TroveGrid
Back to all tools
Falco logo

Falco

Real-time threat detection for containers and Kubernetes using system calls.

0Open Source
Security Kubernetes-tools
Official Website View on GitHub
Share:XLinkedInWhatsApp

Overview

Cloud-native runtime security tool for containerized environments.

Key Features

  • Kernel-level syscall visibility using eBPF for deep runtime inspection
  • Pre-built detection rules for MITRE ATT&CK cloud techniques
  • Custom rules in YAML for organisation-specific threat detection
  • Alerts routed to Slack, PagerDuty, Elasticsearch, and more via Falcosidekick
  • Kubernetes audit log analysis for API server event detection
  • Low-overhead eBPF probe for production-safe deployment

Real-World Workflows

Detecting container escape attempts

  1. 1Deploy Falco as a DaemonSet with the eBPF probe on all Kubernetes nodes
  2. 2Falco monitors syscalls for suspicious patterns: writing to /etc, spawning shells
  3. 3Alert fires when a container attempts to access host filesystem paths
  4. 4Alert is routed via Falcosidekick to a Slack channel and SIEM
  5. 5Security team investigates the pod and isolates it using a NetworkPolicy

Monitoring Kubernetes API server activity

  1. 1Enable Kubernetes audit log forwarding to Falco
  2. 2Falco rules detect suspicious API calls: creating ClusterRoleBindings, exec into pods
  3. 3Alert fires on privilege escalation events in near real-time
  4. 4Events are forwarded to an Elasticsearch SIEM for long-term retention and analysis

Getting Started

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
  --set driver.kind=ebpf \
  --namespace falco --create-namespace

Compare Alternatives

See how Falco stacks up against similar tools.

VSaquaVStwistlockVStrivy