Introduction to Falco

Lorenzo Fontana and Leo Di Donato from Sysdig walk through Falco end-to-end: installing it on a host, the kernel module vs eBPF driver, writing rules in YAML, triggering syscall and Kubernetes audit alerts, and routing output via Falcosidekick.