CINXE.COM
Falco
<!doctype html><html itemscope itemtype=http://schema.org/WebPage lang=en class=no-js><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=generator content="Hugo 0.108.0"><link rel=alternate type=application/rss+xml href=https://falco.org/feed.xml><link rel=alternate type=application/json href=https://falco.org/index.json><meta name=robots content="index, follow"><link rel=canonical href=https://falco.org/><link rel=stylesheet href=https://unpkg.com/swiper@8/swiper-bundle.min.css><link rel="shortcut icon" href=/favicons/favicon.ico><link rel=apple-touch-icon href=/favicons/apple-touch-icon-180x180.png sizes=180x180><link rel=icon type=image/png href=/favicons/favicon-16x16.png sizes=16x16><link rel=icon type=image/png href=/favicons/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=/favicons/android-36x36.png sizes=36x36><link rel=icon type=image/png href=/favicons/android-48x48.png sizes=48x48><link rel=icon type=image/png href=/favicons/android-72x72.png sizes=72x72><link rel=icon type=image/png href=/favicons/android-96x96.png sizes=96x96><link rel=icon type=image/png href=/favicons/android-144x144.png sizes=144x144><link rel=icon type=image/png href=/favicons/android-192x192.png sizes=192x192><title>Falco</title><meta name=description content=" Why Falco? Strengthen container security The flexible rules engine allows you to describe …"><meta property="og:title" content="Falco"><meta property="og:description" content="Runtime Security"><meta property="og:type" content="website"><meta property="og:url" content="https://falco.org/"><meta property="og:image" content="https://falco.org/images/featured/default-01.png"><meta property="og:site_name" content="Falco"><meta itemprop=name content="Falco"><meta itemprop=description content="Runtime Security"><meta name=twitter:card content="summary_large_image"><meta name=twitter:image content="https://falco.org/images/featured/default-01.png"><meta name=twitter:title content="Falco"><meta name=twitter:description content="Runtime Security"><link rel=preload href=/scss/main.min.6f5ec4d119903a244a74e77e9ff3a4bb90c826465c253835c40f5384e2379da8.css as=style><link href=/scss/main.min.6f5ec4d119903a244a74e77e9ff3a4bb90c826465c253835c40f5384e2379da8.css rel=stylesheet integrity><script type=text/javascript src=https://www.termsfeed.com/public/cookie-consent/4.1.0/cookie-consent.js defer></script> <script type=text/javascript charset=utf-8>document.addEventListener("DOMContentLoaded",function(){cookieconsent.run({notice_banner_type:"interstitial",consent_type:"express",palette:"light",language:"en",page_load_consent_levels:["strictly-necessary"],notice_banner_reject_button_hide:!1,preferences_center_close_button_hide:!1,page_refresh_confirmation_buttons:!1})})</script><noscript>Free cookie consent management tool by <a href=https://www.termsfeed.com/>TermsFeed</a></noscript><script>(()=>{const e=document.getElementById("open_preferences_center");e&&document.addEventListener("scroll",()=>{const[n]=document.getElementsByTagName("footer"),s=n.getBoundingClientRect(),o=Math.max(document.documentElement.clientHeight,window.innerHeight),t=o-s.top;e.style.bottom=t>0?`calc(1rem + ${t}px)`:"1rem"})})()</script><script src=/js/jquery-3.6.4.min.js integrity=sha384-D3uwrq65ksHOpbvkMEb7reM5Bzm4MbOwpMgngc01wq8i5BTp7Tc74UZr97GXb2xS crossorigin=anonymous></script> <link rel=stylesheet href=/css/prism.css><link rel=stylesheet crossorigin href=/assets/index-C1z1vz3D.css><script src=/js/scripts.js async></script> <script src=/js/swiper-bundle.min.min.e0e8f81b0b15728d35ff73c07f42ddbb17a108d6f23df4953cb3e60df7ade675.js async onload=initSwiper()></script> <script type=application/javascript>var doNotTrack=!1;doNotTrack||(window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)},ga.l=+new Date,ga("create","UA-00000000-0","auto"),ga("send","pageview"))</script><script async src=https://www.google-analytics.com/analytics.js></script> <script async src="https://www.googletagmanager.com/gtag/js?id=G-D5DEHT7DJ1"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-D5DEHT7DJ1'); </script> </head><body class=td-home><header><nav class="js-navbar-scroll navbar navbar-expand navbar-dark td-navbar"><div class=navbar-brand__wrapper><a class=navbar-brand href=/><span class=navbar-logo><svg xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cc="http://creativecommons.org/ns#" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" id="Layer_1" data-name="Layer 1" viewBox="0 0 704.56704 249.16756" sodipodi:docname="logo.svg" inkscape:version="1.0.1 (3bc2e813f5, 2020-09-07)" width="704.56702" height="249.16757"><sodipodi:namedview pagecolor="#ffffff" bordercolor="#666666" borderopacity="1" objecttolerance="10" gridtolerance="10" guidetolerance="10" inkscape:pageopacity="0" inkscape:pageshadow="2" inkscape:window-width="2560" inkscape:window-height="1380" id="namedview110" showgrid="false" inkscape:zoom="1.8350955" inkscape:cx="219.80511" inkscape:cy="80.521527" inkscape:window-x="0" inkscape:window-y="32" inkscape:window-maximized="1" inkscape:current-layer="fqqZXT"/><defs