Falco is designed to detect these and other threats while your services and applications are running. When it detects unwanted behavior, Falco alerts you instantly so you're informed (and can react!) right away, not after minutes or hours have passed...
Falco makes it easy to consume Linux kernel syscalls, and enrich those events with information from Kubernetes and the rest of the cloud native stack. Falco has a rich set of out of the box security rules specifically built for Kubernetes, Linux and the cloud...
Falco provides real-time detection capabilities for environments from individual containers, hosts, Kubernetes and the cloud. It is able to detect and alert on abnormal behavior and potential security threats in real-time, such as crypto mining, file exfiltration, privilege escalation in applications, rootkit installs among many others. These malicious behaviors are detected via user-defined Falco rules that classify events of application activity as malicious or suspicious.