Protect · Runtime detection
Falco
Falco uses kernel instrumentation (eBPF) to watch system calls and Kubernetes audit events against rules such as "shell spawned in container". Alerts route to Slack, SIEMs or other Falcosidekick outputs.
On this page
What it does
Runs as a DaemonSet, evaluates syscall streams against rules and emits structured alerts with container and pod context.
Where it fits
Protect and Observe: the detective control that catches what admission and scanning could not predict.
Quick start
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco -n falco --create-namespace --set falcosidekick.enabled=true
kubectl -n falco logs -l app.kubernetes.io/name=falco --tail=50
kubectl exec -it deploy/app -- sh # triggers "Terminal shell in container"Common pitfalls
- Default rules are noisy in some stacks; tune with rule exceptions rather than disabling rules.
- Alerts nobody routes anywhere are not detection. Wire Falcosidekick to a channel with an owner.
Articles about Falco
Kubernetes intermediate
Kubernetes Security Checklist for Production Clusters
A layered checklist — control plane, workloads, network, secrets, supply chain and runtime — with the manifests and commands to verify each control rather than just tick it.