falcosecurity/falco

Health v2 · maintenance only

Adoption not part of the score

9305 stars · 1065 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Falco is a CNCF-graduated cloud native runtime security tool for Linux that monitors kernel events (syscalls) via eBPF or kernel modules and detects abnormal behavior using customizable rules. It enriches events with container and Kubernetes metadata and delivers real-time alerts that can be forwarded to SIEM and data lake systems.

Use cases

• detect runtime security threats in containers and kubernetes
• monitor linux syscalls for suspicious behavior
• alert on privilege escalation and shell spawning in production
• detect kubernetes cluster intrusions in real time
• maintain pci dss and mitre att&ck compliance monitoring
• forward security alerts to siem or data lake
• monitor cloud audit logs like aws cloudtrail and okta

When to choose

• you run linux hosts, containers, or kubernetes and need real-time runtime threat detection
• you want a lightweight, low-overhead eBPF-based monitoring agent with a single policy language
• you need out-of-the-box rules plus extensibility via plugins and 50+ alert integrations

When to avoid

• you need endpoint protection on non-Linux systems like Windows or macOS
• you want a full managed SIEM or antivirus product rather than a detection agent
• you cannot run privileged workloads or eBPF/kernel modules on your hosts

Facets

application · maturity stable

monitoring alerting security logging security cloud-computing monitoring self-hosted cloud runtime-security ebpf threat-detection syscall-monitoring cncf siem-integration kubernetes-security intrusion-detection containers devops linux kubernetes docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="falcosecurity/falco")