id="defs82"><style id="style80">.cls-1{fill:#00b4c8}</style></defs><title id="title84">Falco horizontal logo_teal2</title><g id="fqqZXT" transform="translate(-1.8527785,-35.942587)"><path class="cls-1" d="M176.16169 141.03427Q109.1407 208.57188 41.7291 275.66846a61.01065 61.01065.0 01-6.640358 6.13636c-3.213076 2.38145-6.72856 2.52005-9.639229-.56702-2.910669-3.08708-1.902645-6.30015.516613-8.89581 5.796137-6.22455 11.78128-12.27269 17.804223-18.27043Q109.99752 188.15939 176.24989 122.28502c4.22111-4.20849 22.74355 9.47543 27.19146 13.98633" id="path86" style="fill:#fff;stroke-width:1.26003"/><path class="cls-1" d="m189.2282 162.40437c-.189 2.69647-1.94044 4.47311-3.69189 6.22456L74.880488 279.24695c-3.465083 3.45248-7.56018 6.82936-11.919883 2.11686-3.969095-4.27151-.630015-8.1146 2.595661-11.34028q54.735704-54.73569 109.483994-109.4588c2.78467-2.79727 5.77094-5.32992 10.08024-3.78009a5.8087381 5.8087381.0 014.1077 5.61973z" id="path88" style="fill:#fff;stroke-width:1.26003"/><path class="cls-1" d="m7.6200895 35.947772c3.0492725-.113403 5.1535225 1.65064 7.1065685 3.616286Q67.421111 92.22071 120.07776 144.88996c3.27609 3.28867 6.30015 7.23257 2.12945 11.34027-4.1707 4.10769-8.07679 1.26002-11.34027-2.09165Q58.10949 101.46932 5.503239 48.800078C2.8697767 46.154015.8159274 43.268546 2.4161662 39.312052a5.46853 5.46853.0 015.2039233-3.36428z" id="path90" style="fill:#fff;stroke-width:1.26003"/><path class="cls-1" d="m174.56145 284.17367c-6.30014 1.26003-11.21426-1.68844-15.68737-6.30015-8.00118-8.3288-16.21658-16.38039-24.45718-24.52018-4.85112-4.78812-5.04012-9.33682-.1764-14.21314 14.03674-13.94853 27.98527-27.98527 42.022-41.94639 3.08706-3.07449 6.84195-5.65754 10.77326-1.95305 4.38489 4.14549 1.49943 8.07678-1.75145 11.34026-11.01266 11.13867-21.97492 22.34033-33.26479 33.20179-4.2841 4.1203-4.95192 7.20737-.23941 11.41588 5.31733 4.76291 10.24404 9.96683 15.12037 15.12035 3.20047 3.37688 6.74116 5.35513 11.56707 5.17872 4.82591-.1764 10.43304-.1512 10.28185 6.41356-.15121 6.30015-5.97254 6.04815-10.58425 6.47655a26.460629 26.460629.0 01-3.6037-.2142z" id="path92" style="fill:#fff;stroke-width:1.26003"/><path class="cls-1" d="m105.61262 171.22459c-.94502 4.3975-3.37688 7.05616-8.101994 5.49372a16.38039 16.38039.0 01-5.972542-4.1707Q53.598582 134.74672 15.810285 96.945821a29.157093 29.157093.0 01-3.225677-3.780089c-2.167252-3.049273-2.368857-6.30015.378008-8.958813 2.746866-2.658664 6.098545-2.217653 8.82021.327608 4.59911 4.309302 9.034415 8.820209 13.494921 13.268116Q67.597514 130.1098 99.892082 162.44218c2.469658 2.49486 5.455928 4.7125 5.720538 8.78241z" id="path94" style="fill:#fff;stroke-width:1.26003"/><path class="cls-1" d="m86.76257 189.58322a6.1741467 6.1741467.0 01-3.187876 5.40553 6.7663608 6.7663608.0 01-8.353998-1.19703c-4.2211-3.90609-8.278397-7.98859-12.348293-12.05849q-18.06883-18.01842-36.049457-36.07465a43.181227 43.181227.0 01-5.254325-6.30015 5.7583368 5.7583368.0 01.45361-7.56019 6.3001498 6.3001498.0 017.56018-1.41123 14.679349 14.679349.0 014.662112 3.25088q24.494982 24.35638 48.876561 48.83876c1.953046 1.96565 3.679287 4.0951 3.641486 7.10657z" id="path96" style="fill:#fff;stroke-width:1.26003"/></g><path class="cls-1" d="m432.97476 151.03237a32.218966 32.218966.0 00-13.04132-8.354 58.944201 58.944201.0 00-20.16047-2.98627 105.0235 105.0235.0 00-18.64844 1.58764 94.703851 94.703851.0 00-13.33112 3.18787l2.98627 19.50526a67.373801 67.373801.0 0111.34027-2.78466 91.276569 91.276569.0 0115.38497-1.15923 28.489277 28.489277.0 0110.24403 1.58764 16.38039 16.38039.0 016.57736 4.4857 16.670197 16.670197.0 013.47768 6.66557 30.996737 30.996737.0 01.99543 7.96339v3.98169a77.680846 77.680846.0 00-9.34942-1.68844 72.36352 72.36352.0 00-8.3666-.50401 77.42884 77.42884.0 00-16.38039 1.70104 40.648566 40.648566.0 00-13.86033 5.56933 28.60268 28.60268.0 00-9.46282 10.08024 30.354121 30.354121.0 00-3.47769 15.12036 35.772251 35.772251.0 003.06188 15.66217 27.216646 27.216646.0 008.55559 10.35745 35.986455 35.986455.0 0013.24293 5.77094 75.904204 75.904204.0 0017.1112 1.78924 172.93911 172.93911.0 0025.3518-1.68845c7.48458-1.13403 13.10431-2.09164 16.8214-2.88546v-63.1023a64.059923 64.059923.0 00-2.09165-16.8214 31.412546 31.412546.0 00-6.98056-13.04131zm-14.23834 77.23984a89.966139 89.966139.0 01-16.9222 1.18443q-9.14783.0-14.52814-3.27609-5.38034-3.27608-5.36774-11.84428a12.600299 12.600299.0 011.97825-7.27037 13.44452 13.44452.0 015.27953-4.47311 25.427405 25.427405.0 017.37117-2.19245 54.723101 54.723101.0 018.05159-.59222 53.211064 53.211064.0 018.3666.59222 46.621108 46.621108.0 015.77094 1.26003z" id="path99" style="fill:#fff;stroke-width:1.26003"/><path class="cls-1" d="m493.746 223.58489a11.680477 