Falco
Free · OSSHost & Endpoint
Runtime security that sees inside running containers and the kernel.
Falco homepage ↗Runtime security for Linux and containers. Catches "someone just spawned a shell inside a running container" and "a process is reading /etc/shadow" in real time. CNCF-graduated, container-native.
Production-shippable, newer or thinner field coverage. Watch the changelog before pinning compliance claims.
What it watches
- A shell spawned inside a running container
- A process reading sensitive files (/etc/shadow, cloud credentials)
- Unexpected outbound connections from a pod or process
- Privilege escalation + Linux capability changes
- Writes to system binaries or startup paths
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
8 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| falco_critical | Falco critical event on falco |
| falco_warning | Falco warning on falco |
| falco_notice | Falco notice on falco |
| falco_info | Falco info event on falco |
| falco_debug | Falco debug on falco |
| falco_error | Falco error on falco |
| falco_malformed | Malformed Falco log on falco |
| falco_other | Runtime detection on falco |
What it helps you catch
What you'd see in CyberCLI
illustrativeCatches a container breakout in the act — a shell where no shell should ever run.
Routed to Warden (triage) → Knight (detection)
⛓ every step hash-chained · replayable
What CyberCLI reads from Falco
audit our mathFalco emits one JSON detection per syscall or k8s-audit rule firing. The 15 fields we read carry the rule that matched (falco_rule, falco_priority, falco_tags), process context (proc_name, proc_pname, proc_cmdline, proc_pid), container/pod identity (container_id, container_name, container_image, k8s_namespace, k8s_pod), the user, and — for k8s_audit — the API verb, resource, target, and response code. Priority maps 1:1 to rule_level, so a Falco Critical lands at the same severity as a Wazuh L7.
Full field index · 15 fields ↓
.action.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.detail.event_id.event_type.falco_priority.falco_rule.falco_source.falco_tags.host.rule_level MITRE techniques typically mapped
- T1059 ↗
Command and Scripting InterpreterExecution
- T1611 ↗
Escape to HostPrivilege Escalation
- T1610 ↗
Deploy ContainerDefense Evasion · Execution
- T1613 ↗
Container and Resource DiscoveryDiscovery
- T1548 ↗
Abuse Elevation Control MechanismPrivilege Escalation · Defense Evasion
- T1552.001 ↗
Credentials In FilesCredential Access
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest the rule firing, notify Herald, summarize the process/container/pod chain for the case
- ·L3 (Knight verification): correlate proc_cmdline with TI feeds, check image reputation, query the EDR for downstream activity on the same container — read-only
- ·L4+: containment — Falco is detection-only; killing a pod, cordoning a node, or stopping a container routes through container-runtime / EDR / k8s connectors, not Falco itself
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/falco/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
Falco covers 5 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Install Falco on your container hosts / k8s nodes (one-liner below).
- 2 Enable JSON output (file or gRPC).
- 3 Run `cybercli onboard falco` and point it at the event source.
- 4 Confirm rule alerts in the dashboard's Connectors panel.
curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | sudo gpg --dearmor -o /usr/share/keyrings/falco.gpg && sudo apt install falco
Fully local. Falco watches the kernel + containers on your hosts; CyberCLI reads its events in-network.