DevOps · Flashcard
What is falcosidekick?
- AA companion that fans Falco alerts out to many destinations — Slack, Elasticsearch, Loki, and more
- BAn alternative syscall driver — a lighter probe that replaces Falco's kernel module
- CA rule editor UI — a web tool for writing and testing new Falco detection rules
- DA cluster scanner — a job that audits nodes for missing Falco installations
Why this is the answer
falcosidekick receives Falco's output and forwards it to dozens of destinations (chat, SIEMs, message queues, storage). It is not a syscall driver, not a rule-authoring UI, and not a scanner for Falco coverage.
Official docs