Host health
See Falco version, rule version, last heartbeat, and event-drop signals.
Linux host runtime security
Falco host security, visible from one place
Falco is not limited to Kubernetes. OpenFalco is designed to make its Linux host and Docker coverage practical for small infrastructure and security teams.
Standalone hosts disappear into operational gaps
Package installs, systemd services, rules versions, output transport, and kernel event drops all need continuous verification across a server fleet.
Runtime incidents
Investigate suspicious shells, file access, privilege changes, and unexpected processes.
Fleet policy
Roll out controlled rule changes without logging into every machine.
Start with one $9 node and expand only when OpenFalco earns a place in your fleet.
Reserve founding accessWhich operating systems are in the founding scope?
Linux hosts and Linux Kubernetes nodes. Windows and macOS are outside the founding MVP.
Do you charge by event volume?
No. Founding pricing is per protected node, not per event or log byte.