Falco

Falco watches system calls at the kernel level using eBPF and evaluates them against a rules engine to detect suspicious behavior in real time - a shell spawned inside a container, a sensitive file being read, a privilege escalation attempt - and alerts immediately rather than after the fact. It's a CNCF graduated project focused specifically on runtime threat detection.

Falco is a fit for security teams that need to detect active threats and anomalous behavior while a system is running, complementing Trivy and Kyverno (also in this catalog) - those scan images and enforce policy before deployment, while Falco watches what's actually happening at runtime.