Don't Panic — Falco

Falco is the colleague who watches a running Linux system and writes down the interesting bits before anyone insists that nothing happened. It receives events, adds whatever process, user, container, or Kubernetes context is available, checks a rule condition, and emits an alert. That is its job. It does not halt the event, scan the image, or declare the event malicious. Those are other departments in the building, and they have their own forms.

The useful picture is a five-stage conveyor belt: event source, enrichment, rule condition, alert, and output. A syscall source observes supported Linux kernel activity through a driver. Plugins can supply other sources or more fields. Rules apply to one source at a time, which prevents Falco from quietly becoming a cross-source detective novel with no ending.

A rule is a Boolean predicate over event fields. It can say that an execution event occurred, inside a container, with a shell as the process name. The alert then carries fields that explain what matched. Rules, macros, and lists keep that logic readable: one names the detection, one names a reusable condition, and one names a reviewed collection of values.

The surprise is that a rule match is not a verdict. Default rules are a starting point because expected behavior changes with each workload. An interactive shell may be alarming in one container and ordinary in another. The work is to select relevant rules, generate representative activity, inspect the output, and add narrow exceptions for approved behavior. This is less glamorous than a blinking dashboard, but it is how an alert becomes useful.

Start with the Intro for the pipeline and boundaries. Use the Slides when the relationships need a quick map, then the Cheatsheet for rule parts, source limits, output channels, and operational checks. The Practice reference and Exercise trace a controlled event from capture to delivery. The most durable question is not whether Falco is running. It is whether the right event reaches a rule, carries useful context, and arrives where somebody can act.