Falco
Security detections from runtime events
What it does
Falco uses Linux kernel events and other plugin data sources to apply rules to runtime behavior across hosts, containers, and Kubernetes, enriching the resulting event information for investigation.
When to use it
For container behavior monitoring, consult rule and event references to understand triggering conditions, the related process, and the content emitted in alerts.
