Falco
CNCF runtime security tool that detects unexpected or malicious behavior in containers and hosts as it happens, using kernel-level monitoring.
- Actively maintained
- Foundation-backed
- Well documented
- Permissive license
Overview
Falco watches system calls at the kernel level using eBPF and evaluates them against a rules engine to detect suspicious behavior in real time - a shell spawned inside a container, a sensitive file being read, a privilege escalation attempt - and alerts immediately rather than after the fact. It's a CNCF graduated project focused specifically on runtime threat detection.
Falco is a fit for security teams that need to detect active threats and anomalous behavior while a system is running, complementing Trivy and Kyverno (also in this catalog) - those scan images and enforce policy before deployment, while Falco watches what's actually happening at runtime.
Why it's in this catalog
Catalog rating: ★★★☆☆ (3/5)
Leading runtime security/threat-detection tool for containers and Kubernetes.
- Mature
- Foundation-governed
- Categories
- DevOps
- Languages
- C++
- License
- Apache-2.0
Related Projects
Cilium
Apache-2.0eBPF-based networking, security, and observability platform for Kubernetes that replaces traditional networking components with kernel-level performance.
Actively maintained
- DevOps
etcd
Apache-2.0Distributed, consistent key-value store that Kubernetes itself uses to store all cluster state, and a reliable building block for other distributed systems.
Actively maintained
- DevOps
Open Policy Agent (OPA)
Apache-2.0General-purpose, CNCF-graduated policy engine for enforcing authorization, compliance, and configuration rules as code across microservices, APIs, Kubernetes, and CI pipelines.
Actively maintained
- DevOps
cert-manager
Apache-2.0Automates issuing, renewing, and managing TLS certificates for Kubernetes applications, eliminating manual certificate handling.
Actively maintained
- DevOps
Spotted an error? Suggest an edit on GitHub.