Falco.

An open-source cloud-native runtime security engine that detects abnormal container, host, and Kubernetes behavior by streaming syscalls and audit events through a rules engine. It belongs to the Defense & Operations category of cybersecurity.

An open-source cloud-native runtime security engine that detects abnormal container, host, and Kubernetes behavior by streaming syscalls and audit events through a rules engine.

Falco is an Apache 2.0 licensed runtime security tool originally built by Sysdig and donated to the Cloud Native Computing Foundation (CNCF), where it reached Graduated status in 2024. It consumes Linux syscalls via an eBPF probe or kernel module, plus Kubernetes audit logs and pluggable event sources (AWS CloudTrail, Okta, GitHub), and evaluates them against a YAML-defined rule set. Out-of-the-box rules detect container escape, shell-in-container, write below /etc, unexpected outbound connections, and privilege escalation. Operators ship alerts to falcosidekick which can forward to Slack, OpsGenie, Loki, or a SOAR. Falco is the runtime layer of choice for Kubernetes-native SOCs alongside admission controllers like Kyverno.

Defences for Falco typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Falco runtime security, Sysdig Falco.