Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time.
At its core, Falco is a kernel monitoring and detection agent that observes events, such as syscalls, based on custom rules. Falco can enhance these events by integrating metadata from the container runtime and Kubernetes. The collected events can be analyzed off-host in SIEM or data lake systems.
Falco provides real-time detection capabilities for environments from individual containers, hosts, Kubernetes and the cloud. It’s able to detect and alert on abnormal behavior and potential security threats in real-time, such as crypto mining, file exfiltration, privilege escalation in applications, rootkit installs among many others. These malicious behaviors are detected via user-defined Falco rules that classify events of application activity as malicious or suspicious.
Falco, originally created by Sysdig, is a graduated project under the Cloud Native Computing Foundation (CNCF) used in production by various organisations.
This is free and open source software.
Website: github.com/falcosecurity/falco
Support:
Developer: CNCF
License: Apache License 2.0
Falco is written in C++. Learn C++ with our recommended free books and free tutorials.
Related Software
| Host-Based Intrusion Detection Systems | |
|---|---|
| Wazuh | Platform used for threat prevention, detection, and response |
| OSSEC | Full platform to monitor and control your systems. |
| Falco | Cloud native runtime security tool |
| Tracee | Runtime security and observability tool |
| AIDE | Advanced Intrusion Detection Environment |
| Logwatch | Powerful and versatile log parser and analyzer |
| Samhain | File integrity checking and log file monitoring/analysis and more |
| Sagan | Multi-threads, high performance log analysis engine |
| Hades | Uses eBPF and the netlink process connector to monitor activity |
| rkhunter | Scans for rootkits, backdoors and possible local exploits |
| Tripwire | Security and data integrity tool |
| chkrootkit | Locally checks for signs of a rootkit |
Read our verdict in the software roundup.
 Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category.This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form. |
Please read our Comment Policy before commenting.