Sysdig falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco will notify you when these rules are violated. You can think about falco as a mix between snort, ossec and strace.
ba72c109737ff97ca3ceaa8f57f82012fb57c0fe9a1a1e5032fdd5076d82c782
No one has added this yet