Falco
By the Cloud Native Computing Foundation
Falco is an open-source, cloud-native runtime security tool that monitors system calls on Linux hosts and containers to detect unexpected or malicious behavior as it happens. It applies a library of configurable rules to a live stream of…
Definition
Falco is an open-source, cloud-native runtime security tool that monitors system calls on Linux hosts and containers to detect unexpected or malicious behavior as it happens. It applies a library of configurable rules to a live stream of kernel events, generating an alert when a running process does something outside its expected behavior, such as opening a shell inside a container or writing to a sensitive file. Falco is hosted by the Cloud Native Computing Foundation and is commonly deployed as a DaemonSet across Kubernetes clusters.
Overview
Static scanning of container images and infrastructure configuration catches problems that exist before a workload ever runs, but it cannot see what a process actually does once it is executing. Falco fills that gap by watching runtime behavior directly, giving security teams visibility into activity such as a container spawning an unexpected shell, a process reading credentials it has no business touching, or a binary attempting to modify a system file. Falco works by tapping into the Linux kernel's system call interface, using either a kernel module, an eBPF probe, or a userspace instrumentation option depending on the deployment, and streaming every relevant system call into its rule engine in near real time. Rules are written in a YAML-based syntax that matches conditions like process name, file path, container context, and network destination, and a match triggers an alert that can be routed to logging systems, messaging tools, or automated response pipelines. Because it observes actual kernel-level activity rather than static file contents, Falco can catch behavior that never appears in a container image scan. Falco is often deployed alongside admission and policy tools like Kyverno or Gatekeeper, but it occupies a different point in the security lifecycle: those tools prevent noncompliant resources from being created, while Falco detects misbehavior in resources that are already running. It is similarly complementary to posture tools like Wiz, which assess configuration and exposure rather than live process behavior. In practice, Falco is deployed as a DaemonSet so that one instance runs on every node in a Kubernetes cluster, watching all containers scheduled to that node. Security teams tune its default rule set to their environment, since the out-of-the-box rules are intentionally broad and can be noisy, and integrate its alerts into a security information and event management pipeline or an automated response system that can kill a suspicious container. Falco's runtime visibility comes at the cost of requiring careful rule tuning; a default deployment can generate a high volume of false positives until rules are adjusted for the specific workloads running in a cluster. It also only detects behavior after a process has started executing, so it is a detective control rather than a preventive one, and it needs to be paired with image scanning and policy enforcement tools to cover the earlier stages of the software lifecycle. Resource overhead is generally modest compared to full sidecar-based monitoring approaches, since Falco's kernel-level collection is designed to run continuously on every node without materially affecting workload performance.
Key Features
- Monitors Linux kernel system calls in near real time for anomalous behavior
- Uses a YAML-based rule engine to define expected versus suspicious activity
- Supports kernel module, eBPF, and userspace instrumentation collection modes
- Deploys as a Kubernetes DaemonSet to cover every node in a cluster
- Routes alerts to logging, messaging, and automated response integrations
- Detects container escape attempts and unexpected shell activity
- Hosted as a Cloud Native Computing Foundation graduated project