banro21 / falco

Cloud Native Runtime Security

Cloud Native Runtime Security.

---

Latest releases

Read the change log.

	development	stable
rpm
deb
binary

---

The Falco Project, originally created by Sysdig, is an incubating CNCF open source cloud native runtime security tool. Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. Falco has a rich rule set of security rules specifically built for Kubernetes, Linux, and cloud-native. If a rule is violated in a system, Falco will send an alert notifying the user of the violation and its severity.

Installing Falco

If you would like to run Falco in production please adhere to the official installation guide.

Kubernetes

Tool	Link	Note
Helm	Chart Repository	The Falco community offers regular helm chart releases.
Minikube	Tutorial	The Falco driver has been baked into minikube for easy deployment.
Kind	Tutorial	Running Falco with kind requires a driver on the host system.
GKE	Tutorial	We suggest using the eBPF driver for running Falco on GKE.

Developing

Falco is designed to be extensible such that it can be built into cloud-native applications and infrastructure.

Falco has a gRPC endpoint and an API defined in protobuf. The Falco Project supports various SDKs for this endpoint.

SDKs

Language	Repository
Go	client-go
Rust	client-rs
Python	client-py

What can Falco detect?

Falco can detect and alert on any behavior that involves making Linux system calls. Falco alerts can be triggered by the use of specific system calls, their arguments, and by properties of the calling process. For example, Falco can easily detect incidents including but not limited to:

• A shell is running inside a container or pod in Kubernetes.
• A container is running in privileged mode, or is mounting a sensitive path, such as /proc, from the host.
• A server process is spawning a child process of an unexpected type.
• Unexpected read of a sensitive file, such as /etc/shadow.
• A non-device file is written to /dev.
• A standard system binary, such as ls, is making an outbound network connection.

Documentation

The Official Documentation is the best resource to learn about Falco.

Join the Community

To get involved with The Falco Project please visit the community repository to find more.

Contributing

See the CONTRIBUTING.md.

Security Audit

A third party security audit was performed by Cure53, you can see the full report here.

Reporting security vulnerabilities

Please report security vulnerabilities following the community process documented here.

License Terms

Falco is licensed to you under the Apache 2.0 open source license.