Repositories list

• charts

  Public
  Community managed Helm charts for running Falco with Kubernetes

  Go

  •

  Apache License 2.0

  •299•251•13•7•Updated Feb 5, 2025Feb 5, 2025

• rules

  Public
  Falco rule repository

  Go

  •

  Apache License 2.0

  •70•105•6•3•Updated Feb 5, 2025Feb 5, 2025

• falco

  Public
  Cloud Native Runtime Security

  kubernetessecuritycontainers+ 7cncfcloud-nativeebpfhacktoberfestfalcoruntime-securitycncf-project

  C++

  •

  Apache License 2.0

  •912•7.6k•66•6•Updated Feb 5, 2025Feb 5, 2025

• evolution

  Public
  Evolution process of The Falco Project

  kubernetesdeploymentexamples+ 3k8sadoptionfalco

  Go

  •

  Apache License 2.0

  •43•49•6•1•Updated Feb 5, 2025Feb 5, 2025

• falco-talon

  Public
  Response Engine for managing threats in your Kubernetes

  securityfalcoresponse-engine+ 1kubernetes

  Go

  •

  Apache License 2.0

  •13•148•2•3•Updated Feb 5, 2025Feb 5, 2025

• libs

  Public
  libsinsp, libscap, the kernel module driver, and the eBPF driver sources

  kmodebpflibsinsp+ 2falco-driverslibscap

  C

  •

  Apache License 2.0

  •170•254•47•22•Updated Feb 5, 2025Feb 5, 2025

• falco-website

  Public
  Source code of the official Falco website

  securitydocumentationcontainers+ 2cncfhacktoberfest

  HTML

  •

  Creative Commons Attribution 4.0 International

  •227•37•9•4•Updated Feb 4, 2025Feb 4, 2025

• plugins

  Public
  Falco plugins registry

  pluginregistryfalco+ 1falco-plugins

  Go

  •

  Apache License 2.0

  •83•87•7•7•Updated Feb 4, 2025Feb 4, 2025

• deploy-kubernetes

  Public
  Kubernetes deployment resources for Falco

  k8smanifestsfalco+ 4k8s-deploymentfalcosidekickk8s-manifestsfalco-exporter

  Apache License 2.0

  •16•14•0•0•Updated Feb 4, 2025Feb 4, 2025

• plugin-sdk-go

  Public
  Falco plugins SDK for Go

  gosdkfalco-plugins

  Go

  •

  Apache License 2.0

  •17•26•4•1•Updated Feb 4, 2025Feb 4, 2025

• falcosidekick

  Public
  Connect Falco to your ecosystem

  dockerkubernetessecurity+ 4hacktoberfestfalcofalco-eventresponse-engine

  Go

  •

  Apache License 2.0

  •186•566•6•1•Updated Feb 4, 2025Feb 4, 2025

• test-infra

  Public
  Falco workflow & testing infrastructure

  automationbotsci+ 8cdgovernanceprowfalco-driverstesting-infrastructureprow-jobsfalco-prow+ 1

  HCL

  •

  Apache License 2.0

  •109•31•3•3•Updated Feb 4, 2025Feb 4, 2025

• kernel-testing

  Public
  Ansible playbooks to provision firecracker VMs and run Falco kernel tests

  ansiblekerneltests+ 5ebpfignitefalcoruntime-securityfirecracker

  Dockerfile

  •

  Apache License 2.0

  •5•11•0•1•Updated Feb 3, 2025Feb 3, 2025

• falcoctl

  Public
  Administrative tooling for Falco

  Go

  •

  Apache License 2.0

  •60•90•4•3•Updated Feb 3, 2025Feb 3, 2025

• kernel-crawler

  Public
  A tool to crawl Linux kernel versions

  Python

  •

  Apache License 2.0

  •13•17•0•0•Updated Jan 30, 2025Jan 30, 2025

• community

  Public
  The Falco Project Community

  communityoffice-hourscncf-falco+ 1falco-community

  Apache License 2.0

  •21•53•0•0•Updated Jan 29, 2025Jan 29, 2025

• event-generator

  Public
  Generate a variety of suspect actions that are detected by Falco rulesets

  gosecuritysyscall+ 2security-testingkubernetes-auditing

  Go

  •

  Apache License 2.0

  •41•101•3•6•Updated Jan 28, 2025Jan 28, 2025

• dbg-go

  Public
  A go tool to work with falcosecurity drivers build grid

  Go

  •

  Apache License 2.0

  •1•2•1•0•Updated Jan 27, 2025Jan 27, 2025

• plugin-sdk-cpp

  Public
  Falco plugins SDK for C++

  C++

  •

  Apache License 2.0

  •11•3•0•0•Updated Jan 27, 2025Jan 27, 2025

• driverkit

  Public
  Kit for building Falco drivers: kernel modules or eBPF probes

  Go

  •

  Apache License 2.0

  •52•65•1•0•Updated Jan 27, 2025Jan 27, 2025

• falco-rustlings

  Public
  Small exercises to get you used to writing Falco plugins in Rust 🦀

  Rust

  •

  Apache License 2.0

  •1•5•0•1•Updated Jan 16, 2025Jan 16, 2025

• testing

  Public
  All-purpose test suite for Falco and its ecosystem

  Go

  •

  Apache License 2.0

  •11•14•3•1•Updated Jan 15, 2025Jan 15, 2025

• falco-aws-terraform

  Public
  Terraform Module for Falco AWS Resources

  HCL

  •

  Apache License 2.0

  •6•6•0•0•Updated Jan 14, 2025Jan 14, 2025

• plugin-sdk-rs

  Public
  Falco plugins SDK for Rust

  Rust

  •

  Apache License 2.0

  •2•7•0•1•Updated Jan 14, 2025Jan 14, 2025

• syscalls-bumper

  Public
  A tool to automatically update supported syscalls in libs

  Go

  •

  Apache License 2.0

  •5•5•0•0•Updated Jan 13, 2025Jan 13, 2025

• elftoolchain

  Public
  Local version of https://sourceforge.net/projects/elftoolchain/

  C

  •

  Other

  •0•0•0•0•Updated Jan 7, 2025Jan 7, 2025

• falco-exporter

  Public
  Prometheus Metrics Exporter for Falco output events

  metricsprometheusprometheus-exporter+ 1falco

  Go

  •

  Apache License 2.0

  •34•121•0•0•Updated Dec 19, 2024Dec 19, 2024

• falco-actions

  Public
  Run Falco in a GitHub Actions to detect suspicious behavior in your CI/CD

  Python

  •

  Apache License 2.0

  •4•8•0•0•Updated Dec 12, 2024Dec 12, 2024

• cncf-green-review-testing

  Public
  Falco configurations intended for testing with the CNCF Green Reviews Working Group

  Apache License 2.0

  •3•3•1•0•Updated Dec 12, 2024Dec 12, 2024

• falcosidekick-ui

  Public
  A simple WebUI with latest events from Falco

  Vue

  •

  Apache License 2.0

  •16•116•2•0•Updated Dec 9, 2024Dec 9, 2024