falco

Falco monitors Linux system calls in real time and alerts you when something unexpected happens: a container spawning a shell, a process reading sensitive files, a network connection to an unusual destination. It's a security camera for your Linux kernel. It sees everything a process does because it hooks into the kernel via eBPF.

The open source version is free under Apache 2.0. CNCF graduated project. You get real-time threat detection, a rich rule engine, hundreds of pre-built rules for common attack patterns, and output to any alerting system (Slack, PagerDuty, syslog, etc.). Sysdig (the company that created Falco) sells Sysdig Secure, which adds a management UI, compliance dashboards, image scanning, and enterprise support. That's the commercial product. Falco itself has no enterprise tier.

Self-hosting is the only option. Install Falco on each host or as a DaemonSet in Kubernetes. The eBPF probe needs a kernel that supports it (5.8+ for best results). Initial setup is straightforward; tuning the rules to reduce false positives is where the real work starts. Solo developers: overkill unless you're running production containers with sensitive data. Small teams: install it on your Kubernetes cluster and configure Slack alerts. Cheap insurance. Growing teams: essential. Runtime security detection is a gap most teams don't fill until something bad happens.

The catch: out-of-the-box rules are noisy. You'll get alerts for normal container behavior until you tune the rules for your environment. Budget a few days for tuning, or you'll learn to ignore the alerts, which defeats the purpose.