Falco ORG

Cloud Native Runtime Security

A runtime security tool for Linux and Kubernetes that monitors system calls and raises alerts when suspicious behavior is detected, like a shell spawning inside a container.

Connect Falco to your ecosystem

libsinsp, libscap, the kernel module driver, and the eBPF driver sources

Community managed Helm charts for running Falco with Kubernetes

Response Engine for managing threats in your Kubernetes

Falco rule repository

Falco-powered policy and visibility layer for AI coding agents

A simple WebUI with latest events from Falco

Administrative tooling for Falco

Generate a variety of suspect actions that are detected by Falco rulesets

Prometheus Metrics Exporter for Falco output events

Falco plugins registry

Kit for building Falco drivers: kernel modules or eBPF probes

ptrace-based event producer for udig

Evolution process of The Falco Project

The Falco Project Community

Go client and SDK for Falco

Run Falco in a GitHub Actions to detect suspicious behavior in your CI/CD

Source code of the official Falco website

Kubernetes Operator for Falco

Falco workflow & testing infrastructure

Falco plugins SDK for Go

A tool to crawl Linux kernel versions

Fetches the metadata from kubernetes API server and dispatches them to Falco instances

Web-application used to validate Falco rules and test against scap file

Kubernetes deployment resources for Falco

Python client and SDK for Falco

The rust language implementation of the Falco client

Ansible playbooks to provision firecracker VMs and run Falco kernel tests

Kilt is a project that defines how to inject foreign apps into containers

Falco plugins SDK for Rust

All-purpose test suite for Falco and its ecosystem

Terraform Module for Falco AWS Resources

Default community health files

A tool to automatically update supported syscalls in libs

Small exercises to get you used to writing Falco plugins in Rust 🦀

Go SDK for Falco libs

Language Server Protocol and VSCode Extension for Falco rules

Secrets and config manager for Falco's infrastructure

eBPF probe for syscall events

No description.

Falco plugins SDK for C++

A go tool to work with falcosecurity drivers build grid

System inspection library

No description.

Falco configurations intended for testing with the CNCF Green Reviews Working Group

Acts as a template for new repositories

Falco Rules Syntax Checker for Emacs, Using Flycheck

Community sandbox to test-drive ideas/projects/code

Local version of https://sourceforge.net/projects/elftoolchain/

Tool to synchronize Peribolos configuration with GitHub people sources of truth.

Advocacy machinery