Falcosidekick is a daemon that connects Falco security events to your ecosystem by forwarding them to multiple outputs in a fan-out pattern.
The tool solves the problem of integrating Falco's runtime security alerts with downstream systems. Falco detects suspicious behavior in containers and Kubernetes environments, but its output needs to reach various platforms for alerting, logging, and response. Falcosidekick acts as a single endpoint that accepts Falco events and distributes them to multiple destinations simultaneously, allowing many Falco instances to feed into one daemon rather than requiring direct connections from each instance to each output system.
Teams running Falco in containerized or Kubernetes environments should adopt this tool if they need to route security events to chat platforms, monitoring systems, log aggregators, object storage, serverless functions, message queues, email, databases, SIEM systems, or workflow automation tools. The project supports a broad range of outputs across these categories, making it suitable for organizations with heterogeneous tooling. It works equally well for small deployments with a few Falco instances and large setups with many sources feeding into centralized event processing.
The project maintains steady development activity with regular commits and releases. The codebase is written in Go and includes comprehensive test coverage. The tool provides multiple metrics and observability options including Prometheus metrics, StatsD/DogStatsD integration, and Golang ExpVar for monitoring its own performance. Configuration is handled through YAML files, and the project supports deployment across multiple environments including Docker, systemd, and Kubernetes with Helm charts. Mutual TLS support is available for secure communication between Falco instances and the daemon.
