falco

Falco is a cloud‑native runtime security tool for Linux that monitors system calls and container events in real time. It uses a rule‑based engine to detect abnormal behavior and raise alerts, which can be enriched with metadata from Kubernetes and container runtimes. The project is a CNCF graduated initiative, originally from Sysdig, and is used in production by many organizations. The main repository contains the Falco binary, while related components such as libs, rules, plugins, falcoctl, and Helm charts are hosted in separate repos. Users can start with the Getting Started guide, deploy Falco in various environments, and integrate alerts with SIEMs or data lakes. The project provides comprehensive documentation, a demo Docker‑compose setup, and active community support via Slack, mailing lists, and GitHub issues. Security audits and best‑practice guidelines are publicly available. Building from source requires CMake with driver and modern BPF options, and testing can be performed with the unit test suite. Contributions follow the project’s contributing guide and code of conduct. Falco is licensed under Apache 2.0.