3 ms·
Falco can read events via an ebpf program (instead of the falco-probe kernel module). https://github.com/draios/sysdig/wiki/eBPF https://github.com/draios/sysd
by random_copy 8y ago
Falco can read events via an ebpf program (instead of the falco-probe kernel module).
https://github.com/draios/sysdig/wiki/eBPF https://github.com/draios/sysdig/wiki/eBPF
So, falco will work on GKE and COS