Runtime threat detection for containers and hosts
CNCF graduated project that watches Linux system calls (via eBPF or a kernel module) and raises alerts when rules detect suspicious behaviour.
Falco collects kernel events such as system calls and enriches them with container and Kubernetes metadata. Rules written in YAML describe suspicious behaviour, for example a shell spawned inside a container or an unexpected write to a sensitive directory, and Falco emits an alert when they match.
It also ingests other event sources through plugins, such as Kubernetes audit logs and cloud audit trails. Falco is a graduated project of the Cloud Native Computing Foundation.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
8 published advisories for Falco in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.
GHSA-7cq5-h4p2-h37plow2025-04-30
Unsupported detection of asynchronous io_uring operations
GHSA-6v9j-2vm2-ghf7CVE-2022-26316medium2022-03-11
TOCTOU issue that could lead to rule bypass
GHSA-c7mr-v692-9p4gcritical2021-05-07
Undetected crash of the kernel module disables Falco
GHSA-rfgw-vmxp-hp5ghigh2021-05-07
Default rules can be bypassed with different techniques
GHSA-qfjf-hpq4-6m37low2021-05-07
Security flags not enforced my CMake-files
GHSA-cxrc-f2j2-3rj3low2021-04-19
Dependencies pulled via hard-coded HTTP links
GHSA-wr4f-m7x5-g6x7high2021-04-19
HTTP request with incorrect data leads to crashes
GHSA-q77j-vxxw-mwgjhigh2021-04-19
Concurrent requests towards Lua state can lead to crashes
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
Kubernetes security posture and compliance scanner
CNCF project that scans clusters, manifests and Helm charts against frameworks such as the NSA-CISA guidance and CIS Benchmarks, and scans images.
CIS Kubernetes Benchmark checks
Aqua Security tool that checks whether Kubernetes nodes and control-plane components are configured according to the CIS Kubernetes Benchmark.
Query your endpoints with SQL
Exposes the operating system as a relational database so processes, users, packages and configuration can be queried with SQL on Linux, macOS and Windows.
Open-source XDR and SIEM platform
Security platform combining an endpoint agent, a manager and an indexer for log analysis, intrusion detection, file integrity monitoring and compliance.
Endpoint visibility and digital forensics at scale
DFIR tool that collects forensic artefacts and hunts across fleets of endpoints with its query language VQL, from a single server binary.
