Falco can detect and alert on any behavior that involves making Linux system calls.
Falco alerts are triggered based on specific system calls, arguments, and properties
of the calling process. Falco operates at the user space and kernel space. The system
calls are interpreted by the Falco kernel module. The syscalls are then analyzed using
the libraries in the userspace. The events are then filtered using a rules engine
where the Falco rules are configured. Suspicious events are then alerted to outputs
that are configured as Syslog, files, Standard Output, and others.
Falco
Product description
Falco can detect and alert on any behavior that involves making Linux system calls.
Falco alerts are triggered based on specific system calls, arguments, and properties
of the calling process. Falco operates at the user space and kernel space. The system
calls are interpreted by the Falco kernel module. The syscalls are then analyzed using
the libraries in the userspace. The events are then filtered using a rules engine
where the Falco rules are configured. Suspicious events are then alerted to outputs
that are configured as Syslog, files, Standard Output, and others.
X![]()
Properties
Product
Falco
Vendor
Falco
Latest version
0.34.1
# Releases
32
# Versions
51
# Security affected versions (CVE)
39
Licence MIT
Apache-2.0
Licence details
Wikipedia
Last verification date
2023-03-15
Read more
Content repository - product release & end-of-life
A daily updated, centralised and harmonised content repository of versions, releases and patches of software and hardware products as well as their end-of-life (maintenance, support) information.
Supported product releases & end-of-life
Overview of supported product versions & End-of-Life (EoL) information in the Versio.io content database.
Versio.io supported enterprise technologies
Versio.io supports a wide range of hardware & software technologies to help organizations automate inventory, reporting, compliance and management of the IT landscape.
Talk to us
Keywords