You are viewing documentation for Falco version: v0.38.2

Falco v0.38.2 documentation is no longer actively maintained. The version you are currently viewing is a static snapshot. For up-to-date documentation, see the latest version.

Getting Started

Getting started with Falco

Falco is a cloud-native security tool. It provides near real-time threat detection for cloud, container, and Kubernetes workloads by leveraging runtime insights. Falco can monitor events defined via customizable rules from various sources, including the Linux kernel, and enrich them with metadata from the Kubernetes API server, container runtime, and more. Falco supports a wide range of kernel versions, x86_64 and ARM64 architectures, and many different output channels.

Try it now

Get started on your Linux host or Kubernetes cluster.

Docker
Try Falco with Docker
Run Falco on your host with a Docker container
Kubernetes
Try Falco on Kubernetes
Install Falco and Falcosidekick on your Kubernetes cluster with Helm
Ubuntu
Try Falco on Ubuntu
Run Falco on your host or set up a Vagrant VM to try it