← All tools

Falco

Runtime Security · Advanced

Runtime threat detection for containers/K8s.

Knowledge reference only. Prefer in-browser Labs first. Use this tool only on systems you own or have written authorization to test.

What to learn

  • Syscall rules
  • Alerts

Legitimate use

Runtime layer beyond image scanning.

Official docs →

Example commands (lab VMs only)

  • falco --list
    List rules