# Falco **URL:** https://community.sysdig.com/c/communities/falco/6.md [Latest](https://community.sysdig.com/latest.md) · [Categories](https://community.sysdig.com/categories.md) · [Tags](https://community.sysdig.com/tags.md) --- ## [About the Falco category](https://community.sysdig.com/t/about-the-falco-category/484)
**Author:** [@system](https://community.sysdig.com/u/system)\ **Replies:** 0\ **Last updated:** [July 23, 2025, 8:10pm UTC](https://community.sysdig.com/t/about-the-falco-category/484 "2025-07-23T20:10:43Z")
Falco provides real-time detection capabilities for environments from individual containers, hosts, Kubernetes and the cloud. It is able to detect and alert on abnormal behavior and potential security threats in real-tim… --- ## [Tuning Sysdig Falco egress rules for third-party Android tool testing environments](https://community.sysdig.com/t/tuning-sysdig-falco-egress-rules-for-third-party-android-tool-testing-environments/788)
**Author:** [@michael.anderson](https://community.sysdig.com/u/michael.anderson)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 12:19pm UTC](https://community.sysdig.com/t/tuning-sysdig-falco-egress-rules-for-third-party-android-tool-testing-environments/788 "2026-10-21T12:19:01Z")
We recently noticed a spike in runtime alerts inside Sysdig Secure triggered by our standard Falco rule for unexpected outbound network connections in a staging cluster. The pod in question was running automated tests fo… --- ## [Troubleshooting intermittent Falco egress alerts for API calls](https://community.sysdig.com/t/troubleshooting-intermittent-falco-egress-alerts-for-api-calls/780)
**Author:** [@alicia](https://community.sysdig.com/u/alicia)\ **Replies:** 0\ **Last updated:** [October 5, 2026, 8:32pm UTC](https://community.sysdig.com/t/troubleshooting-intermittent-falco-egress-alerts-for-api-calls/780 "2026-10-05T20:32:38Z")
We recently deployed the Sysdig agent across our staging GKE cluster to monitor runtime network behavior, but we are running into an issue with unexpected rule triggers. Our backend microservices regularly poll external … --- ## [Mark your calendars for next week - Falco Virtual Community Workshop](https://community.sysdig.com/t/mark-your-calendars-for-next-week-falco-virtual-community-workshop/771)
**Author:** [@LibbySchulze](https://community.sysdig.com/u/LibbySchulze)\ **Replies:** 0\ **Last updated:** [May 20, 2026, 7:16pm UTC](https://community.sysdig.com/t/mark-your-calendars-for-next-week-falco-virtual-community-workshop/771 "2026-05-20T19:16:39Z")
:locked: Free Workshop | May 26 | 10 AM BST | 11 AM CEST | 3.30 PM IST Cloud security moves fast, and staying ahead of threats takes more than just the right tools. On May 26, we’re hosting a free 60-minute hands-on wor… --- ## [Prempti - policy and visibility layer for AI coding agents](https://community.sysdig.com/t/prempti-policy-and-visibility-layer-for-ai-coding-agents/768)
**Author:** [@jonasrosland](https://community.sysdig.com/u/jonasrosland)\ **Replies:** 0\ **Last updated:** [May 12, 2026, 2:12pm UTC](https://community.sysdig.com/t/prempti-policy-and-visibility-layer-for-ai-coding-agents/768 "2026-05-12T14:12:00Z")
Excited to share something awesome the team has been working on: Prempti, a policy and visibility layer for AI coding agents. If you’re running Claude Code or similar tools day to day, you’ve probably wondered at some p… --- ## [Falco ruleset: OSS2Falco](https://community.sysdig.com/t/falco-ruleset-oss2falco/765)
