Description

Falco is an open-source cloud-based runtime security tool designed for security professionals. It enables users to create detection rules to define unexpected application behavior, streamline rules through context from the cloud provider and Kubernetes environments, identify policy violations using community-sourced detection, respond to policy violation alerts, generate false positives by tuning policies, as well as capture activity for incident response. Features include machine learning support, remediation automation, eBPF probe support, gRPC leveraging capability, Kernel module probe capability, and context management.