Falco on Ubuntu 24.04 LTS

Overview

Falco is the graduated Cloud Native Computing Foundation project for runtime threat detection. It taps the kernel's syscall stream, enriches each event with process, user and file context, and evaluates the result against a behavioural rule set, so it alerts on what a program actually did rather than on what it is called or what signature it matches. Its bundled rules already cover a large part of the way real intrusions look from the inside: a sensitive credentials file being read by a program that has no business reading it, an interactive shell appearing where none should exist, a kernel module being loaded, a process attaching a debugger to another process, a new binary written and then immediately executed, private keys or cloud credentials being searched for. Because the detections describe behaviour, they keep working against tooling nobody has catalogued yet.

Runtime detection is the layer that answers a question nothing else on the machine can. Vulnerability scanning tells you what could be exploited, and network controls tell you what can reach you, but neither tells you what an intruder is doing right now on a host that is already running. Falco fills that gap, and it is a natural companion to a network intrusion detection sensor rather than a replacement for one: the network sensor watches the packets, Falco watches the behaviour they lead to. Alerts are written as structured JSON, one object per line, which drops straight into a SIEM, a log pipeline or any alerting tool without parsing work.

Common uses

• Detect intrusions and privilege abuse on a running host in real time
• Feed structured runtime security alerts into a SIEM or log pipeline
• Satisfy a runtime threat detection control for an audit or compliance regime