{"id":5686,"url":"https://github.com/developer-guy/awesome-falco","name":"awesome-falco","description":"A curated list of Falco related tools, frameworks, blogs, podcasts, and articles","projects_count":68,"last_synced_at":"2026-07-22T23:00:19.870Z","repository":{"id":37544943,"uuid":"337955630","full_name":"developer-guy/awesome-falco","owner":"developer-guy","description":"A curated list of Falco related tools, frameworks, blogs, podcasts, and articles","archived":false,"fork":false,"pushed_at":"2021-07-28T08:11:27.000Z","size":127,"stargazers_count":202,"open_issues_count":1,"forks_count":22,"subscribers_count":10,"default_branch":"main","last_synced_at":"2026-07-04T08:03:16.357Z","etag":null,"topics":["awesome","container-runtime-security","falco","falco-outputs","falco-security","falcosidekick","kubernetes-security","sysdig-falco"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/developer-guy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-02-11T07:13:53.000Z","updated_at":"2026-06-29T01:20:55.000Z","dependencies_parsed_at":"2022-08-26T14:13:26.310Z","dependency_job_id":null,"html_url":"https://github.com/developer-guy/awesome-falco","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/developer-guy/awesome-falco","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/developer-guy%2Fawesome-falco","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/developer-guy%2Fawesome-falco/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/developer-guy%2Fawesome-falco/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/developer-guy%2Fawesome-falco/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/developer-guy","download_url":"https://codeload.github.com/developer-guy/awesome-falco/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/developer-guy%2Fawesome-falco/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35780803,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-22T02:00:06.236Z","response_time":124,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-01-06T22:54:28.602Z","updated_at":"2026-07-22T23:00:19.871Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["Blogs and Articles","Official projects","Videos","Slides","Podcasts","Interactive Learning","Support and Community","Community Repositories","IDE and Editor Integrations"],"sub_categories":["Blogs","Docs","Develop and Contribute","Learn and Connect","Repositories"],"readme":"# awesome-falco [![Awesome](https://awesome.re/badge.svg)](https://awesome.re)\n\n\u003cimg src=\"https://cncf-branding.netlify.app/img/projects/falco/horizontal/color/falco-horizontal-color.svg\" width=\"300\"\u003e\u003cbr/\u003e\u003cbr/\u003e\n\nA curated list of Falco related tools, frameworks and articles\n\n## Contents\n\n- 💼 [Official Projects](#official-projects)\n    - 📂 [Repositories](#repositories)\n    - 🗒️ [Docs](#docs)\n    - 📰 [Blogs](#blogs-and-articles)\n- 🐾 [Community Repositories](#community-repositories)\n- 🗃️ [Blogs and Articles](#blogs-and-articles)\n- 📹 [Videos](#videos)\n- 📑 [Slides](#slides)\n- 🎤 [Podcasts](#podcasts)\n- 🧪 [Interactive Learning](#interactive-learning)\n- 🧰 [IDE and Editor Integrations](#ide-and-editor-integrations)\n- 📡 [Support and Community](#support-and-community)\n     - 💊 [Develop and Contribute](#develop-and-contribute)\n     - 📆 [Learn and Connect](#learn-and-connect)\n\n\n## Official projects\n\n### Repositories\n\n- [Falco](https://github.com/falcosecurity/falco) - Cloud Native Runtime Security\n- [Falco Libs](https://github.com/falcosecurity/libs) - libsinsp, libscap, the kernel module driver, and the eBPF driver sources\n- [Falcosidekick](https://github.com/falcosecurity/falcosidekick) - A simple daemon to help you with falco's outputs\n- [Falcosidekick UI](https://github.com/falcosecurity/falcosidekick-ui) - A simple WebUI with latest events from Falco\n- [falcoctl](https://github.com/falcosecurity/falcoctl) - Administrative tooling for Falco.