Falco, Kubernetes threat detection, graduates within the CNCF

2024-02-29 · Publisher : CNCF · Domain : Cloud & DevOps

On 29 February 2024, the CNCF announces the graduation of Falco, the open source runtime threat-detection engine created by Sysdig, which relies on Linux kernel events and eBPF.

### Background On 29 February 2024, the Cloud Native Computing Foundation announces that **Falco** moves to the *Graduated* level, the highest in its hierarchy. Falco is a runtime security tool for Linux, presented by the CNCF as the de facto Kubernetes threat detection engine: it applies custom rules to kernel events and raises real-time alerts. ### Key facts - Created and open-sourced by Sysdig in 2016, accepted into the CNCF Sandbox in 2018, moved to Incubating in April 2020. - Since incubation: +400% active contributors, +526% total downloads and +135% average monthly downloads (CNCF figures). - More than 30 public adopters, including Cisco, Shopify, Skyscanner, Vinted, Booz Allen Hamilton, GitLab and Qonto. - Recent improvements cited: a new eBPF probe, better test suites, a kernel testing framework and additional data sources. ### Why it matters The Graduated level is the CNCF's most demanding: demonstrated production adoption and proven governance. For an IT services firm building Kubernetes platforms, Falco becomes a runtime intrusion-detection building block that can be defended in front of a CISO: open source, neutral governance, used by varied organizations. The real cost remains operations: writing, tuning and triaging rules to avoid false positives. Falco relies on eBPF, which places it at the crossroads of security and kernel observability. ### Takeaway Falco joins the CNCF projects considered production-ready: runtime detection becomes a standard option for Kubernetes platforms.

Tags : Sécurité, Kubernetes, eBPF, Open Source, Cloud natif