**Author:** [@sammonsempes](https://community.sysdig.com/u/sammonsempes)\ **Replies:** 0\ **Last updated:** [May 6, 2026, 4:01pm UTC](https://community.sysdig.com/t/falco-ruleset-oss2falco/765 "2026-05-06T16:01:32Z")
Sharing a Falco ruleset I put together, based on detection logic from LinPEAS, Sigma and Splunk. Drop it in your Falco config and you’re good to go Stars welcome :star: --- ## [Join the Falco CNCF livestream next week!](https://community.sysdig.com/t/join-the-falco-cncf-livestream-next-week/764)
**Author:** [@LibbySchulze](https://community.sysdig.com/u/LibbySchulze)\ **Replies:** 0\ **Last updated:** [April 30, 2026, 7:29pm UTC](https://community.sysdig.com/t/join-the-falco-cncf-livestream-next-week/764 "2026-04-30T19:29:23Z")
Hey folx! :wave: Join us next Wednesday (5/6) for a Falco maintainer livestream! We’ll be covering the latest advancements and strategic direction of the project including the new Falco Operator, performance and reliabi… --- ## [Reminder: Falco Community Survey is still open!](https://community.sysdig.com/t/reminder-falco-community-survey-is-still-open/755)
**Author:** [@LibbySchulze](https://community.sysdig.com/u/LibbySchulze)\ **Replies:** 0\ **Last updated:** [March 16, 2026, 4:35pm UTC](https://community.sysdig.com/t/reminder-falco-community-survey-is-still-open/755 "2026-03-16T16:35:12Z")
Hey Falco community! Quick reminder that our community survey is still open — we’ve extended it through Wednesday (3/18). If you have ~5 minutes, we’d really appreciate hearing how you’re using Falco. Your feedback hel… --- ## [Falco Plugin for OpenClaw](https://community.sysdig.com/t/falco-plugin-for-openclaw/747)
**Author:** [@takao.shimizu](https://community.sysdig.com/u/takao.shimizu)\ **Replies:** 1\ **Last updated:** [March 2, 2026, 1:45pm UTC](https://community.sysdig.com/t/falco-plugin-for-openclaw/747 "2026-03-02T13:45:12Z")
Hi, I have developed a Falco plugin for OpenClaw. https://falcoya.dev/openclaw --- ## [Falco Flock - we want to hear from you!](https://community.sysdig.com/t/falco-flock-we-want-to-hear-from-you/737)
**Author:** [@LibbySchulze](https://community.sysdig.com/u/LibbySchulze)\ **Replies:** 0\ **Last updated:** [February 26, 2026, 8:53pm UTC](https://community.sysdig.com/t/falco-flock-we-want-to-hear-from-you/737 "2026-02-26T20:53:57Z")
Hi everyone! We invite you all to take 5 minutes to respond to our new community survey. We would love for you all to share how you’re using Falco, as it helps us continue to build the community you want! Click here to … --- ## [Real-time Web Attack Detection with Falco + Nginx Plugin](https://community.sysdig.com/t/real-time-web-attack-detection-with-falco-nginx-plugin/699)
**Author:** [@takao.shimizu](https://community.sysdig.com/u/takao.shimizu)\ **Replies:** 2\ **Last updated:** [January 13, 2026, 7:13am UTC](https://community.sysdig.com/t/real-time-web-attack-detection-with-falco-nginx-plugin/699 "2026-01-13T07:13:08Z")
I’ve created a Falco plugin for Nginx, and the prototype is currently published. I’ve completed the E2E testing up to phase 1. We’re now in phase 2 of the E2E testing :slight\_smile: --- ## [Wednesday Poll - Which Detection Would You Build First?](https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697)
**Author:** [@Bodhi](https://community.sysdig.com/u/Bodhi)\ **Replies:** 5\ **Last updated:** [October 23, 2025, 1:52pm UTC](https://community.sysdig.com/t/wednesday-poll-which-detection-would-you-build-first/697 "2025-10-23T13:52:24Z")
If you’re just starting out with Falco or cloud threat detection: Which type of detection rule would you build first? :1st\_place\_medal: A) Kubernetes exec into container B) Suspicious network outbound C) File change … --- ## [🦅 Falco 0.42 Released — Faster, Smarter, and Ready for Forensics!](https://community.sysdig.com/t/falco-0-42-released-faster-smarter-and-ready-for-forensics/700)