\n- [Falcosecurity Evolution](https://github.com/falcosecurity/evolution) - Evolution process of The Falco Project\n- [Falco Event Generator](https://github.com/falcosecurity/event-generator) - Generate a variety of suspect actions that are detected by Falco rulesets\n\n### Docs\n\n- [Falco](https://falco.org/docs/) - Official Falco documentation\n\n### Blogs\n\n- [Falco](https://falco.org/blog/) - Official blog for the Falco project\n- [Sysdig Blog](https://sysdig.com/blog/?s=\u0026sd-tax-sysdig-open-source%5B%5D=sysdig-falco) - Explore Sysdig resources for whitepapers, videos, webinars, case studies, and more. Embed security, compliance and monitoring into DevOps workflows. \n\n## Community Repositories\n\n- [Extending Falco outputs with Falcosidekick by developer-guy](https://github.com/developer-guy/extending-falco-outputs-with-falcosidekick)\n- [Falco workshop by vicenteherrera](https://github.com/vicenteherrera/falco-workshop)\n- [Container Runtime Security with Falco by developer-guy](https://github.com/developer-guy/container-runtime-security-with-falco)\n- [falco-filebeat-daemonset by Popsiclestick](https://github.com/Popsiclestick/falco-filebeat-daemonset) - Easily deployable daemonset which moves logs from falco with filebeat\n- [Falco Diagrams: Visually learn Falco and its eBPF probe](https://github.com/leodido/falco-diagrams)\n\n## Blogs and Articles\n\n- [Using Falco to monitor outbound traffic for Pods in Kubernetes](https://www.rkatz.xyz/post/2021-04-16-falco-network-monitoring/)\n- [Installing and using sysdig falco by Spencer Krum](https://developer.ibm.com/tutorials/installing-and-using-sysdig-falco/)\n- [Falco Container Native Security by cloudpirate](https://www.cloudpirate.io/blog/falco-container-native-runtime-security-40608.html)\n- [Kubernetes Security monitoring at scale with Sysdig Falco by Skyscanner Engineering](https://medium.com/@SkyscannerEng/kubernetes-security-monitoring-at-scale-with-sysdig-falco-a60cfdb0f67a)\n- [Container Host Security Demo - Falco for GitLab 13.2 by GitLab Unfiltered](https://www.youtube.com/watch?v=WxBzBz76FxU)\n- [Kubernetes Security With Falco by Gaurav Agarwal](https://medium.com/better-programming/kubernetes-security-with-falco-2eb060d3ae7d)\n- [Hunting for Malware with Falco by dlorenc](https://dlorenc.medium.com/hunting-for-malware-with-falco-834b19b398c9)\n- [Container runtime security in Kubernetes with Falco by gatesch](https://medium.com/@gatesch/container-runtime-security-in-kubernetes-with-falco-904cd713054a)\n- [Getting Started with Falco Runtime Security and Cloud Native Distributed SQL on Google Kubernetes Engine by yugabyte](https://medium.com/yugabyte/getting-started-with-falco-runtime-security-and-cloud-native-distributed-sql-on-google-kubernetes-477b2471535c)\n- [Integrating Falco and Your CI/CD Pipeline by ravilach](https://ravilach.medium.com/integrating-falco-and-your-ci-cd-pipeline-870152795282)\n- [Deploying Falco to Kubernetes by glentomkowiak](https://medium.com/@glentomkowiak/deploying-falco-to-kubernetes-4d950cf46119)\n- [Play by Play Security with Sysdig and Falco by avinash_vjti](https://medium.com/@avinash_vjti/play-by-play-security-with-sysdig-and-falco-22ce397271ed)\n- [What is Falco, and how it work with Kubernetes by jihadbenabra](https://jihadbenabra.medium.com/what-is-falco-and-how-it-work-with-kubernetes-44f5dbb985cb)\n- [Security Sprint: Falco by terceranexus6](https://dev.to/terceranexus6/security-sprint-falco-e0o)\n- [Runtime Security with Falco by Pawan Shankar](https://rancher.com/blog/2020/runtime-security-with-falco)\n- [Implementing Runtime Security in Amazon EKS using CNCF Falco by Anand Krishna](https://aws.amazon.com/blogs/containers/implementing-runtime-security-in-amazon-eks-using-cncf-falco/)\n- [Security with Falco by Radhika Rajesh](https://dzone.com/articles/security-with-falco)\n- [Falco is the First Runtime Security Project to be Accepted into CNCF Incubator by Matt Campbell](https://www.infoq.com/news/2020/01/falco-security-cncf/)\n- [An Introduction to Kubernetes Security using Falco by Frederick Fernando](https://www.infracloud.io/blogs/introduction-kubernetes-security-falco/)\n- [Kubernetes Audit Log Falco by Pawan Shankar](https://sysdig.com/blog/kubernetes-audit-log-falco/)\n- [K3s Sysdig Falco by Dan Papandrea](https://sysdig.com/blog/k3s-sysdig-falco/)\n- [Falco Security and Monitoring on RKE Bare Metal Cluster with Rancher by Frank Jogeleit](https://blog.webdev-jogeleit.de/blog/falco-security-and-monitoring-on-rke-bare-metal-cluster-with-rancher)\n- [Falco at the edge arm64 by Alex Ellis](https://blog.alexellis.io/falco-at-the-edge-arm64/)\n- [Analyze