Runtime detection on every host: the platform configures the modern eBPF engine, the Falco rules plus the Navin platform rules, JSON alerts sent to the SIEM endpoint, and the health and metrics web server.
Generated from catalog/services/falco.yaml: do not edit by hand.
Summary
| |
|---|
| Version | 0.45.2 |
| Use | install and configure, configure and connect |
| Layer | functional (AI catalog) |
| Category | Security and policies |
| Installation methods | binary, podman |
| External connection | no |
| Sandbox only | no |
Licence
| |
|---|
| SPDX identifier | Apache-2.0 |
| Licence policy | core licence (MIT or Apache-2.0) |
| Licence exception | - |
| Platform component | falco |
Packages and artifacts
A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.
Images are pinned by tag in the descriptor, and by digest when the descriptor declares one (the offline bundle then refuses a pulled image that does not carry it); the digest is recorded in the mirror of the Manager when the offline bundle is imported, and every pull or load is checked against it.
Supported systems and architectures
| Method | Operating systems | Architectures |
|---|
binary | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64 (architecture of the artifacts of the descriptor) |
podman | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64, aarch64 (not restricted by the descriptor) |
Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.
Prerequisites
Host
- Linux kernel 5.8 or later (warning,
kernel).
Network and ports
| Component | Port name | Port | Opened in the host firewall |
|---|
falco | webserver | 8765/tcp | yes |
Services and connections needed
This service has no dependency.
Installation methods and modes
| Method | Default | What the method uses |
|---|
binary | yes | the binary archives of the descriptor, unpacked under the service directory |
podman | - | the container images of the descriptor, run by Podman under systemd |
Components
| Component | Kind | Installation methods | Ports |
|---|
Falco sensor (falco) | worker | binary, podman | 8765/tcp |
Every chosen host (per-host) (default)
One Falco per host, like a daemon set: each host watches its own kernel events.
What the mode deploys:
| Component | Placement |
|---|
falco | min 1, recommended 3 |
Single host (standalone)
One Falco on one host (test or single server platform).
What the mode deploys:
| Component | Placement |
|---|
falco | min 1, max 1 |
Install this service
The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.
-
Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.
-
Choose the service. On the Service step, select Falco. The card shows the licence Apache-2.0. Pick the Method among binary, podman (default binary).
-
Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode: per-host (default), standalone. Each mode deploys the components listed in Installation methods and modes.
-
Bindings. This service has no dependency: the Bindings step has nothing to bind.
-
Configure. On the Configure step, review the parameters (see Configuration parameters). Passwords left empty with a generated default are generated and sealed by the Manager.
-
Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.
-
Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services.
Connect an existing service
| |
|---|
| Schemes | https, http |
| Default port | 8765 |
| Authentication | none |
| Health check | /healthz |
| Authentication method | Fields | Description |
|---|
none | - | The Falco web server (health endpoint) has no authentication. |
Official documentation: https://falco.org/docs/
| Field | Type | Default | Description | Notes |
|---|
Alert source (alert_source) | string | falcosidekick | Where the existing Falco fleet sends its alerts (falcosidekick, http output, syslog). | - |
High availability
| |
|---|
| Cluster | per host (per-host) |
| High availability | per host (per-host) |
| Failover | none (none) |
| Replication | none (none) |
| Quorum | none (none) |
| Discovery | none (none) |
| Entry point | per host (per-host) |
| Official documentation | https://falco.org/docs/setup/operator/ |
Topology per mode
| Modes | Highest catalog level | Distribution | Quorum component | Fault domains | Description |
|---|
per-host | ha (ha) | per host (per-host) | - | - | One agent on every host: each host covers itself, the loss of a host only loses its own coverage. |
standalone | standalone (standalone) | single (single) | - | 1 | One Falco on one host. |
Notes
- Falco needs Linux with the modern eBPF probe (or the kernel driver) on every host; it watches only its own host.
Configuration parameters
Engine and rules
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
Driver (engine) | enum | modern_ebpf | modern_ebpf, ebpf, kmod | no | no | yes | Kernel event source; modern_ebpf needs no kernel module (kernel 5.8 or later). |
Minimum priority (priority) | enum | notice | emergency, alert, critical, error, warning, notice, informational, debug | no | no | no | Rules below this priority raise no alert. |
Navin platform rules (platform_rules) | bool | true | - | no | no | no | Load the rules of the Navin platform containers (shell in a container, write below the binaries, unexpected outbound connection). |
Alerts
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
Web server port (webserver_port) | port | 8765 | - | no | no | yes | Port of /healthz and /metrics. |
Alert endpoint (http_output_url) | string | (empty) | - | no | no | no | URL receiving the JSON alerts (SIEM ingest or Falcosidekick); empty keeps the alerts in the journal. |
Security
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
TLS (tls_enabled) | bool | false | - | no | no | yes | Serve /healthz and /metrics over TLS (webserver.ssl_enabled) with a certificate issued by the manager CA; the certificate and its key are joined at start in a 0600 file, the form Falco reads. |
Endpoints
| Endpoint | Scheme | Component | Port | Path | TLS parameter | Binding parameters | Binding secrets | Provisioning command |
|---|
webserver | http | falco | 8765 (webserver_port) | /healthz | tls_enabled | - | - | - |
Health checks
Liveness (per instance)
| Component | Check | Details |
|---|
falco | HTTP {{ ('https://' ~ host.fqdn) if config.tls_enabled else 'http://127.0.0.1' }}:{{ config.webserver_port }}/healthz | Expected 200; 30 retries; interval 2 s; timeout 5 s |
Readiness (service check)
| Check | Details |
|---|
HTTP {{ ('https://' ~ host.fqdn) if config.tls_enabled else 'http://127.0.0.1' }}:{{ config.webserver_port }}/healthz | Expected 200 |
Preflight checks
| Check | Type | Meaning | Severity | Components |
|---|
kernel | kernel_min {"version": "5.8"} | Linux kernel 5.8 or later | warning | every component |
webserver_port_free | port_free {"param": "webserver_port"} | port 8765 free on the host | blocking | every component |
Uninstall
Paths removed when the data is purged: {{ paths.log }}.
Upstream documentation