helm install falco falcosecurity\/falco –namespace falco –create-namespace –set tty=true<\/strong><\/p>\n\n\n\nFalco deploys as a DaemonSet, meaning one Falco pod runs on every node in your cluster automatically. Wait for the pods to become ready:<\/p>\n\n\n\n
kubectl wait pods –for=condition=Ready –all -n falco<\/strong><\/p>\n\n\n\nSince version 0.40, Falco recommends the modern eBPF driver for kernels 5.8 and above, which needs no kernel headers or compilation, making installation noticeably simpler than older Falco versions.<\/p>\n\n\n\n
Seeing Falco Catch Its First Alert<\/strong><\/h2>\n\n\n\nThe fastest way to understand this Falco runtime security tutorial is to watch it catch something live.<\/p>\n\n\n\n
Open a shell inside any running container in your cluster:<\/p>\n\n\n\n
kubectl exec -it <pod-name> — \/bin\/sh<\/strong><\/p>\n\n\n\nCheck Falco’s logs in a separate terminal:<\/p>\n\n\n\n
kubectl logs -n falco -l app.kubernetes.io\/name=falco -f<\/strong><\/p>\n\n\n\nWithin seconds, you should see an alert fire, something like “A shell was spawned in a container with an attached terminal,” along with the user, the container image, and the full command line. This is Falco’s default ruleset working exactly as intended, catching a behaviour that is completely normal during debugging but highly suspicious during a real attack.<\/p>\n\n\n\n
Understanding Falco’s Default Rules<\/strong><\/h2>\n\n\n\nFalco ships with a comprehensive set of default rules covering common attack patterns. List everything currently loaded with:<\/p>\n\n\n\n
falco –list<\/strong><\/p>\n\n\n\nOr inside Kubernetes:<\/p>\n\n\n\n
kubectl exec -n falco -it $(kubectl get pods -n falco -l app.kubernetes.io\/name=falco -o jsonpath='{.items[0].metadata.name}’) — falco –list<\/strong><\/p>\n\n\n\nEach rule has three core parts: a condition<\/strong> that defines exactly what triggers it, an output<\/strong> template describing the alert message, and a priority<\/strong> level like NOTICE, WARNING, or CRITICAL. Default rules cover shell spawning, sensitive file reads, unexpected outbound connections, and privileged pod creation among many others.<\/p>\n\n\n\nWriting a Simple Custom Rule<\/strong><\/h2>\n\n\n\nFalco’s real power in any Falco runtime security tutorial shows up once you start writing rules specific to your own environment. Here is a simple example that flags privileged pod creation:<\/p>\n\n\n\n
- rule: Create Privileged Pod\n desc: Detect creation of privileged pods\n condition: >\n kevt and kcreate and ka.target.resource = \"pods\"\n and ka.req.pod.containers[0].privileged = true\n output: >\n Privileged pod created (user=%ka.user.name pod=%ka.target.name\n ns=%ka.target.namespace image=%ka.req.pod.containers[0].image)\n priority: WARNING\n source: k8s_audit\n<\/code><\/pre>\n\n\n\nThis rule uses the k8s_audit<\/strong> source, which means it needs the Kubernetes API server configured to send audit events to Falco. Once active, any privileged pod created anywhere in your cluster triggers an immediate, clearly labelled alert.<\/p>\n\n\n\n\n
\ud83d\udca1 Did You Know?<\/h3>\n \n - Falco is often considered the Linux equivalent of Sysmon for Windows, providing deep visibility into system activity and security events. It monitors activity at the kernel syscall level, allowing it to detect suspicious behavior without modifying the applications it protects. Because Falco operates independently of networking components, it works consistently across Kubernetes clusters regardless of the CNI or network plugin being used.<\/li>\n <\/ul>\n<\/div>\n\n\n\n
Common Mistakes to Avoid<\/strong><\/h2>\n\n\n\n\n- Treating Falco as a replacement for static scanning.<\/strong> Falco catches runtime behaviour, not vulnerable dependencies or insecure code. Pair it with a static analysis tool to cover both ends of the security lifecycle.<\/li>\n\n\n\n
- Ignoring alert volume in production.<\/strong> Default rules can be noisy on a busy cluster. Tune rule sensitivity and route alerts to a proper destination like Slack or PagerDuty instead of letting them pile up unread in logs.<\/li>\n\n\n\n
- Forgetting to configure Kubernetes audit logging for k8s_audit rules.<\/strong> Rules based on the k8s_audit<\/strong> source, like the privileged pod example above, will silently never fire unless the API server is actually sending audit events to Falco.<\/li>\n<\/ul>\n\n\n\n
Conclusion<\/strong><\/h2>\n\n\n\nThis Falco runtime security tutorial covered the full beginner workflow: installing Falco with Helm on Kubernetes, watching it catch a real shell-spawn alert, exploring the default ruleset, and writing a custom rule for privileged pod detection. Static scanning catches problems before deployment. Falco catches them the moment they happen inside a running cluster, and that distinction is exactly why both belong in a serious security setup.<\/p>\n\n\n\n
FAQs<\/strong><\/h2>\n\n\n\n
\n
\n
1. Is Falco free to use?<\/strong><\/h3>\n\n\n
Yes. Falco is fully open-source and free, with no licensing cost for any core features covered in this Falco runtime security tutorial.<\/p>\n\n<\/div>\n<\/div>\n
\n
2. What is the difference between Falco and a static security scanner?<\/strong><\/h3>\n\n\n
Static scanners check code or images before deployment. Falco watches actual running processes and system calls in real time, catching threats only visible once a workload is running.<\/p>\n\n<\/div>\n<\/div>\n
\n
3. Does Falco work outside of Kubernetes?<\/strong><\/h3>\n\n\n
Yes. Falco can run on bare metal hosts and standalone Docker containers, not just Kubernetes clusters.<\/p>\n\n<\/div>\n<\/div>\n
\n
4. What kernel driver does Falco use?<\/strong><\/h3>\n\n\n
Modern eBPF is the recommended driver since version 0.40, requiring no kernel headers or compilation for kernels 5.8 and above.<\/p>\n\n<\/div>\n<\/div>\n
\n
5. Can I write my own Falco rules?<\/strong><\/h3>\n\n\n
Yes, in YAML with a condition, output message, and priority level, as shown in the custom rule example above.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"
Most security tools check your code before it ships. Falco watches what is actually happening while your application runs. This Falco runtime security tutorial shows you how to install Falco on a Kubernetes cluster, see it catch a real suspicious action, and write your own custom detection rule. TL;DR Summary What is Falco? Falco is […]<\/p>\n","protected":false},"author":65,"featured_media":120889,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[712,621],"tags":[],"views":"53","authorinfo":{"name":"Jebasta","url":"https:\/\/www.guvi.in\/blog\/author\/jebasta\/"},"thumbnailURL":"https:\/\/www.guvi.in\/blog\/wp-content\/uploads\/2026\/06\/Falco-Runtime-Security-300x116.webp","_links":{"self":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119040"}],"collection":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/comments?post=119040"}],"version-history":[{"count":3,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119040\/revisions"}],"predecessor-version":[{"id":120897,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119040\/revisions\/120897"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media\/120889"}],"wp:attachment":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media?parent=119040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/categories?post=119040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/tags?post=119040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}