11.680477.0 01-2.52006-5.04011 32.974984 32.974984.0 01-.69302-7.37118V91.911773l-24.09177 3.98169V215.7223a51.33362 51.33362.0 001.70105 13.86033 22.138726 22.138726.0 005.87173 10.15585 27.355251 27.355251.0 0011.23947 6.30015 65.521558 65.521558.0 0017.81682 2.38145l3.38949-19.90848a37.523692 37.523692.0 01-7.86259-1.68843 11.037863 11.037863.0 01-4.85112-3.23828z" id="path101" style="fill:#fff;stroke-width:1.26003"/><path class="cls-1" d="m582.98132 226.87357a62.043875 62.043875.0 01-12.14669 1.19702q-16.51899.0-23.48695-9.0596-6.96797-9.05962-6.96797-24.58319.0-16.12838 7.37117-24.9864 7.37118-8.85801 21.49612-8.8202a50.90521 50.90521.0 0111.23946 1.19702 54.660099 54.660099.0 019.46283 2.98627l5.16612-19.70686a72.930534 72.930534.0 00-27.85926-5.36773 53.110262 53.110262.0 00-21.49612 4.1707 47.062118 47.062118.0 00-16.22918 11.55448 51.207617 51.207617.0 00-10.25664 17.41361 64.034722 64.034722.0 00-3.57849 21.59691 71.607502 71.607502.0 003.18787 21.79852 46.898314 46.898314.0 009.66444 17.275 43.874242 43.874242.0 0016.38039 11.34028 60.267233 60.267233.0 0023.18455 4.0825 85.745038 85.745038.0 0016.61979-1.60024 50.199593 50.199593.0 0012.04589-3.57849l-3.38948-19.90847a56.701348 56.701348.0 01-10.40785 2.99887z" id="path103" style="fill:#fff;stroke-width:1.26003"/><path class="cls-1" d="m700.88233 171.83547a51.283219 51.283219.0 00-10.25664-17.22462 44.390855 44.390855.0 00-15.82598-11.03786 51.573025 51.573025.0 00-20.16048-3.88089 50.829608 50.829608.0 00-20.16048 3.88089 45.764288 45.764288.0 00-15.82598 11.03786 50.249994 50.249994.0 00-10.34484 17.22462 64.652137 64.652137.0 00-3.69189 22.39072 65.521558 65.521558.0 003.70448 22.50414 50.993412 50.993412.0 0010.24405 17.32541 46.079296 46.079296.0 0015.72517 11.15127 50.577602 50.577602.0 0020.26129 3.95649 51.270619 51.270619.0 0020.39988-3.9691 45.764288 45.764288.0 0015.82597-11.15126 50.023189 50.023189.0 0010.20624-17.31281 67.373801 67.373801.0 003.57849-22.49153 64.954544 64.954544.0 00-3.67928-22.40333zm-27.72067 47.27631q-6.66555 9.17302-18.61063 9.16043-11.94509-.0126-18.61065-9.16043-6.66555-9.14781-6.67816-24.88559.0-15.51096 6.67816-24.58318 6.67816-9.07221 18.61065-9.05962 11.94508.0 18.61063 9.05962 6.66557 9.05961 6.66557 24.58318.0504 15.72518-6.61516 24.88559z" id="path105" style="fill:#fff;stroke-width:1.26003"/><path class="cls-1" d="m349.92618 185.22959h-60.22943v63.7197H264.76076V99.547553h95.62367v20.009267h-70.68768v45.65089h60.22943z" id="path107" style="fill:#fff;stroke-width:1.26003"/></svg></span><span class=font-weight-bold>Falco</span></a></div><div class="td-navbar-nav-scroll ml-md-auto w-100" id=main_navbar><ul class="navbar-nav mt-2 mt-lg-0 justify-content-center"><li class="nav-item dropdown d-none d-md-block mb-2 mb-lg-0 mx-2"><a class="nav-link dropdown-toggle" href=# id=navbarDropdownAbout role=button data-toggle=dropdown aria-haspopup=true aria-expanded=false>About</a><div class=dropdown-menu aria-labelledby=navbarDropdownMenuLink><a class="dropdown-item d-flex flex-column" href=/about/><span class=font-weight-bold>What is Falco?</span> <span class="small text-dark">Learn about Falco and how it works</span></a> <a class="dropdown-item d-flex flex-column" href=/about/why-falco/><span class=font-weight-bold>Why choose Falco?</span> <span class="small text-dark">Benefits of Falco for runtime security</span></a> <a class="dropdown-item d-flex flex-column" href=/about/use-cases/><span class=font-weight-bold>Falco use cases</span> <span class="small text-dark">Threat detection and regulatory compliance</span></a> <a class="dropdown-item d-flex flex-column" href=/about/case-studies/><span class=font-weight-bold>Case studies</span> <span class="small text-dark">Discover how the industry is adopting Falco</span></a> <a class="dropdown-item d-flex flex-column" href=/about/ecosystem/><span class=font-weight-bold>Falco ecosystem</span> <span class="small text-dark">Integrations and plugins</span></a> <a class="dropdown-item d-flex flex-column" href=/about/faq/><span class=font-weight-bold>FAQ</span> <span class="small text-dark">The most common questions about the whole Falco<br>ecosystem</span></a></div></li><li class="nav-item d-none d-md-block mx-2 mb-2 mb-lg-0"><a class=nav-link href=/docs/><span>Docs</span></a></li><li class="nav-item d-none d-md-block mx-2 mb-2 mb-lg-0"><a class=nav-link href=/blog/><span>Blog</span></a></li><li class="nav-item dropdown d-none d-md-block mb-2 mb-lg-0 mx-2"><a class="nav-link dropdown-toggle" href=# id=navbarDropdownCommunity role=button data-toggle=dropdown aria-haspopup=true aria-expanded=false>Community</a><div class=dropdown-menu aria-labelledby=navbarDropdownMenuLink><a class="dropdown-item d-flex flex-column" href=/community/><span class=font-weight-bold>About the community</span> <span class="small text-dark">For users and contributors</span></a> <a class="dropdown-item