**Author:** [@leogr](https://community.sysdig.com/u/leogr)\ **Replies:** 0\ **Last updated:** [October 23, 2025, 9:41am UTC](https://community.sysdig.com/t/falco-0-42-released-faster-smarter-and-ready-for-forensics/700 "2025-10-23T09:41:56Z")
I’m excited to announce Falco 0.42.0, bringing major performance and observability improvements to your runtime security experience! Key highlights :movie\_camera: Capture recording: record and replay Falco events for d… --- ## [Falco Workshop at Kubecon!](https://community.sysdig.com/t/falco-workshop-at-kubecon/698)
**Author:** [@Maddie](https://community.sysdig.com/u/Maddie)\ **Replies:** 0\ **Last updated:** [October 22, 2025, 10:26pm UTC](https://community.sysdig.com/t/falco-workshop-at-kubecon/698 "2025-10-22T22:26:26Z")
Hey Folks! I know this is a bit of a shameless plug, but I wanted to talk about how AWESOME Falco is in person and I would love if you joined me! Here is the link for the Workshop I am doing. https://sysdig.pathfactor… --- ## [Understanding Falco’s Kubernetes Audit Log Plugins](https://community.sysdig.com/t/understanding-falco-s-kubernetes-audit-log-plugins/677)
**Author:** [@leogr](https://community.sysdig.com/u/leogr)\ **Replies:** 0\ **Last updated:** [August 20, 2025, 12:25pm UTC](https://community.sysdig.com/t/understanding-falco-s-kubernetes-audit-log-plugins/677 "2025-08-20T12:25:02Z")
Since this is a recurring topic, I wanted to share a quick explanation about Falco’s Kubernetes audit log plugins. EKS is just one example, but the same principles apply to all K8s audit plugins. Which plugin should I… --- ## [From Alerts to Action: Falco Vanguard!](https://community.sysdig.com/t/from-alerts-to-action-falco-vanguard/649)
**Author:** [@maddigsys](https://community.sysdig.com/u/maddigsys)\ **Replies:** 0\ **Last updated:** [August 6, 2025, 10:13pm UTC](https://community.sysdig.com/t/from-alerts-to-action-falco-vanguard/649 "2025-08-06T22:13:49Z")
Hey everyone! I’m excited to share with you Falco Vanguard—a user-friendly solution that turns basic Falco security alerts into intelligent, actionable insights. This excellent tool is built as a Flask application and fe… --- ## [What’s the Most Creative Falco Rule You’ve Written?](https://community.sysdig.com/t/what-s-the-most-creative-falco-rule-you-ve-written/565)
**Author:** [@Bodhi](https://community.sysdig.com/u/Bodhi)\ **Replies:** 1\ **Last updated:** [July 30, 2025, 11:08pm UTC](https://community.sysdig.com/t/what-s-the-most-creative-falco-rule-you-ve-written/565 "2025-07-30T23:08:14Z")
Share the weirdest or most clever Falco rule you’ve created — whether it caught something serious or just made you laugh. Bonus points for real-world outcomes or memes. --- ## [Taking feedback for the future!](https://community.sysdig.com/t/taking-feedback-for-the-future/595)
**Author:** [@edsoncelio](https://community.sysdig.com/u/edsoncelio)\ **Replies:** 0\ **Last updated:** [July 25, 2025, 9:40pm UTC](https://community.sysdig.com/t/taking-feedback-for-the-future/595 "2025-07-25T21:40:28Z")
In the spirit of open source and growing together as a community, what ideas or features do you think would make this space even more valuable? --- ## [Falco Rule Tuning: Show Us Your Best Practices](https://community.sysdig.com/t/falco-rule-tuning-show-us-your-best-practices/566)
**Author:** [@Bodhi](https://community.sysdig.com/u/Bodhi)\ **Replies:** 0\ **Last updated:** [July 25, 2025, 5:24pm UTC](https://community.sysdig.com/t/falco-rule-tuning-show-us-your-best-practices/566 "2025-07-25T17:24:01Z")
Let’s crowdsource strategies for tuning Falco rules! How do you balance verbosity vs. silence, reduce noise, or align alerts to actual risk? Templates and GitHub links welcome.