Event Sources

Falco can consume events from a variety of different sources and apply rules to these events to detect abnormal behavior.

Currently, Falco supports the following built-in event sources:

• System Calls (syscall) via the drivers
• Kubernetes Audit Events (k8s_audit)

Falco also supports the following event sources via officially supported plugins:

• AWS Cloudtrail
• Okta

In addition to these event sources, others have written third-party plugins that support additional event sources.