Getting Started

Falco is a cloud-native security tool. It provides near real-time threat detection for cloud, container, and Kubernetes workloads by leveraging runtime insights. Falco can monitor events defined via customizable rules from various sources, including the Linux kernel, and enrich them with metadata from the Kubernetes API server, container runtime, and more. Falco supports a wide range of kernel versions, x86_64 and ARM64 architectures, and many different output channels.

Try it now

Get started on your Linux host or Kubernetes cluster.

Try Falco with Docker

Run Falco on your host with a Docker container

Try Falco on Kubernetes

Install Falco and Falcosidekick on your Kubernetes cluster with Helm

Try Falco on Ubuntu

Run Falco on your host or set up a Vagrant VM to try it