Falco Runtime Security

Detect threats at runtime in containers and Kubernetes with Falco, the CNCF runtime security engine. Monitors system calls to catch anomalous behavior — shells in containers, unexpected network connections, sensitive file access — and write custom detection rules with MITRE ATT&CK mapping.

Falco is the CNCF-graduated runtime security tool that watches kernel system calls to detect suspicious activity in real time. This skill helps you deploy Falco on Kubernetes, tune the default ruleset, author custom rules for your workloads, reduce alert noise, and route alerts to your incident tooling.

When to use

Use to add runtime threat detection to containers and Kubernetes, tune or write Falco rules, map detections to MITRE ATT&CK, and cut false positives.

Examples

Deploy Falco on Kubernetes

Runtime detection in your cluster

Help me deploy Falco to my Kubernetes cluster and enable alerts for shells spawned in containers

Write a custom rule

Detect app-specific behavior

Write a Falco rule that alerts when a process reads /etc/shadow or opens an unexpected outbound connection

Reduce alert noise

Tune the ruleset

My Falco is too noisy — help me add exceptions for known-good workloads without losing real detections