the primary binary source in the main repository and core functionality split into dedicated modules for libraries, rules, plugins, and tooling. Development is structured around focused components, with the libs repository containing kernel drivers and detection logic, the rules repository housing the official detection ruleset, and the plugins repository enabling extensibility beyond syscalls. The project publishes Helm charts for Kubernetes deployment and provides a command-line utility for managing Falco configurations and interactions. The tool is a graduated project under the Cloud Native Computing Foundation and is used in production by various organizations.
