Falco

Falco enables real-time monitoring of system calls to detect suspicious behavior, such as unexpected shell execution, unauthorized file modifications, or abnormal network connections within containers. It provides deep visibility into kernel-level events, allowing security teams to trigger alerts or block malicious activity based on predefined behavioral policies.

Falco is designed for DevSecOps engineers, site reliability engineers, and security analysts responsible for maintaining the integrity of containerized environments. It serves professionals who require granular visibility into kernel-level activity to satisfy compliance requirements and mitigate threats within complex, distributed infrastructure.

Falco requires a Linux kernel with support for eBPF or a kernel module to intercept system calls. It is typically deployed as a DaemonSet within Kubernetes environments, requiring sufficient privileges to access the host kernel and monitor events across all nodes in the cluster.