# falcosecurity/falco

> Falco is a cloud native runtime security tool for Linux that monitors syscalls and container/Kubernetes events against custom rules, alerting on abnormal behavior in real time.

- Magnitude: 1.1 out of 10 — Steady
- Stars: 9,404 total · +1 star today, ≈ 3 by evening
- Star trust: star growth looks organic
- Category: Security · Language: C++ · License: Apache-2.0 · Created: 2016-01-19 · Last push: 2026-09-21
- GitHub: https://github.com/falcosecurity/falco · Homepage: https://falco.org · Page: https://gitnova.dev/en/r/falcosecurity/falco

## Useful for

- Set up alerts for suspicious syscalls in a Kubernetes cluster
- Forward Falco events to a SIEM or data lake for analysis
- Run the docker-compose demo environment with Falco and its UI

## Why it’s here

- 1 star so far today, about 3 expected by the end of the day.
- GitHub Trending C++ today: #9, +6 stars.

## Star trust

Star growth looks organic.

Star-trust labels are heuristics based on the repository’s behavior, not a check of every stargazer.

## Numbers

- Forks: 1,080
- Issues and pull requests: 3,914
- Watchers: 131
- Average over the last week: 4 per day
- Usual pace: 4 per day
- Stars in the last hour (measured): 0
- Latest release: 0.45.0 (2026-09-21)

## Stars per day, last 30 days (oldest → newest, today is partial)

2026-08-24 … 2026-09-22: 6, 3, 3, 5, 1, 2, 5, 3, 5, 6, 5, 6, 1, 4, 8, 3, 2, 2, 2, 0, 3, 11, 7, 5, 9, 3, 1, 1, 7, 1

## Spotted in now

- GitHub Trending C++ today: #9, +6 stars

## More in this category

1. **mvt-project/mvt** — 6.5 · Breakout · Security · Python · +102 stars today, ≈ 225 by evening
   A collection of mobile forensics utilities that gather and analyze traces of compromise on Android and iOS devices, matching them against public indicators of compromise (IOCs). Built by Amnesty International Security Lab for…
   Full card: https://gitnova.dev/en/r/mvt-project/mvt.md
2. **newliver666/apk-reverse** — 5.9 · Early signal · Security · Python · +146 stars today, ≈ 261 by evening
   An Agent Skill for Android APK reverse engineering: unpacking, ad removal, dex patching, repacking, and runtime/server analysis. Loaded by an agent (Claude Code, Codex) while it works.
   Full card: https://gitnova.dev/en/r/newliver666/apk-reverse.md
3. **cloudflare/security-audit-skill** — 5.1 · Peaking · Security · JavaScript · +425 stars today, ≈ 805 by evening
   A coding-agent skill that turns the agent into a security auditor, running a multi-phase code audit with independently verified, machine-readable findings.
   Full card: https://gitnova.dev/en/r/cloudflare/security-audit-skill.md
4. **MSNightmare/BigDiskBuster** — 4.0 · Cooling · Security · C++ · +5 stars today, ≈ 13 by evening
   A C++ proof-of-concept that blocks Windows Defender platform and signature updates, causing a denial of service for the antivirus.
   Full card: https://gitnova.dev/en/r/MSNightmare/BigDiskBuster.md
5. **ejfkdev/ddc** — 3.6 · Cooling · Security · Rust · +17 stars today, ≈ 32 by evening
   A Rust DEX-to-Java decompiler for Android with progressive analysis: query metadata first and decompile classes on demand instead of a full run. Its output is javac-verified across seven real-world APKs.
   Full card: https://gitnova.dev/en/r/ejfkdev/ddc.md

---

Magnitude (0–10) measures how fast and how unusually interest in a repository is growing right now. It is not a quality score.
Days are UTC. “So far today” is a fact; “expected by the end of the day” is a forecast.
Summaries and use cases are written by an LLM (DeepSeek V4.1 Flash) from the README and may be inaccurate: verify specific claims (benchmarks, speed, hardware) in the repository itself.
Data as of 2026-09-22 13:19 UTC, updated every 30 minutes.