Falco rule repository
☆194Oct 26, 2026Updated last week
Alternatives and similar repositories for rules
Users that are interested in rules are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Falco plugins registry☆120Oct 26, 2026Updated last week
- Administrative tooling for Falco☆131Oct 26, 2026Updated last week
- Falco plugins SDK for Rust☆12Sep 19, 2026Updated last month
- Response Engine for managing threats in your Kubernetes☆218Oct 26, 2026Updated last week
- Generate a variety of suspect actions that are detected by Falco rulesets☆141Oct 25, 2026Updated last week
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- Cloud Native Runtime Security☆9,544Updated this week
- Connect Falco to your ecosystem☆699Oct 26, 2026Updated last week
- Kit for building Falco drivers: kernel modules or eBPF probes☆70Oct 26, 2026Updated last week
- A simple WebUI with latest events from Falco☆144Oct 26, 2026Updated last week
- Fetches the metadata from kubernetes API server and dispatches them to Falco instances☆22Updated this week
- Source code of the official Falco website☆39Updated this week
- Curating Falco rules with MITRE ATT&CK Matrix☆87Mar 7, 2024Updated 2 years ago
- A tool to crawl Linux kernel versions☆25Oct 26, 2026Updated last week
- ☆11Sep 13, 2026Updated last month
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Research on various techniques to bypass default falco ruleset (based on falco v0.28.1).☆90Jan 28, 2024Updated 2 years ago
- eBPF-based Security Observability and Runtime Enforcement☆5,138Updated this week
- Linux Runtime Security and Forensics using eBPF☆4,663Updated this week
- A collections of VQL (Velociraptor Query Language) files used for the extraction of crucial data during incident response procedures usin…☆10Aug 21, 2025Updated last year
- NetNSCLI is a lightweight Go-based CLI tool, built with Cobra, designed to create and manage local network testbeds effortlessly from YAM…☆29Feb 28, 2025Updated last year
- Listing of YARA rules I wrote for Live and Retro hunts. Includes Jupyter infostealer, suspicious powershell, dll hijacking, vbs downloade…☆17Oct 14, 2026Updated 2 weeks ago
- Run Falco in a GitHub Actions to detect suspicious behavior in your CI/CD☆53Aug 23, 2026Updated 2 months ago
- 内存加载执行golang elf二进制文件☆29Dec 22, 2021Updated 4 years ago
- Tool for building Kubernetes attack paths☆1,017Updated this week
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Falco-powered policy and visibility layer for AI coding agents☆230Sep 21, 2026Updated last month
- Falco workflow & testing infrastructure☆33Updated this week
- PoC repository for the blog post CopyEscape: Taking Over Docker Hosts with docker cp☆22Aug 9, 2026Updated 2 months ago
- Nginx Multi Cluster Ingress Controller (based on kubernetes/ingress-nginx@v1.1.1)☆20Feb 28, 2024Updated 2 years ago
- ☆12Jul 8, 2023Updated 3 years ago
- Hive dependency injection☆27Updated this week
- Malicious skills for testing skill scanners☆45Jun 3, 2026Updated 4 months ago
- suidsnoop is a tool based on eBPF LSM programs that logs whenever a suid binary is executed and implements custom allow/deny lists.☆17Oct 31, 2021Updated 5 years ago
- Sublime rules for email attack detection, prevention, and threat hunting.☆381Updated this week
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- A utility to generate SPDX-compliant Bill of Materials manifests☆475Oct 26, 2026Updated last week
- ☆16Oct 12, 2026Updated 3 weeks ago
- A library implementing a generic SQL like query language.☆22Aug 20, 2026Updated 2 months ago
- Various eBPF programs for tracing network connections☆32Oct 26, 2021Updated 5 years ago
- CloudPathSniffer is an open-source, easy to use and extensible Cloud Anomaly Detection platform designed to help security teams to find h…☆13Nov 30, 2023Updated 2 years ago
- A Kubernetes Operator for Lakekeeper (WIP)☆17Apr 30, 2026Updated 6 months ago
- A comprehensive framework for analyzing and defending against attacks targeting Software Development Life Cycle Infrastructure.☆185Oct 22, 2026Updated last week