d-flex flex-column" href=/community/events/><span class=font-weight-bold>Events</span> <span class="small text-dark">Meet and learn about Falco</span></a> <a class="dropdown-item d-flex flex-column" href=/community/contributors/><span class=font-weight-bold>Contributors</span> <span class="small text-dark">The people who build Falco</span></a> <a class="dropdown-item d-flex flex-column" href=/docs/roadmap/><span class=font-weight-bold>Roadmap</span> <span class="small text-dark">The Project direction</span></a> <a class="dropdown-item d-flex flex-column" href=/community/falco-brand/><span class=font-weight-bold>Falco brand</span> <span class="small text-dark">Brand guidelines</span></a></div></li><li class="nav-item d-none d-md-block mx-2 mb-2 mb-lg-0"><a class=nav-link href=/enterprise/><span>Enterprise</span></a></li><li class="nav-item dropdown d-none d-lg-block"><a class="nav-link dropdown-toggle" href=# id=navbarDropdownVersions role=button data-toggle=dropdown aria-haspopup=true aria-expanded=false>Versions <span></span></a><div class=dropdown-menu aria-labelledby=navbarDropdownMenuLink><a class=dropdown-item href=https://falco.org/>v0.40</a> <a class=dropdown-item href=https://v0-39.falco.org/>v0.39</a> <a class=dropdown-item href=https://v0-38.falco.org/>v0.38</a> <a class=dropdown-item href=https://v0-37.falco.org/>v0.37</a> <a class=dropdown-item href=https://v0-36.falco.org/>v0.36</a> <a class=dropdown-item href=https://v0-35.falco.org/>v0.35</a> <a class=dropdown-item href=https://v0-34.falco.org/>v0.34</a> <a class=dropdown-item href=https://v0-33.falco.org/>v0.33</a> <a class=dropdown-item href=https://v0-32.falco.org/>v0.32</a> <a class=dropdown-item href=https://v0-31.falco.org/>v0.31</a> <a class=dropdown-item href=https://v0-30.falco.org/>v0.30</a> <a class=dropdown-item href=https://v0-29.falco.org/>v0.29</a> <a class=dropdown-item href=https://v0-28.falco.org/>v0.28</a> <a class=dropdown-item href=https://v0-27.falco.org/>v0.27</a> <a class=dropdown-item href=https://v0-26.falco.org/>v0.26</a></div></li></ul></div><div class="d-flex justify-content-center justify-content-md-end mr-3 w-50"><div class="navbar-nav d-none d-lg-block"><div id=docsearch style=margin-right:5px></div></div><a href=/docs/getting-started/ role=button class="btn btn-primary flex-shrink-0 px-3">Try Falco</a></div><div class="dropdown-hamburger d-block d-md-none position-static ml-3"><button class="bg-transparent border-0" id=hamburgerDropdown role=button data-toggle=dropdown aria-haspopup=true aria-expanded=false aria-label="hamburger menu"> <i class="fa fa-bars fa-2x weigh" aria-hidden=true></i></button><div class="w-100 dropdown-menu dropdown-menu--mobile" aria-labelledby=hamburgerDropdown><a class="dropdown-item my-2" href=/about/><h4 class=font-weight-bold>About</h4></a><a class="dropdown-item my-2" href=/docs/><h4 class=font-weight-bold>Docs</h4></a><a class="dropdown-item my-2" href=/blog/><h4 class=font-weight-bold>Blog</h4></a><a class="dropdown-item my-2" href=/community/><h4 class=font-weight-bold>Community</h4></a><a class="dropdown-item my-2" href=/enterprise/><h4 class=font-weight-bold>Enterprise</h4></a></div></div></nav></header><div class="container-fluid td-default td-outer"><main role=main class=td-main><section class=row><div class=container><div class=row><div class="col-md-6 col-12"><h1 class="mt-5 pt-5">Detect security threats in real time</h1><p class="mb-0 mt-3">Falco is a cloud native security tool that provides runtime security across hosts, containers, Kubernetes, and cloud environments. It leverages custom rules on Linux kernel events and other data sources through plugins, enriching event data with contextual metadata to deliver real-time alerts. Falco enables the detection of abnormal behavior, potential security threats, and compliance violations.</p><a href=/docs/getting-started/ role=button class="btn btn-primary px-5 mt-5">Try Falco</a></div><div class="col-md-6 col-12"><img class=mt-4 src=/img/falco-schema.svg alt=plug></div></div></div></section><section class=row><div class="container td-arrow-down"><div class=row><div class=col-12><div class="grid-1 grid-lg-2 gap-3"><div class=use-cases-item><a href=/about/use-cases/#threat-detection class="d-flex align-items-baseline text-decoration-none"><h6 class="w-100 text-body">Threat Detection</h6><i class="fa fa-arrow-right"></i></a><p class=mb-0>Detect malicious behavior in hosts and containers, no matter what scale, using the power of eBPF.</p></div><div class=use-cases-item><a href=/about/use-cases/#compliance class="d-flex align-items-baseline text-decoration-none"><h6 class="w-100 text-body">Regulatory Compliance</h6><i class="fa fa-arrow-right"></i></a><p class=mb-0>Stay compliant in cloud-native systems with Falco's intelligent monitoring and rule-based detection.