1. What Falco Is Falco is a cloud-native runtime security project contributed to the CNCF by Sysdig. Falco implements an extensible event rule filtering engine. Through a series of operations — capturing events, matching security rules, and producing alert notifications — it can surface security problems in a system. The events come from system calls, and it also supports an ebpf probe; the rules are open source [1] and you can define your own extensions [2].