Does Falco prevent malicious actions or detect them?

Why this is the answer

Falco is a detection and alerting engine: it surfaces suspicious behavior but does not block, kill, or revert on its own. Blocking or remediation requires a separate response layer (e.g. Falco Talon reacting to alerts) — Falco itself neither intercepts syscalls to deny them, deletes pods, nor rolls back actions.