</p></div></div></div></div></div></section><section class=row><div class="container td-arrow-down"><div class=row><div class=col-12><h3>What makes Falco different?</h3><div class="mt-4 pt-3"><div class="p-0 grid-lg-2 grid-1 gap-4" id=falco-features-container><div class="card bg-light feature-card"><div class="card-body d-flex flex-column gap-3"><div class=icon style=margin-left:auto;margin-right:auto><img src=/icons/cloud-fill.svg alt="Cloud Native"></div><div class="d-flex flex-column h-100"><h4 class="display-4 mt-0 pb-1 feature-card__title" style=margin-left:auto;margin-right:auto>Cloud Native</h4><p class="flex-grow-1 mb-2 pb-1">Falco detects threats across containers, Kubernetes, hosts and cloud services.</p><ul id=falco-features-0 class="collapse multi-collapse ml-3 pl-1 mb-2" aria-labelledby=falco-features-0><li>Uses eBPF to monitor system activity for adverse behavior.</li><li>Integrated with Kubernetes.</li><li>Use plugins to monitor cloud services such as GitHub, Okta, or AWS Cloudtrail.</li></ul><a data-toggle=collapse data-target=#falco-features-0 class="btn btn-link text-primary align-self-start p-0 feature-card__expand-control" aria-expanded=false aria-controls=falco-features-0 role=button><span class="collapsed font-weight-normal">Show more</span> <span class="expanded font-weight-normal">Show less</span></a></div></div></div><div class="card bg-light feature-card"><div class="card-body d-flex flex-column gap-3"><div class=icon style=margin-left:auto;margin-right:auto><img src=/icons/shield-fill.svg alt="Real Time Detection"></div><div class="d-flex flex-column h-100"><h4 class="display-4 mt-0 pb-1 feature-card__title" style=margin-left:auto;margin-right:auto>Real Time Detection</h4><p class="flex-grow-1 mb-2 pb-1">Falco provides streaming detection of unexpected behavior, configuration changes, and attacks.</p><ul id=falco-features-1 class="collapse multi-collapse ml-3 pl-1 mb-2" aria-labelledby=falco-features-1><li>Runtime detection is a fundamental layer of defense against security blind spots and zero-day bugs in your software supply chain.</li><li>Streaming approach enables real-time response while minimizing storage costs and complexity.</li><li>Ready out-of-the-box with rules, which you can customize for your environment.</li></ul><a data-toggle=collapse data-target=#falco-features-1 class="btn btn-link text-primary align-self-start p-0 feature-card__expand-control" aria-expanded=false aria-controls=falco-features-1 role=button><span class="collapsed font-weight-normal">Show more</span> <span class="expanded font-weight-normal">Show less</span></a></div></div></div><div class="card bg-light feature-card"><div class="card-body d-flex flex-column gap-3"><div class=icon style=margin-left:auto;margin-right:auto><img src=/icons/arrow-right.svg alt="Integration with 50+ Systems"></div><div class="d-flex flex-column h-100"><h4 class="display-4 mt-0 pb-1 feature-card__title" style=margin-left:auto;margin-right:auto>Integration with 50+ Systems</h4><p class="flex-grow-1 mb-2 pb-1"><a href=/docs/outputs/forwarding/>Forward Falco alerts</a> to any off-host SIEM and data lake system for analysis, storage, or reaction.</p><ul id=falco-features-2 class="collapse multi-collapse ml-3 pl-1 mb-2" aria-labelledby=falco-features-2><li>Falco alerts can easily be forwarded to more than 50+ third parties.</li><li>The JSON format for alerts allows for storing, analysis, or triggering reactions easily.</li></ul><a data-toggle=collapse data-target=#falco-features-2 class="btn btn-link text-primary align-self-start p-0 feature-card__expand-control" aria-expanded=false aria-controls=falco-features-2 role=button><span class="collapsed font-weight-normal">Show more</span> <span class="expanded font-weight-normal">Show less</span></a></div></div></div><div class="card bg-light feature-card"><div class="card-body d-flex flex-column gap-3"><div class=icon style=margin-left:auto;margin-right:auto><img src=/icons/pentagon-fill.svg alt="Open Source"></div><div class="d-flex flex-column h-100"><h4 class="display-4 mt-0 pb-1 feature-card__title" style=margin-left:auto;margin-right:auto>Open Source</h4><p class="flex-grow-1 mb-2 pb-1">A multi-vendor and widely adopted solution that you can rely on.</p><ul id=falco-features-3 class="collapse multi-collapse ml-3 pl-1 mb-2" aria-labelledby=falco-features-3><li>Created cloud native in the same community as Kubernetes, Prometheus, and OPA.</li><li>Powered by eBPF technology.</li><li>Runs on x64 & ARM CPUs.</li><li>Deployable in Kubernetes with an official Helm chart.</li><li>Run on many platforms like GKE, EKS, AKS, gVisor and others.</li><li>Zero cost to start, and easy to audit, extend, and integrate.