Falco
E703664
behavior-based security tool
cloud-native security project
intrusion detection system
open-source software
runtime security tool
Falco is an open-source cloud-native runtime security tool that monitors system behavior to detect and alert on suspicious activity in containers, Kubernetes, and Linux hosts.
All labels observed (1)
| Label | Occurrences |
|---|---|
| Falco canonical | 4 |
How this entity was disambiguated
This entity first appeared as the object of triple T7938806 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.
NED1
Entity disambiguation (via context triple)
gpt-5-mini-2025-08-07
Target entity: Falco Context triple: [Cloud Native Computing Foundation, hostsProject, Falco]
-
A.
Falco
Falco was an Austrian pop and rock musician best known internationally for his 1980s hit "Rock Me Amadeus."
-
B.
Falco
Falco is a surname most prominently associated with American actress Edie Falco, known for her acclaimed television roles.
-
C.
Falco
Falco is a genus of birds of prey that includes the true falcons, known for their speed, agility, and keen hunting abilities.
-
D.
Hawk
The Hawk is a bird of prey commonly symbolizing keen vision, strength, and agility, and serves as the mascot for various schools and sports teams.
-
E.
Raptor
Raptor is the NATO reporting name for the F-22, a fifth-generation American stealth air superiority fighter aircraft.
- F. None of above. chosen
- G. Unsure - the case is ambiguous/there is not enough information to decide.
NED2
Entity disambiguation (via description)
gpt-5-mini-2025-08-07
Target entity: Falco Target entity description: Falco is an open-source cloud-native runtime security tool that monitors system behavior to detect and alert on suspicious activity in containers, Kubernetes, and Linux hosts.
-
A.
Falco
Falco was an Austrian pop and rock musician best known internationally for his 1980s hit "Rock Me Amadeus."
-
B.
Falco
Falco is a surname most prominently associated with American actress Edie Falco, known for her acclaimed television roles.
-
C.
Falco
Falco is a genus of birds of prey that includes the true falcons, known for their speed, agility, and keen hunting abilities.
-
D.
Hawk
The Hawk is a bird of prey commonly symbolizing keen vision, strength, and agility, and serves as the mascot for various schools and sports teams.
-
E.
Raptor
Raptor is the NATO reporting name for the F-22, a fifth-generation American stealth air superiority fighter aircraft.
- F. None of above. chosen
Statements (47)
| Predicate | Object |
|---|---|
| instanceOf |
behavior-based security tool
ⓘ
cloud-native security project ⓘ intrusion detection system ⓘ open-source software ⓘ runtime security tool ⓘ |
| alertsOn |
suspicious activity in Kubernetes
ⓘ
suspicious activity in containers ⓘ suspicious activity on Linux hosts ⓘ |
| analyzes |
container runtime activity
ⓘ
file system activity ⓘ kernel-level events ⓘ network activity ⓘ process activity ⓘ |
| category |
cloud-native runtime security tool
ⓘ
open-source security project ⓘ |
| coreCapability |
behavioral monitoring
ⓘ
policy-based alerting ⓘ real-time threat detection ⓘ |
| deploymentModel | agent-based ⓘ |
| designedFor |
Kubernetes clusters
NERFINISHED
ⓘ
cloud-native environments ⓘ containerized workloads ⓘ |
| detects |
anomalous behavior
ⓘ
security threats at runtime ⓘ suspicious activity ⓘ |
| domain |
Kubernetes security
ⓘ
Linux security ⓘ cloud security ⓘ container security ⓘ |
| license | open-source license ⓘ |
| monitors |
Kubernetes workloads
ⓘ
Linux hosts ⓘ Linux system calls ⓘ containers ⓘ system behavior ⓘ |
| purpose |
detect policy violations
ⓘ
improve runtime security of cloud-native workloads ⓘ provide security alerts ⓘ |
| softwareType |
intrusion detection
ⓘ
runtime security ⓘ threat detection ⓘ |
| sourceModel | open source ⓘ |
| supportsPlatform |
Docker
NERFINISHED
ⓘ
Kubernetes NERFINISHED ⓘ Linux ⓘ |
| uses |
rules engine
ⓘ
security policies ⓘ |
How these facts were elicited
The pipeline generated the facts above by prompting gpt-5.1 with this entity's name + description and the instruction below.
Instruction
You are a knowledge base construction expert. Given a subject entity and a description of it, return factual statements that you know for the subject as a JSON list of dictionaries(triples), where keys must be "subject", "predicate" and "object". The number of facts may be very high, between 25 to 50 or more, for very popular subjects. For less popular subjects, the number of facts can be very low, like 5 or 10. # Requirements - If you don't know the subject at all, return an empty list. - If the subject is not a named entity, return an empty list. - Include at least one triple where predicate is "instanceOf". - Do not get too wordy. - Separate several objects into multiple triples with one object.
Input
Subject: Falco Description of subject: Falco is an open-source cloud-native runtime security tool that monitors system behavior to detect and alert on suspicious activity in containers, Kubernetes, and Linux hosts.
Referenced by (4)
Full triples — surface form annotated when it differs from this entity's canonical label.