Falco
Open source runtime-security för Linux + Kubernetes. Sysdig 2016, CNCF Graduated 2024. eBPF-baserad. Detect anomalous behavior: shell-in-container, write-to-system-dir, sensitive-file-read. Default-rules + custom-Yaml-policies.
Use case: container-escapes, cryptojacking-detection, accidental privileged-operations. Output: stdout, JSON, syslog, gRPC. Falcosidekick: forwards events to 60+ destinations (Slack, PagerDuty, Datadog). Falco Operator: deploy + manage på Kubernetes. Konkurrent: Tetragon (Cilium), Tracee (Aqua Security), commercial (CrowdStrike, Wiz). Performance-overhead: 1-5% CPU på typical-workloads. Default-rules: 100+ för common threats. Modern security-stack: Falco + Polkit + AppArmor/SELinux för defense-in-depth.