Sysdig Falco — a tool for detecting anomalies and monitoring system activity. It works both on the host and in containers, if required. Falco consists of two parts — the falco_probe kernel module, and the daemon itself, which processes the collected information, generates reports, and so on.yaml files. …