Falco
Falco is a runtime security tool that observes activity from Linux systems and other event sources, evaluates that activity against rules, and emits alerts when behavior matches a detection.
itCloud native tools and technologies | OpenSkills.info
Intro
Falco
Falco detects behavior while a system is running. It consumes event streams, evaluates each event against rules, and emits an alert when a rule condition matches. Its built-in syscall event source observes Linux kernel activity through a driver. Plugins can add sources such as Kubernetes audit events and cloud service logs.
This position in the security stack matters. Image scanning finds known problems before deployment. Admission policy decides which workloads may enter a cluster. Falco observes what workloads and users do after software starts. These controls answer different questions, so Falco supplements them rather than replacing them.
The detection pipeline
Follow one event through five parts:
- Event source — the Linux kernel driver or a plugin supplies an event stream.
- Enrichment — Falco can attach process, user, container, and orchestration metadata available for the event.
- Rule engine — a Boolean condition selects relevant events and behavior.
- Alert — a matching rule supplies an output message, priority, tags, and source.
- Output channel — Falco sends the alert to standard output, a file, syslog, a program, or an HTTP endpoint.
This pipeline is detection, not prevention. A rule match produces an alert. Falco does not block the activity that caused the match. Your surrounding system must route, investigate, and respond to alerts.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://falco.org/docs/getting-started/
Supports
- Falco as a cloud native runtime security tool
- Near real-time threat detection from runtime events
- Customizable rules and metadata enrichment
- Linux and Kubernetes starting paths
- https://falco.org/docs/concepts/event-sources/
Supports
- Event streams and source definitions
- Built-in `syscall` source and plugin-provided sources
- Per-source threads and rule partitioning
- No correlation across different event sources
- Source enable and disable behavior
- https://falco.org/docs/concepts/event-sources/kernel/architecture/
Supports
- Kernel-event capture pipeline
- Modern eBPF probe and kernel module
- Falco libraries, enrichment, rule evaluation, and outputs
- https://falco.org/docs/concepts/rules/
Supports
- YAML rules files
- Rules, macros, and lists
- Rules repository and compatibility metadata
- https://falco.org/docs/concepts/rules/basic-elements/
Supports
- Rule fields and Boolean conditions
- Event-type constraints
- Output fields, priority, tags, and source
- Macro and list behavior
- Instructional shell-in-container rule structure
- https://falco.org/docs/concepts/rules/default-custom/
Supports
- Project default and local rule files
- Rule loading order and local customization
- Separation of project rules from local changes
- https://falco.org/docs/reference/rules/default-rules/
Supports
- Stable, incubating, and sandbox rule maturity
- Stable rules loaded by default
- Project-maintained default rules
- https://falco.org/docs/concepts/rules/exceptions/
Supports
- Structured exceptions for approved contexts
- Exception fields, comparators, and values
- https://falco.org/docs/concepts/rules/controlling-rules/
Supports
- Rule selection by name and tag
- Enabling and disabling selected rules
- https://falco.org/docs/concepts/rules/adoption/
Supports
- Production tuning and staged rule adoption
- Review of false positives against workload behavior
- Operational ownership of rules
- https://falco.org/docs/concepts/outputs/
Supports
- Standard output, file, syslog, program, and HTTP output channels
- Falcosidekick as a third-party forwarding component
- https://falco.org/docs/concepts/outputs/formatting/
Supports
- Alert fields and structured JSON formatting
- Output-field interpolation
- https://falco.org/docs/concepts/event-sources/kernel/dropped-events/
Supports
- Event drops as a detection visibility concern
- Drop monitoring and mitigation controls
- https://falco.org/docs/concepts/event-sources/kernel/sample-events/
Supports
- Event Generator purpose
- Controlled syscall and Kubernetes audit sample activity
- Validation of a Falco deployment
- https://github.com/sindresorhus/awesome
Supports
- Starting point for curated topic-list discovery
- Security and DevSecOps list categories
- https://github.com/developer-guy/awesome-falco
Supports
- Falcosidekick as a Falco output helper
- falcoctl as Falco administrative tooling
- Falco Event Generator as controlled suspect-activity tooling
- https://falco.org/docs/concepts/outputs/forwarding/
Supports
- Falcosidekick forwarding role
- Integration beyond built-in output channels
- https://falco.org/blog/falcoctl-install-manage-rules-plugins/
Supports
- falcoctl as the official CLI for Falco ecosystem components
- Rule and plugin artifacts
- OCI indexes, registries, repositories, installation, and updates