Repositories list

• falco-talon

  Public
  Response Engine for managing threats in your Kubernetes

  securityfalcoresponse-engine+ 1kubernetes

  Go

  •

  Apache License 2.0

  •15•165•1•4•Updated Jul 15, 2025Jul 15, 2025

• libs

  Public
  libsinsp, libscap, the kernel module driver, and the eBPF driver sources

  kmodebpflibsinsp+ 2falco-driverslibscap

  C

  •

  Apache License 2.0

  •174•277•42•8•Updated Jul 15, 2025Jul 15, 2025

• falco-website

  Public
  Source code of the official Falco website

  securitydocumentationcontainers+ 2cncfhacktoberfest

  HTML

  •

  Creative Commons Attribution 4.0 International

  •237•39•9•6•Updated Jul 15, 2025Jul 15, 2025

• falcosidekick

  Public
  Connect Falco to your ecosystem

  dockerkubernetessecurity+ 4hacktoberfestfalcofalco-eventresponse-engine

  Go

  •

  Apache License 2.0

  •190•606•13•7•Updated Jul 15, 2025Jul 15, 2025

• plugin-sdk-go

  Public
  Falco plugins SDK for Go

  gosdkfalco-plugins

  Go

  •

  Apache License 2.0

  •17•26•3•1•Updated Jul 15, 2025Jul 15, 2025

• evolution

  Public
  Evolution process of The Falco Project

  kubernetesdeploymentexamples+ 3k8sadoptionfalco

  Go

  •

  Apache License 2.0

  •45•53•5•1•Updated Jul 15, 2025Jul 15, 2025

• test-infra

  Public
  Falco workflow & testing infrastructure

  automationbotsci+ 8cdgovernanceprowfalco-driverstesting-infrastructureprow-jobsfalco-prow+ 1

  HCL

  •

  Apache License 2.0

  •109•31•3•3•Updated Jul 15, 2025Jul 15, 2025

• plugins

  Public
  Falco plugins registry

  pluginregistryfalco+ 1falco-plugins

  Go

  •

  Apache License 2.0

  •89•98•14•25•Updated Jul 15, 2025Jul 15, 2025

• testing

  Public
  All-purpose test suite for Falco and its ecosystem

  Go

  •

  Apache License 2.0

  •10•14•2•0•Updated Jul 14, 2025Jul 14, 2025

• falco

  Public
  Cloud Native Runtime Security

  kubernetessecuritycontainers+ 7cncfcloud-nativeebpfhacktoberfestfalcoruntime-securitycncf-project

  C++

  •

  Apache License 2.0

  •941•8.1k•66•5•Updated Jul 14, 2025Jul 14, 2025

• plugin-sdk-rs

  Public
  Falco plugins SDK for Rust

  Rust

  •

  Apache License 2.0

  •3•11•0•0•Updated Jul 10, 2025Jul 10, 2025

• dbg-go

  Public
  A go tool to work with falcosecurity drivers build grid

  Go

  •

  Apache License 2.0

  •1•2•1•0•Updated Jul 9, 2025Jul 9, 2025

• falcoctl

  Public
  Administrative tooling for Falco

  Go

  •

  Apache License 2.0

  •62•108•3•8•Updated Jul 7, 2025Jul 7, 2025

• deploy-kubernetes

  Public
  Kubernetes deployment resources for Falco

  k8smanifestsfalco+ 4k8s-deploymentfalcosidekickk8s-manifestsfalco-exporter

  Apache License 2.0

  •15•16•0•0•Updated Jul 2, 2025Jul 2, 2025

• falco-operator

  Public
  Kubernetes Operator for Falco

  Go

  •

  Apache License 2.0

  •2•13•0•0•Updated Jul 2, 2025Jul 2, 2025

• charts

  Public
  Community managed Helm charts for running Falco with Kubernetes

  Go

  •

  Apache License 2.0

  •306•262•9•5•Updated Jul 1, 2025Jul 1, 2025

• driverkit

  Public
  Kit for building Falco drivers: kernel modules or eBPF probes

  Go

  •

  Apache License 2.0

  •52•65•0•3•Updated Jun 30, 2025Jun 30, 2025

• kernel-testing

  Public
  Ansible playbooks to provision firecracker VMs and run Falco kernel tests

  ansiblekerneltests+ 5ebpfignitefalcoruntime-securityfirecracker

  Dockerfile

  •

  Apache License 2.0

  •5•12•0•1•Updated Jun 25, 2025Jun 25, 2025

• rules

  Public
  Falco rule repository

  Go

  •

  Apache License 2.0

  •77•127•11•6•Updated Jun 24, 2025Jun 24, 2025

• kernel-crawler

  Public
  A tool to crawl Linux kernel versions

  Python

  •

  Apache License 2.0

  •13•17•0•1•Updated Jun 23, 2025Jun 23, 2025

• contrib

  Public
  Community sandbox to test-drive ideas/projects/code

  Python

  •

  Apache License 2.0

  •1•0•0•0•Updated Jun 17, 2025Jun 17, 2025

• community

  Public
  The Falco Project Community

  communityoffice-hourscncf-falco+ 1falco-community

  Apache License 2.0

  •21•57•0•0•Updated Jun 12, 2025Jun 12, 2025

• elftoolchain

  Public
  Local version of https://sourceforge.net/projects/elftoolchain/

  C

  •

  Other

  •0•0•0•0•Updated Jun 11, 2025Jun 11, 2025

• falco-actions

  Public
  Run Falco in a GitHub Actions to detect suspicious behavior in your CI/CD

  Python

  •

  Apache License 2.0

  •11•39•2•4•Updated Jun 10, 2025Jun 10, 2025

• cncf-green-review-testing

  Public
  Falco configurations intended for testing with the CNCF Green Reviews Working Group

  Apache License 2.0

  •2•3•0•0•Updated Jun 9, 2025Jun 9, 2025

• event-generator

  Public
  Generate a variety of suspect actions that are detected by Falco rulesets

  gosecuritysyscall+ 2security-testingkubernetes-auditing

  Go

  •

  Apache License 2.0

  •42•106•2•0•Updated May 27, 2025May 27, 2025

• syscalls-bumper

  Public
  A tool to automatically update supported syscalls in libs

  Go

  •

  Apache License 2.0

  •4•5•0•0•Updated May 14, 2025May 14, 2025

• falcosidekick-ui

  Public
  A simple WebUI with latest events from Falco

  Vue

  •

  Apache License 2.0

  •16•121•3•5•Updated Apr 16, 2025Apr 16, 2025

• client-go

  Public
  Go client and SDK for Falco

  clientfalcogo+ 2golanggrpc

  Go

  •

  Apache License 2.0

  •19•55•1•1•Updated Apr 16, 2025Apr 16, 2025

• falco-exporter

  Public
  Prometheus Metrics Exporter for Falco output events

  metricsprometheusprometheus-exporter+ 1falco

  Go

  •

  Apache License 2.0

  •34•122•0•1•Updated Apr 16, 2025Apr 16, 2025