Falco is an open-source cloud-native runtime security tool designed to detect and alert on anomalous behavior and potential security threats in containers, Kubernetes, and cloud environments.
Why this server?
Ingests Falco runtime security scanner output as a data source for attack-path analysis and runtime confirmation.
Why this server?
Enables deployment and management of Falco rules for eBPF-based runtime security monitoring.
Why this server?
Provides tools for querying and retrieving Falco security events from Falcosidekick UI, including normalized event data from syscall, Kubernetes audit, and AWS CloudTrail sources, with support for temporal filtering and full event inspection by UUID.
Why this server?
Integrates Falco for runtime security monitoring of containers and Kubernetes to detect anomalous behavior.