</li></ul><a data-toggle=collapse data-target=#falco-features-3 class="btn btn-link text-primary align-self-start p-0 feature-card__expand-control" aria-expanded=false aria-controls=falco-features-3 role=button><span class="collapsed font-weight-normal">Show more</span> <span class="expanded font-weight-normal">Show less</span></a></div></div></div></div></div></div></div></div></section><section class="row p-0"><div class=container><div class="row justify-content-center align-items-end gap-2"><h6 class="m-0 text-dark">Created by</h6><a href=https://sysdig.com/opensource/ target=_blank><img src=/icons/sysdig.svg style=transform:translateY(20%)translateX(-10%) alt=sysdig width=130></a></div></div></section><section class=row><div class="container slider-wrapper"><h3>Stories From Our Users</h3><div class="swiper__container d-flex justify-content-center align-items-center mt-4"><span class=swiper__control></span><div class=swiper><div class=swiper-wrapper><div class="swiper-slide px-3"><a href=/about/case-studies/r6-security class="quote-slide__link font-weight-normal text-decoration-none"><div class="card card-rounded card-rounded--shaded h-100"><div class="card-body d-flex flex-column justify-content-between"><img class=quote-slide__logo src=/img/case-studies/phoenix/phoenix.png alt="Quote Logo"><p class="card-text mb-0 mt-4 flex-grow-3">"Falco's threat detection and real-time alerting capabilities, together with Phoenix's mitigation features help effectively address security issues that might evade other security offerings"</p><div class="d-flex flex-column flex-grow-2"><div class="d-flex mt-4"><img class="rounded-circle quote-slide__avatar" src=/img/case-studies/phoenix/zsolt_nemeth.jpg alt="author image"><div class="pl-3 d-flex flex-column justify-content-center"><span>Zsolt Nemeth</span> <span class=text-black-50>CEO at R6 Security Inc</span></div></div></div></div></div></a></div><div class="swiper-slide px-3"><a href=/about/case-studies/trendyol class="quote-slide__link font-weight-normal text-decoration-none"><div class="card card-rounded card-rounded--shaded h-100"><div class="card-body d-flex flex-column justify-content-between"><img class=quote-slide__logo src=/img/case-studies/trendyol/trendyol.png alt="Quote Logo"><p class="card-text mb-0 mt-4 flex-grow-3">"At Trendyol, we leverage Falco to develop a threat detection system using Kubernetes audit logs and kernel events to monitor user behavior in production clusters. This lets us detect operational anti-patterns, enhance visibility, and identify malicious actors."</p><div class="d-flex flex-column flex-grow-2"><div class="d-flex mt-4"><img class="rounded-circle quote-slide__avatar" src=/img/case-studies/trendyol/furkan_tural.png alt="author image"><div class="pl-3 d-flex flex-column justify-content-center"><span>Furkan Türal</span> <span class=text-black-50>Platform Engineer at Trendyol</span></div></div><div class="d-flex mt-4"><img class="rounded-circle quote-slide__avatar" src=/img/case-studies/trendyol/emin_aktas.png alt="author image"><div class="pl-3 d-flex flex-column justify-content-center"><span>Emin Aktas</span> <span class=text-black-50>Platform Engineer at Trendyol</span></div></div></div></div></div></a></div><div class="swiper-slide px-3"><a href=/about/case-studies/incepto-medical class="quote-slide__link font-weight-normal text-decoration-none"><div class="card card-rounded card-rounded--shaded h-100"><div class="card-body d-flex flex-column justify-content-between"><img class=quote-slide__logo src=/img/case-studies/incepto-medical/incepto-medical.png alt="Quote Logo"><p class="card-text mb-0 mt-4 flex-grow-3">"Incepto Medical uses Falco to provide a secure on-demand medical imaging service to healthcare facilities. Their platform enables partners to run custom applications (workloads) in a multi-tenant environment while protecting sensitive customer data thanks to Falco."</p><div class="d-flex flex-column flex-grow-2"><div class="d-flex mt-4"><img class="rounded-circle quote-slide__avatar" src=/img/case-studies/incepto-medical/alexandre_lemaresquier.png alt="author image"><div class="pl-3 d-flex flex-column justify-content-center"><span>Alexandre Lemaresquier</span> <span class=text-black-50>Head of SecDevOps at Incepto Medical</span></div></div></div></div></div></a></div><div class="swiper-slide px-3"><div class="card testimonial-card bg-transparent h-100"><div class="card-body d-flex flex-column align-items-start py-5"><div class="testimonial-card__icon bg-info rounded-circle d-flex justify-content-center align-items-center p-3"><img class=bg-info src=/img/icons/question-lg.svg alt="Quote Logo"></div><h3 class="flex-grow-1 mt-4 font-weight-normal">Share your story</h3><a class="btn btn-primary btn-lg" role=button href="https://docs.google.com/forms/d/e/1FAIpQLSeUeha4P3VxqBd-AvNuEybNdc2DzQQyAInyceAqgqoXLy8Ptw/viewform?usp=sf_link" target=_blank>Add your story</a></div></div></div></div><div class="swiper__pagination d-flex justify-content-center mt-4"></div></div><span class=swiper__control-reverse></span></div></div></section><section class=row><div