Falco alerts

falco -r <rules.yaml>

Run Falco with a custom rule set to detect anomalous behavior in real time: shells, container escapes, suspicious writes.

Deploy Falco when you want real-time behavioral detection on your hosts and containers: the engine (the same one as sysdig) evaluates every syscall against the rules and alerts instantly — a shell inside a container, a process writing to /etc, an outbound connection from a pod, a privilege escalation. With -r you load your rules (or the official falcosecurity ones) and the output goes to stdout, to a file, or to a collector (falco-exporter, Pulsar, webhook). It is the standard runtime security piece in Kubernetes and the open source alternative to commercial runtime agents.

Do not deploy it without calibration: Falco's default rules generate constant alerts in environments with legitimate activity (kubectl exec, startup shells, agents writing to /tmp) — without tuning and prioritization, the noise kills the signal and the team ends up ignoring alerts. On high-performance hosts, Falco has CPU cost (every syscall goes through the engine): measure the impact before putting it in production. And watch out: Falco sees syscalls, not intent — an attacker using legitimate tools (curl, kubectl) with normal behavior can go unnoticed; it is a layer, not a silver bullet.