Falco can detect and alert on any behavior that involves making Linux system calls.
Falco alerts are triggered based on specific system calls, arguments, and properties
of the calling process. Falco operates at the user space and kernel space. The system
calls are interpreted by the Falco kernel module. The syscalls are then analyzed using
the libraries in the userspace. The events are then filtered using a rules engine
where the Falco rules are configured. Suspicious events are then alerted to outputs
that are configured as Syslog, files, Standard Output, and others.
Falco
Comprehensive overview of the Falco product lifecycle - Releases, last patch, long-term support, maintenance and support
All supported productsFree Versio.io trialWhat is Falco?
Falco can detect and alert on any behavior that involves making Linux system calls.
Falco alerts are triggered based on specific system calls, arguments, and properties
of the calling process. Falco operates at the user space and kernel space. The system
calls are interpreted by the Falco kernel module. The syscalls are then analyzed using
the libraries in the userspace. The events are then filtered using a rules engine
where the Falco rules are configured. Suspicious events are then alerted to outputs
that are configured as Syslog, files, Standard Output, and others.
The entire lifecycle of Falco
X![]()
Facts and figures about Falco
Product
Falco
Vendor
Falco
Latest version
0.40.0
Number of releases
38
Number of versions
94
Number of unstable versions
24
Number of versions affected by CVE
39
Licence
Apache License 2.0
Licence details
Wikipedia
Last verification date
2025-05-21
Questions or interested? Talk to me!
Keywords