class=container><div class=row><div class="col-lg-7 mt-4 pt-2 d-flex flex-column"><div class="d-flex justify-content-between pb-3"><h4 class=mb-0>Featured videos</h4><a href=https://www.youtube.com/@falcosecurity target=_blank role=button class="btn btn-outline-primary">Falco on YouTube</a></div><div class="d-flex flex-column gap-4"><div id=PLgVVUpW8NIJDaH2_KOVPvDsQQ-4he2wxX></div><div id=PLgVVUpW8NIJAaa6AZmVWIGo34s7Gmndid></div><script src=/js/videos.js async></script></div></div><div class="col-lg-5 d-flex flex-column gap-4"><div class="card mt-4 mt-lg-0 shadow"><div class=card-body><div class="d-flex justify-content-between align-items-start"><h4 class="mt-0 pb-1">News</h4><a href=/blog role=button class="btn btn-outline-primary">Falco blog</a></div><div class="text-muted mb-2">Feb 11, 2025</div><a class="card-title mb-2 text-body" href=/blog/falco-talon-v0-3-0/><h6 class=mb-2>Falco Talon v0.3.0</h6></a><div class="card-text news">Falco Talon v0.3.0</div><hr class=my-4><div class="text-muted mb-2">Feb 04, 2025</div><a class="card-title mb-2 text-body" href=/blog/falcosidekick-2-31-0/><h6 class=mb-2>Falcosidekick 2.31.0</h6></a><div class="card-text news">Falcosidekick 2.31.0</div></div></div><div class="card shadow"><div class=card-body><div class="d-flex justify-content-between align-items-start"><h4 class="mt-0 pb-1">Events</h4><a href=/community/events role=button class="btn btn-outline-primary">Events</a></div><div id=landing-events></div><script src=/js/events.min.f75c89ffcedea98a31418700b789de12d75fa06df7d549c1ee1a2705e776613d.js async></script></div></div></div></div></div></section><section class=row><div class="container td-arrow-down"><div class=row><div class=col><h3>Join the Falco community</h3><div class="mt-4 pt-3"><div class="grid-md-3 grid-lg-4 grid-1 grid-sm-2 gap-4"><a class="card shadow text-center text-decoration-none" href=https://github.com/falcosecurity/falco target=_blank><div class=card-body><img class=icon-4 src=/icons/github.svg alt=GitHub><div class="card-title text-body font-weight-bold mt-3 mb-0">Find us on GitHub</div><p class="text-muted text-small mb-0"><i class="fa fa-star"></i> 4.6K+</p></div></a><a class="card shadow text-center text-decoration-none" href=https://kubernetes.slack.com/messages/falco target=_blank><div class=card-body><img class=icon-4 src=/icons/slack.svg alt=Slack><div class="card-title text-body font-weight-bold mt-3 mb-0">Join our Slack</div><p class="text-muted text-small mb-0"></p></div></a><a class="card shadow text-center text-decoration-none" href="https://www.youtube.com/playlist?list=PLgVVUpW8NIJAaZtszf1_nxB2y6mQrlY4s" target=_blank><div class=card-body><img class=icon-4 src=/icons/youtube.svg alt=YouTube><div class="card-title text-body font-weight-bold mt-3 mb-0">Watch us on YouTube</div><p class="text-muted text-small mb-0"></p></div></a><a class="card shadow text-center text-decoration-none" href=https://hub.docker.com/u/falcosecurity target=_blank><div class=card-body><img class=icon-4 src=/icons/docker64.svg alt=Docker><div class="card-title text-body font-weight-bold mt-3 mb-0">Download on Dockerhub</div><p class="text-muted text-small mb-0">60M+ Downloads</p></div></a></div></div></div></div></div></section><section class=row><div class="container td-arrow-down"><div class="row justify-content-center"><div class=px-3><h4 class=font-weight-normal>We are a CNCF graduated project</h4><a href=https://lists.cncf.io/g/cncf-falco-dev/><img src=/img/cncf-color-bg.svg alt=CNCF></a></div></div></div></section><section class="row relative"><div class=container><h3>Trusted by</h3><div class="grid-2 grid-md-3 grid-lg-4 grid-xl-5 gap-5"><figure class=my-auto><a href=https://www.boozallen.com/><img class=img-fluid src=/img/adopters/bah.png alt="Booz Allen Hamilton"></a></figure><figure class=my-auto><a href=https://controlplane.com/><img class=img-fluid src=/img/adopters/controlplane.png alt="Control Plane"></a></figure><figure class=my-auto><a href=https://frame.io/><img class=img-fluid src=/img/adopters/frameio.png alt=Frame.io></a></figure><figure class=my-auto><a href=https://about.gitlab.com/><img class=img-fluid src=/img/adopters/gitlab.png alt=GitLab></a></figure><figure class=my-auto><a href=https://kubesphere.io><img class=img-fluid src=/img/adopters/kubesphere.png alt=KubeSphere></a></figure><figure class=my-auto><a href=https://league.com/us/><img class=img-fluid src=/img/adopters/league.png alt=League></a></figure><figure class=my-auto><a href=https://nws.netways.de/en><img class=img-fluid src=/img/adopters/nws.png alt="NETWAYS Web Services"></a></figure><figure class=my-auto><a href=https://www.preferral.com/><img class=img-fluid src=/img/adopters/preferral.png alt=Preferral></a></figure><figure class=my-auto><a href=https://shopify.com><img class=img-fluid src=/img/adopters/shopify.png alt=Shopify></a></figure><figure class=my-auto><a