README
Falco
Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time.
At its core, Falco is a kernel monitoring and detection agent that observes events, such as syscalls, based on custom rules. Falco can enhance these events by integrating metadata from the container runtime and Kubernetes. The collected events can be analyzed off-host in SIEM or data lake systems.
Falco, originally created by Sysdig, is a graduated project under the Cloud Native Computing Foundation (CNCF) used in production by various organisations.
For detailed technical information and insights into the cyber threats that Falco can detect, visit the official Falco website.
For comprehensive information on the latest updates and changes to the project, please refer to the Change Log.
The Falco Project
The Falco Project codebase is maintained under the falcosecurity GitHub organization. The primary repository, falcosecurity/falco, holds the source code for the Falco binary, while other sub-projects are hosted in dedicated repositories. This approach of isolating components into specialized repositories enhances modularity and focused development. Notable core repositories include:
- falcosecurity/libs: This repository hosts Falco's core libraries, which constitute the majority of the binary’s source code and provide essential features, such as kernel drivers.
- falcosecurity/rules: It contains the official ruleset for Falco, offering pre-defined detection rules for various security threats and abnormal behaviors.
- falcosecurity/plugins: This repository supports integration with external services through plugins that extend Falco's capabilities beyond syscalls and container events, with plans for evolving specialized functionalities in future releases.
- falcosecurity/falcoctl: A command-line utility designed for managing and interacting with Falco.
- falcosecurity/charts: This repository publishes Helm charts for deploying Falco and its ecosystem. The Falco chart source lives in
chart/falco.
For further insights into our repositories and additional details about our governance model, please visit the official hub of The Falco Project: falcosecurity/evolution.