Falco

Falco uses eBPF (extended Berkeley Packet Filter) to instrument the Linux kernel and capture every syscall event at the operating system level. This provides deep visibility into container and host activity without modifying application code or inserting kernel modules. The eBPF probe sits in the kernel, parsing arguments and return values to build a rich, real-time stream of system events—file opens, process spawns, network connections—with minimal performance overhead.

Falco's detection logic is defined through a declarative rules language that specifies conditions for suspicious behavior. Rules can filter on:

• Syscall types (e.g., open, execve, connect)
• Process lineage (parent-child relationships)
• File paths and permissions
• Network endpoints and protocols

Example: A rule triggers when a shell is spawned inside a running container (spawned_process with container and proc.name=bash), indicating a potential container escape or unauthorized access.

When a rule condition is met, Falco generates a structured alert containing:

• Event timestamp and severity level
• Container ID, image name, and Kubernetes metadata
• Process command line and user context
• File paths or network details involved

Alerts are streamed to stdout, syslog, or integrated with SIEM platforms and notification channels like Slack, PagerDuty, and webhooks. This enables immediate incident response for threats such as cryptojacking, reverse shells, or unauthorized credential access.

Falco integrates deeply with Kubernetes by enriching syscall events with orchestrator metadata. It automatically resolves:

• Pod names, namespaces, and labels
• Deployment and ReplicaSet ownership
• Service account identities

This context allows security teams to map a suspicious syscall directly to the responsible workload. Falco can be deployed as a DaemonSet to monitor every node, or as a sidecar for per-pod isolation, and its alerts can trigger Kubernetes admission webhooks or NetworkPolicy enforcement via tools like Falco Talon.

Falco supports programmatic output via gRPC APIs, allowing custom consumers to process alert streams. It can also capture full syscall logs for forensic analysis, recording every event on a system for post-incident investigation. Integration with Falcosidekick enables forwarding alerts to over 50 destinations, including:

• AWS S3 and Security Lake
• Elasticsearch and Loki
• Kafka for streaming analytics

This extensibility makes Falco the central sensor in a cloud-native detection and response pipeline.

The kernel technology that powers Falco's instrumentation. eBPF allows sandboxed programs to run in the Linux kernel without changing kernel source code or loading modules. Falco's driver attaches eBPF probes to syscall tracepoints to capture every execve, open, and network connection with near-zero overhead. In air-gapped environments, the eBPF probe is compiled once and loaded as a pre-built object file, eliminating the need for kernel headers or LLVM at runtime.

The raw sequence of kernel-level system calls that Falco monitors in real-time. Each event contains metadata including the process name, PID, UID, parent process, and arguments. Falco's rule engine filters this high-volume stream—often thousands of events per second—against a rules file to identify suspicious patterns. Key monitored syscalls include:

• execve and execveat for process spawning
• open and openat for file access
• connect and accept for network activity
• ptrace for debugging and injection attempts

A declarative YAML-based DSL for defining security policies. Rules specify a condition (a boolean expression over syscall fields), a priority level, and an output message. The language supports macros for reusable logic and lists for grouping related items. Example rule detecting a shell spawned in a container:

• Condition: evt.type = execve and container and proc.name = bash
• Output: Shell spawned in container (user=%user.name container_id=%container.id)
• Priority: WARNING Rules are compiled at startup and evaluated against every syscall event.

Shared libraries that extend Falco's event sources beyond syscalls. The plugin framework defines a gRPC-based API for ingesting events from cloud services, Kubernetes audit logs, or custom applications. Key plugin types:

• Source plugins: Generate events from external systems (e.g., AWS CloudTrail, GitHub webhooks)
• Extractor plugins: Parse fields from event payloads for use in rule conditions Plugins are compiled as .so files and loaded at startup, making them fully compatible with air-gapped deployments where they are distributed via private registries.