falco(8)
Falco is a runtime security monitoring and detection engine that tracks system calls and kernel events to detect suspicious behavior and policy violations.
Synopsis
falco [OPTIONS] [-o OUTPUT_FORMAT] [-D RULE_FILE]Description
Falco monitors system-level activity by analyzing kernel syscalls and events in real-time. It compares observed behavior against a set of security rules to detect anomalies, intrusions, and policy violations. Falco can run as a daemon or in the foreground and outputs alerts when suspicious patterns match defined rules.
Common use cases include detecting unauthorized process execution, file access violations, network connections from unexpected sources, and privilege escalation attempts. Falco integrates with container platforms like Kubernetes and Docker to provide runtime security.
Common options
| Flag | What it does |
|---|---|
-o, --output | Output format for alerts: json, text, csv (default: json) |
-D, --daemon | Run Falco as a daemon in the background |
-c, --config | Path to the Falco configuration file |
-r, --rules | Path to a specific rules file to load (can be used multiple times) |
-l, --list | List all loaded rules and exit |
-p, --print | Print default rules to stdout and exit |
-e, --events | Specify which events to capture (advanced filtering) |
-k, --k8s-audit | Enable Kubernetes audit logging integration |
-v, --validate-rules | Validate rules syntax without running Falco |
-M, --multiplier | Multiplier for system call buffer size |
Examples
Run Falco in the foreground with default rules, displaying alerts in real-time
sudo falcoStart Falco as a daemon using a custom configuration file
sudo falco -D -c /etc/falco/falco.yamlLoad a custom rules file and output alerts in JSON format
sudo falco -r /path/to/custom_rules.yaml -o jsonList all loaded rules with their descriptions and conditions
sudo falco -lValidate rules syntax without actually running the monitoring engine
sudo falco -v -r /etc/falco/rules.yamlRun Falco and redirect CSV-formatted alerts to a file for analysis
sudo falco -c /etc/falco/falco.yaml -o csv > alerts.csvMonitor Kubernetes audit logs using Falco rules specific to cluster events
sudo falco -k /etc/falco/rules/k8s_audit_rules.yaml