How to detect runtime threats with Falco on Linux

Vulnerability scanning tells you what could go wrong; runtime detection tells you what is going wrong right now. Falco watches kernel system calls and raises alerts on suspicious behaviour: a shell spawned inside a container, a sensitive file read by the wrong process, an unexpected outbound connection. This walkthrough installs Falco with the modern eBPF driver, writes a custom detection rule, triggers it, and points the alerts at a log file.

Prerequisites

A Linux host with kernel 5.8 or newer (for the modern eBPF driver). Check with uname -r.
Root access.

Step 1: install Falco

curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | \
  sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/falco-archive-keyring.gpg] https://download.falco.org/packages/deb stable main" | \
  sudo tee /etc/apt/sources.list.d/falcosecurity.list
sudo apt-get update
sudo apt-get install -y falco

Step 2: select the modern eBPF driver

Modern eBPF needs no kernel module compilation and works on recent kernels. Set it in /etc/falco/falco.yaml:

engine:
  kind: modern_ebpf

Also enable file output so alerts land somewhere you can watch and forward:

file_output:
  enabled: true
  keep_alive: false
  filename: /var/log/falco/events.log

Create the log directory and start the modern eBPF service:

sudo mkdir -p /var/log/falco
sudo systemctl enable --now falco-modern-bpf.service
sudo systemctl status falco-modern-bpf --no-pager

Step 3: write a custom detection rule

Falco ships a large default rule set. Add your own for something specific, such as any process other than the SSH tools reading a private key. Put it in a file under the rules directory:

sudo tee /etc/falco/rules.d/local.yaml > /dev/null <<'EOF'
- rule: Read SSH Private Key
  desc: Detect a non-SSH process reading a user's SSH private key
  condition: >
    open_read and fd.name glob "/home/*/.ssh/id_*"
    and not proc.name in (sshd, ssh, ssh-agent, scp, sftp-server)
  output: >
    SSH private key read (user=%user.name command=%proc.cmdline file=%fd.name)
  priority: WARNING
  tags: [filesystem, mitre_credential_access]
EOF

Validate the rule syntax before restarting, then apply it:

sudo falco --validate /etc/falco/rules.d/local.yaml
sudo systemctl restart falco-modern-bpf.service

Step 4: trigger it and read the alert

Read a private key with a normal command, which the rule does not trust:

cat /home/deploy/.ssh/id_ed25519 > /dev/null

Then check the alert landed:

sudo tail /var/log/falco/events.log
sudo journalctl -u falco-modern-bpf -n 20 --no-pager

You will see the rule fire with the user, command, and file that triggered it. From here, forward /var/log/falco/events.log into the centralized logging setup from the Loki how-to, or install falcosidekick to push alerts to Slack or a webhook.

What goes wrong

Falco will not start with a driver error. The kernel is older than 5.8, so modern eBPF is unavailable. Install the falco-bpf (legacy eBPF) or falco-kmod (kernel module) variant instead.

Constant alerts from the default rules. Some defaults are noisy on a busy host. Do not disable rules wholesale; add narrow exceptions for the specific known-good processes causing the noise.

A rule change breaks Falco silently. You skipped validation. Always run falco --validate before restarting.

Alerts fire but nobody sees them. Falco detecting and no one watching is the same as not detecting. Route events.log into your log pipeline or an alerting channel.