AWS EKS Audit logs with Falco by Ismail Yenigul](https://medium.com/faun/analyze-aws-eks-audit-logs-with-falco-95202167f2e)\n- [Sysdig contributes Falco's kernel module, eBPF probe, and libraries to the CNCF by Loris Degioanni](https://sysdig.com/blog/sysdig-contributes-falco-kernel-ebpf-cncf/)\n- [Contribution of the drivers and the libraries By Leonardo Di Donato, Leonardo Grasso](https://falco.org/blog/contribution-drivers-kmod-ebpf-libraries/)\n- [Runtime security in Azure Kubernetes Service by Eric Carter](https://sysdig.com/blog/runtime-security-in-azure-kubernetes-service/)\n- [A story about touching Falco by RyuSA](https://translate.google.com/translate?hl=fr\u0026sl=ja\u0026u=https://zenn.dev/ryusa/scraps/f2807017e0b58c\u0026prev=search\u0026pto=aue)\n- [AWS S3 security with CloudTrail and Falco By Alba Ferri](https://sysdig.com/blog/aws-s3-security-cloudtrail-falco/)\n- [Detecting MITRE ATT\u0026CK: Privilege escalation with Falco By Stefano Chierici](https://sysdig.com/blog/mitre-privilege-escalation-falco)\n- [Exploiting and detecting CVE-2021-25735: Kubernetes validating admission webhook bypass By Stefano Chierici](https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/)\n- [Pick-up Container Security Project Falco](https://www.programmersought.com/article/95228502147/)\n\n## Videos\n\n- [Container Runtime Security with Falco by Kubernetes Meetup Tokyo](https://www.youtube.com/watch?v=t-7sq1_wYP4)\n- [Sysdig Falco - Open Source Docker Security - WTF my container just spawned a shell by Sysdig](https://www.youtube.com/watch?v=eCC_RFlyxkg)\n- [Intro to Falco: Intrusion Detection for Containers - Shane Lawrence, Shopify by Shane Lawrence](https://www.youtube.com/watch?v=rBqBrYESryY)\n- [Webinar: Getting started with container runtime security using Falco by Loris Degioanni](https://www.youtube.com/watch?v=eqZxd7VJzek)\n- [Kubernetes Master Class - 2020-04-20 - Detecting Anomalous Kubernetes Activity with Falco by Rancher Labs](https://www.youtube.com/watch?v=M3f6-ioY9rs)\n- [Unveil hidden malicious processes with Falco in cloud-native environments by Kaizhe Huang](https://securitysandman.com/2021/04/12/falco-ioc-detection-on-k8-wip/)\n\n## Slides\n\n- [Kubernetes Runtime Security with Falco and Sysdig by Jorge Salamero](https://www.cncf.io/wp-content/uploads/2020/08/Kubernetes-Runtime-Security-with-Falco-and-Sysdig.pdf)\n- [Getting Started with Runtime Security using Falco by Loris Degioanni](https://www.cncf.io/wp-content/uploads/2020/07/CNCF_-Getting-Started-with-Runtime-Security-using-Falco_2020.09.02.pptx)\n\n## Podcasts\n\n- [Falco by Thomas Labarussias](https://electro-monkeys.fr/?tag=falco)\n- [Kubelist Podcast on Falco with @danpopsd](https://www.heavybit.com/library/podcasts/the-kubelist-podcast/ep-9-falco-with-dan-pop-papandrea-of-sysdig/) \n\n## Interactive Learning\n\n- [Container Runtime Security with Falco by falco](https://katacoda.com/falco/courses/falco/falco)\n- [Sysdig Falco: Container security monitoring by mateobur](https://www.katacoda.com/mateobur/scenarios/falco)\n- [Blocking security threats with Falco Response Engine by Falco](https://katacoda.com/falco/courses/falco/falco-response-engine)\n\n## IDE and Editor Integrations\n\n- [VS Code plugin](https://github.com/sysdiglabs/vscode-falco) - Falco Rules helpers for VSCode\n\n## Support and Community\n\n### Develop and Contribute\n\n- [Slack](https://kubernetes.slack.com/messages/falco) - Chat with other project developers\n- [Developer mailing list](https://lists.cncf.io/g/cncf-falco-dev) - Discuss development issues around the project\n- [Contributor of the Month](https://falco.org/docs/contribute/contributor-of-the-month/) - View the contributors of the month\n\n### Learn and Connect\n\n- [Twitter](https://twitter.com/falco_org) - Follow us on Twitter to get the latest news!\n- [User mailing list](https://lists.cncf.io/g/cncf-falco-dev/) - Discussion and help from your fellow users\n- [StackOverflow](https://stackoverflow.com/questions/tagged/falco) - Practical questions and curated answers\n- [Calendar](https://lists.cncf.io/g/cncf-falco-dev/calendar) - Subscribe to the Falco calendar, through this ics feed\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/developer-guy%2Fawesome-falco/projects"}