Alternatives to Falco

Detect unusual runtime behavior on Linux systems. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as Falco.

  • Kubescape

    Assess Kubernetes configuration and runtime security.

    FreeOpen sourceWindowsmacOSLinuxCommand line

    Kubescape combines Kubernetes posture checks with runtime security features, so it focuses on clusters rather than general Linux system events.

  • Wazuh Agent

    Endpoint agent that feeds a Wazuh server with security and compliance data.

    FreeOpen sourceWindowsLinux

    Wazuh Agent covers file integrity, log collection and rootkit detection on Windows and Linux, but needs a Wazuh manager and indexer deployment.

  • Velociraptor

    Endpoint monitoring and digital forensics platform driven by a query language.

    FreeOpen sourceWindowsmacOSLinux

    Velociraptor provides endpoint monitoring driven by a query language across Windows, macOS and Linux, oriented toward forensics collection rather than real-time rule alerts.

  • Tetragon

    An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.

    FreeOpen sourceLinuxSelf-hosted

    Tetragon is an eBPF-based tool for Linux and Kubernetes that adds real-time kernel-level enforcement to runtime observability, but it requires familiarity with eBPF and policy writing.

  • Tracee

    A Linux runtime security and forensics tool that traces system events using eBPF.

    FreeOpen sourceLinuxCommand line

    Tracee traces Linux system events with eBPF and ships built-in detectors and signatures, serving both live monitoring and forensics on hosts and containers with administrator privileges.

Similar software

Related functionality, not a direct replacement.