Open source. Open possibilities.

Falco is a cloud‑native runtime security tool for Linux that monitors kernel events and container activity, detects anomalies, and alerts on potential threats using customizable rules. It integrates with SIEMs and Kubernetes.