href=https://sightmachine.com/><img class=img-fluid src=/img/adopters/sightmachine.png alt="Sight Machine"></a></figure><figure class=my-auto><a href=https://medium.com/@SkyscannerEng/kubernetes-security-monitoring-at-scale-with-sysdig-falco-a60cfdb0f67a><img class=img-fluid src=/img/adopters/skyscanner.png alt="Sky Scanner"></a></figure><figure class=my-auto><a href=https://stack.io/><img class=img-fluid src=/img/adopters/stackio.png alt=stack.io></a></figure><figure class=my-auto><a href=https://www.vinted.com><img class=img-fluid src=/img/adopters/vinted.png alt=Vinted></a></figure></div><div class="mt-5 d-flex justify-content-center"><a href=https://github.com/falcosecurity/falco-website/blob/master/ADD_LANDING_LOGO.md role=button class="btn btn-primary px-4 py-2">Add your logo</a></div></div></section><div class="container eclipse__layout"><div class="eclipse eclipse-top"></div><div class="eclipse eclipse-bottom"></div></div><div id=toast class="d-none toast position-fixed" role=alert aria-live=assertive aria-atomic=true data-delay=2000><div class="d-flex align-items-center py-2 px-3"><div class="mr-4 w-100 toast__content"></div><button type=button class=close data-dismiss=toast aria-label=Close> <span aria-hidden=true>×</span></button></div></div></main><footer class="py-5 row d-print-none"><div class="container-fluid mx-sm-5"><div class=row><div class="col-12 col-sm-6 col-md-4 text-center text-sm-left"><ul class="list-inline mb-0"><li class="list-inline-item mx-2 h3" data-toggle=tooltip data-placement=top title=GitHub aria-label=GitHub><a class=text-white target=_blank rel="noopener noreferrer" href=https://github.com/falcosecurity/falco aria-label=GitHub><i class="fab fa-github"></i></a></li><li class="list-inline-item mx-2 h3" data-toggle=tooltip data-placement=top title=Slack aria-label=Slack><a class=text-white target=_blank rel="noopener noreferrer" href=https://kubernetes.slack.com/messages/falco aria-label=Slack><i class="fab fa-slack"></i></a></li><li class="list-inline-item mx-2 h3" data-toggle=tooltip data-placement=top title="Developer mailing list" aria-label="Developer mailing list"><a class=text-white target=_blank rel="noopener noreferrer" href=https://lists.cncf.io/g/cncf-falco-dev aria-label="Developer mailing list"><i class="fa fa-envelope"></i></a></li><li class="list-inline-item mx-2 h3" data-toggle=tooltip data-placement=top title="Contributor of the Month" aria-label="Contributor of the Month"><a class=text-white target=_blank rel="noopener noreferrer" href=/docs/contribute/contributor-of-the-month/ aria-label="Contributor of the Month"><i class="fa fa-star"></i></a></li></ul><script type=module crossorigin src=/assets/index-JfmtLPLI.js></script></div><div class="col-12 col-sm-6 col-md-8 text-center text-sm-right"><a class="pl-lg-4 pl-sm-2 text-white font-weight-normal" href=/about/>About</a> <a class="pl-lg-4 pl-sm-2 text-white font-weight-normal" href=/docs/>Docs</a> <a class="pl-lg-4 pl-sm-2 text-white font-weight-normal" href=/blog/>Blog</a> <a class="pl-lg-4 pl-sm-2 text-white font-weight-normal" href=/community/>Community</a> <a class="pl-lg-4 pl-sm-2 text-white font-weight-normal" href=/enterprise/>Enterprise</a></div></div><div class=row><div class="col-12 col-sm-8 text-center text-sm-left text-white"><small>Falco was created by <a href=https://sysdig.com/opensource/>Sysdig</a></small></div></div><div class=row><div class="col-12 col-sm-8 text-center text-sm-left text-white"><small>© 2025 The Falco Authors | Documentation Distributed under <a href=https://creativecommons.org/licenses/by/4.0/ target=_blank>CC BY 4.0</a></small><br><small>© 2025 The Linux Foundation ®. All Rights Reserved<br>The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our <a class=text-white href=https://www.linuxfoundation.org/trademark-usage>Trademark Usage page</a>. <a class=text-white href=https://www.linuxfoundation.org/privacy>Privacy Policy</a> and <a class=text-white href=https://www.linuxfoundation.org/terms>Terms of Use</a>.</small><br></div></div></div></footer></div><img referrerpolicy=no-referrer-when-downgrade src="https://static.scarf.sh/a.png?x-pxid=91d2b9ed-2cd3-43e5-8eee-dbaa47affa14"> <script src=https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js integrity=sha384-9/reFTGAW83EW2RDu2S0VKaIzap3H66lZH81PoYlFhbGU+6BZp6G7niu735Sk7lN crossorigin=anonymous></script> <script src=https://cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/js/bootstrap.min.js integrity="sha512-UR25UO94eTnCVwjbXozyeVd6ZqpaAE9naiEUBK/A+QDbfSTQFhPGj5lOR6d8tsgbBk84Ggb5A3EkjsOgPRPcKA==" crossorigin=anonymous></script> <script src=/js/tabpane-persist.js></script> <script src=/js/main.min.a63cf6d582974fa71718bfa53d0de6936beb05648c2e9e9e657c5b2d449ac42c.js integrity="sha256-pjz21YKXT6cXGL+lPQ3mk2vrBWSMLp6eZXxbLUSaxCw=" crossorigin=anonymous></script> <script src=/js/prism.js></script></body></html>