CheckOps home

Tools directory

F

CheckOps

Falco

Falco is the CNCF's Apache-2.0 cloud-native runtime security tool that detects abnormal behaviour in hosts, containers and Kubernetes using system calls and rules.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Falco is a cloud-native runtime security project. It observes system calls and other event sources on hosts and containers, applies rules, and alerts when behaviour looks suspicious, such as a shell spawning in a container or sensitive files being read.

The source code is at falcosecurity/falco on GitHub under the Apache-2.0 licence, with about 9,600 stars; the most recent commit was on 9 November 2026.

Features

  1. Runtime detection: System-call based monitoring.
  2. Rules engine: Default rules plus custom ones.
  3. Kubernetes context: Enriches events with pod and namespace metadata.
  4. Plugins: Additional event sources, such as cloud audit logs.
  5. Alert outputs: Send to many destinations via Falcosidekick.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 9 November 2026.
  3. Community: About 9,600 GitHub stars.

Cons

  1. Runtime only: Complements, not replaces, shift-left scanning.
  2. Tuning required: Rules need tuning to reduce noise.
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco -n falco --create-namespace

Resources:

Pricing

Falco is free and open source under the Apache-2.0 licence.

  1. Platform security teams needing runtime detection.
  2. Kubernetes operators.
  3. Not a fit for pre-deployment scanning alone.

Conclusion

Falco is the standard open-source runtime threat detection tool for containers.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Falco side by side.