Falco
What it is
Falco is free, open-source runtime security software for Linux and self-hosted environments. It monitors hosts, containers, Kubernetes, and cloud environments to detect abnormal behavior, potential threats, and compliance violations in real time. Events are checked against built-in detection rules, and users can create custom rules for their environment. Falco can ingest Linux kernel system calls, Kubernetes audit logs, AWS CloudTrail events, and activity from systems such as GitHub and Okta. For kernel monitoring, it uses an eBPF driver by default and offers a kernel module for wider compatibility. Installation options cover Linux hosts, Docker containers, and Kubernetes, including official Helm charts; supported architectures include x86_64 and ARM64. Falcosidekick can forward events to more than 50 systems, including email, chat, message queues, serverless functions, and databases. The project is hosted by the CNCF and described as a graduated project. Detection depends on having appropriate rules in place, while resource use varies with server load and workload.
For and against
For
- Free and open source.
- Supports Linux hosts, Docker, and Kubernetes.
- Includes an eBPF driver by default.
- Falcosidekick forwards events to over 50 systems.
- Supports x86_64 and ARM64 architectures.
Against
- Detection depends on appropriate rules.
- Resource use varies with workload.
- Community support is through Slack and a mailing list.
The verdict
Falco provides runtime event monitoring and flexible rule-based detection for self-hosted environments. Teams should plan to configure suitable rules and evaluate resource use for their workload.
Who it suits
Falco suits teams seeking runtime security monitoring across Linux hosts, containers, Kubernetes, and cloud environments. It is most relevant to users able to configure rules and assess resource use in their target workload.
Plans and prices
Falco
Zero cost to start · open source
Read 4 Oct 2026 · falco.org
On the record
- Architectures
- Falco supports x86_64 and ARM64 architectures, with Linux packages listed for x86_64 and aarch64.falco.org · read 4 Oct 2026
- Commercial offering
- The project site links to partner commercial offerings for enterprise support and detection rules, but does not list their prices.falco.org · read 4 Oct 2026
- Deployment
- The project provides installation options for Linux hosts, Docker containers, and Kubernetes, including official Helm charts.falco.org · read 4 Oct 2026
- Detection rules
- Falco compares events against built-in rules and lets users create custom rules for their environment.falco.org · read 4 Oct 2026
- Event sources
- Falco can ingest Linux kernel syscalls, Kubernetes audit logs, cloud events such as AWS CloudTrail, and events from systems such as GitHub and Okta.falco.org · read 4 Oct 2026
- Integrations
- Falco's plugins include sources for GitHub webhooks, Kubernetes audit events, AWS EKS audit events, CloudTrail logs, Docker events, Okta audit logs, and Nomad events.falco.org · read 4 Oct 2026
- Notable detection limit
- Falco does not automatically cover every possible threat; detection depends on having appropriate rules in place.falco.org · read 4 Oct 2026
- Performance considerations
- Falco's resource use varies with server load and workload, and the project recommends testing performance in the target environment.falco.org · read 4 Oct 2026
- Project status
- Falco is an open source project hosted by the CNCF and is described on its site as a CNCF graduated project.falco.org · read 4 Oct 2026
- Purpose
- Falco provides runtime security across hosts, containers, Kubernetes, and cloud environments, detecting abnormal behavior, potential threats, and compliance violations in real time.falco.org · read 4 Oct 2026
- Security mechanism
- For kernel event monitoring, Falco uses a modern eBPF driver by default and offers a kernel module for wider compatibility.falco.org · read 4 Oct 2026
- Support
- Community support is available through Kubernetes Slack and the project's mailing list; the project also lists partner-provided enterprise offerings.falco.org · read 4 Oct 2026
- Threat response
- Falcosidekick can forward Falco events to more than 50 systems, including email, chat, message queues, serverless functions, and databases.falco.org · read 4 Oct 2026
