Skip to main content
Falco monitors syscalls on every node, detecting anomalous runtime behavior in real time.

​
Detections

  • Unexpected process execution in containers
  • Privilege escalation attempts
  • Container escape attempts
  • Connections to suspicious endpoints
  • File access violations
  • Cryptomining activity
  • Reverse shells

​
Architecture

Deployed as a DaemonSet (one pod per node) using the modern_ebpf driver. Falco Sidekick forwards alerts to the ChangeGuard AI backend.

​
Privileges and host access

Unlike the rest of ChangeGuard AI — which is read-only and runs unprivileged — runtime syscall monitoring requires kernel-level access. When security scanning is enabled (the default), the Falco DaemonSet therefore runs privileged on every node and mounts host paths for eBPF and kernel introspection:
  • Runs as a privileged container (securityContext.privileged: true) on every node.
  • Mounts host paths: /proc, /dev, /boot, /lib/modules, /usr, /etc, /var/run.
This is inherent to eBPF-based runtime detection — it is the same privilege model Falco uses upstream — so evaluate it as you would any node-level security agent. It is disclosed here, and on Permissions & RBAC, so your security review has the full picture. If your posture does not allow a privileged DaemonSet, you can turn off runtime scanning without affecting the collector or the other scanners:

​
Configuration

​
Requirements

  • Linux kernel 5.8+ for modern_ebpf (recommended, no kernel headers needed)
  • Kernel 4.14+ for ebpf driver (requires headers)