You are viewing documentation for Falco version: v0.38.2

Falco v0.38.2 documentation is no longer actively maintained. The version you are currently viewing is a static snapshot. For up-to-date documentation, see the latest version.

Blog

Do you have something to share? Contribute to Falco blog!

Featured Image for Choosing a Falco driver
Kris Nóva Sep 23, 2020
Choosing a Falco driver

Falco works by taking Linux system call information at runtime, and rebuilding the state of the kernel in memory. The Falco engine depends on a driver in order to consume the raw stream of system call information. Currently the Falco …