Falco
Falco is a core monitoring and detection agent that observes events such as system calls based on special rules. Container runtime and Kubernetes enrich these events by integrating incoming metadata. The events collected can be analyzed outside the mainframe in SIEM or data lake systems.
Falco
100falcosecurity · SIEM & Security Monitoring
Common commercial products in this category: Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel
- You observe events such as system calls based on special rules
- You enrich events with container runtime and Kubernetes metadata
- Analyze collected events in SIEM or data lake systems
- ↓ NegativeGitHub Issue
OOM on physical servers
“**Describe the bug** Pn 0.34.x releases we do experience mem leak on physical instances, while the same setup on AWS is fine. It could be due node workload, but still its clear mem leak. Actually as of now RC not identified, - looking for help to do some mem profile or debug the…”
- • NeutralGitHub Issue
Falco on GKE - dropped syscall events
“**What happened**: Falco is constantly dropping events on a really small GKE cluster (3 nodes) and 9 containers (excluding Google services containers) **What you expected to happen**: I would expect that for a cluster of such size that falco would have no issues handling the…”