What it does
Falco is an open-source runtime-security tool that applies rules to system activity and other event sources and forwards contextual alerts.
Falco is useful when a defender wants to notice unexpected runtime behavior, such as activity that differs from a workload's normal role. Its page describes rules over Linux events and plugins for additional sources. Tune rules against representative workloads and decide where alerts will be reviewed. Forwarding JSON to a SIEM is an integration step, not the response itself. Keep the detection policy close to the team that understands the application's expected activity.
Strengths
- Customizable runtime rules and alert integrations
Best for
- Defenders monitoring container and host behavior
Sources
- Falco (Oct 26, 2026)
- Falco COPYING (Oct 26, 2026)