falco

Watch the cluster at runtime with Falco

Sep 6, 2026

Falco sits on syscalls and Kubernetes audit events. Custom rules go in falco_rules.local.yaml. Restart, then prove the rule fires.