Falco
Detect unexpected runtime behaviour in Linux hosts and containers.
What’s included for free?
Falco is ongoing-free under Apache-2.0 with no provider event quota; operators supply hosts, rule management and alert storage.
Where it runs: Self-hosted
Provider information ↗Checked 2026-11-01
Before you use it
Apache-2.0 covers Falco. Rules, plugins, drivers and downstream alert systems can have separate licences.
Provider terms can change. Check current pricing and usage rights before starting a project.