Falco

Falco is an open source threat detection tool that watches, in real time, what happens inside Linux machines, containers and Kubernetes clusters. The American company Sysdig created it and opened the code in 2016, then handed it to the Cloud Native Computing Foundation in 2018, the same foundation that hosts Kubernetes. The project went through every stage there and reached graduated status on 29 February 2024. It is released under the Apache 2.0 licence.

The latest version, 0.45.0, came out on 21 September 2026. According to the CNCF announcement, its self-declared adopters include organisations such as GitLab, Shopify, Cisco and Booz Allen Hamilton.

What Falco is for

Falco rests on a simple observation: anything significant a program does goes through the kernel. Opening a file, starting a process, making a network connection or changing privileges all turn into system calls. Falco captures that stream through a driver, by default a modern eBPF probe built into the binary, or a kernel module where that is not possible. It checks each event against rules written in YAML and fires an alert as soon as a condition is met.

The rules shipped with the project flag behaviour that typically signals an intrusion, such as a shell spawned inside a container, a write to the system configuration directory, tampering with password files or a container gaining elevated privileges. Each event is enriched with the container, image, pod and Kubernetes namespace names, so it is immediately clear which application is involved. Plugins add further sources, among them Kubernetes audit logs and cloud service logs.

Alerts can go to standard output, a file, syslog, a program or an HTTP endpoint. The companion project Falcosidekick forwards them to a long list of chat tools, monitoring platforms and analytics systems, and the falcoctl utility bundled with Falco installs and updates rules and plugins.

Falco differs from Suricata and Zeek, which listen to the network. It looks inside the system instead, where encrypted traffic no longer hides anything. Wazuh, also listed in our software library, covers desktops and servers more broadly, Windows included, with a central console. Cilium shares Falco’s reliance on eBPF, but its main job is networking and securing traffic between containers.

Who is it for?

Falco is aimed at teams running containers in production: platform engineers, people in charge of Kubernetes cluster security, analysts who want visibility into Linux server activity and auditors who need to show that abnormal behaviour would be caught. Installing it through a Helm chart or the Kubernetes operator makes it easy to roll out on every node of a cluster.

Its limits are worth knowing. Falco detects and alerts, but it blocks nothing on its own, so stopping a process or isolating a container requires other tools wired to its alerts. It runs on Linux only, on x86_64 and aarch64, and the modern eBPF driver expects a fairly recent kernel, in practice version 5.8 or later. The default rules nearly always need tuning to keep false positives down, which calls for a good understanding of the workloads being monitored. Nor does it replace antivirus software or an image vulnerability scanner.

Download Falco safely

Official downloads are listed on falco.org, on the Download page of the documentation. GPG-signed DEB and RPM packages and tar.gz archives are hosted on download.falco.org for x86_64 and aarch64. Container images are published as falcosecurity/falco on Docker Hub, and the Helm charts live in the falcosecurity/charts repository on GitHub.

Falco has no paid edition, and the project sells nothing. Because the agent runs with very high privileges on every machine and loads code into the kernel, an image or package of unknown origin is a serious risk for the whole cluster. Stick to the official repositories and verify package signatures, all the more since the project announced a rotation of its signing key in December 2025.

Frequently asked questions