v0.18.0 Read the change log

Dev Branch:
Master Branch:
CII Best Practices:

Falco is a behavioral activity monitor designed to detect anomalous activity in your applications. Falco audits a system at the most fundamental level, the kernel. Falco then enriches this data with other input streams such as container runtime metrics, and Kubernetes metrics. Falco lets you continuously monitor and detect container, application, host, and network activity—all in one place—from one source of data, with one set of rules.

Falco is hosted by the Cloud Native Computing Foundation (CNCF) as a sandbox level project. If you are an organization that wants to help shape the evolution of technologies that are container-packaged, dynamically-scheduled and microservices-oriented, consider joining the CNCF. For details read the Falco CNCF project proposal.

Falco can detect and alert on any behavior that involves making Linux system calls. Falco alerts can be triggered by the use of specific system calls, their arguments, and by properties of the calling process. For example, Falco can easily detect incidents including but not limited to:

• A shell is running inside a container.
• A container is running in privileged mode, or is mounting a sensitive path, such as /proc, from the host.
• A server process is spawning a child process of an unexpected type.
• Unexpected read of a sensitive file, such as /etc/shadow.
• A non-device file is written to /dev.
• A standard system binary, such as ls, is making an outbound network connection.

A comprehensive installation guide for Falco is available in the documentation website.

One of the questions we often get when we talk about Falco is “How does Falco differ from other Linux security tools such as SELinux, AppArmor, Auditd, etc.?”. We wrote a blog post comparing Falco with other tools.

See Falco Documentation to quickly get started using Falco.

• Join the mailing list for news and a Google calendar invite for our Falco open source meetings. Note: this is the only way to get a calendar invite for our open meetings.
• Website for Falco.
• Join our Public Slack channel for Falco announcements and discussions.

Falco has bi-weekly office hour style meetings where we plan our work on the project. You can get a Google calendar invite by joining the mailing list. It will automatically be sent.

Wednesdays at 8am Pacific on Zoom.

Falco is licensed to you under the Apache 2.0 open source license.

See the CONTRIBUTING.md.