Runtime detection for your containers.
Multi-engine runtime detection: Falco (behavioral container/Kubernetes/Linux, ATT&CK Containers-mapped) + Tetragon (eBPF, detects AND blocks at kernel level), plus cloud audit (Kubernetes audit, AWS CloudTrail, Okta, GCP). Every rule validated on its own engine; forged maison rules + the permissively-licensed open-source ecosystem.
What we added recently
A living feed: here is the coverage added to it, dated.
- +83 règles
- +78 règles
The runtime abuses that matter in containers.
Mining binaries launched inside a container (T1496).
nsenter/unshare/mount and host-escape tooling (T1611).
Reads of K8s tokens, /etc/shadow, SSH keys (T1552).
cron/systemd/ld.so.preload writes, kernel modules, setuid (T1543/T1547).
Interactive shells, netcat/reverse-shell, runtime package managers (T1059/T1195).
Network recon tools and container admin commands (T1046/T1609).
Kubernetes audit, AWS CloudTrail, Okta, GCP, GitHub, via Falco plugins (each ruleset needs its plugin).
Cloud detections from the Sigma standard (AWS CloudTrail, GCP audit) translated into Falco rules: both engines read the same JSON record, so the detection logic is preserved, and every converted rule is validated on the real Falco engine before delivery.
Runtime: forged maison rules (ATT&CK Containers) + the open-source Falco rules ecosystem (Apache 2.0), validated on the real engine. Cloud: official Falco plugin rulesets (k8saudit, cloudtrail, okta, gcpaudit, github), loaded with their plugin, + Sigma cloud detections translated to Falco (derivative works under DRL-1.1). The pack ships each rule’s licence in its index, you know exactly what you are loading.
Validated on the real engine, not just YAML.
Falco rules pass `falco --validate` on the real engine; Tetragon policies are validated against the official CRD schema, the very one the Kubernetes API enforces on admission. Nothing breaks on load.
Rules forged by us, not a mere mirror of a public repo.
The pack ships a coverage index (by tactic, technique, engine, platform) and ready-to-load bundles: container escape, credential access, Kubernetes runtime, cloud audit. You don’t get a bag of YAML, you get a map of what you cover, and what you don’t cover is counted too.
the open-source Falco upstream under Apache 2.0, redistributable under its own license (attribution kept); our in-house Falco rules and the curated pack stay proprietary (EULA, subscriber use).
The feed is signed; you verify its integrity before loading.
A single subscription, updated as research and new techniques emerge.
Which Falco version is it compatible with?
The rules target a modern engine version (required_engine_version) and are validated on the latest official Falco image. Load them with `falco -r <file>.yaml` or via `rules_files` in falco.yaml.
How is it different from Falco Feeds (Sysdig)?
Same open-source Falco engine. Our edge: forged, validated maison rules mapped to ATT&CK Containers, aggregated with the Apache ecosystem, delivered signed under one key, at an SMB price. The Apache upstream stays redistributable under its own license; our in-house rules and the compilation are proprietary (EULA).
What sources and licenses?
Our in-house Falco rules (proprietary), plus the open-source Falco rules ecosystem (Apache 2.0). The Apache upstream is redistributable under its own license, attribution kept in the pack; our in-house rules and the curated compilation stay proprietary (EULA, use by the subscribing organization), the pack itself is not resold or redistributed as-is.
Ready to watch your containers?
Annual subscription. Instant key. Cancel anytime.