{"avoid_when":"只要镜像静态扫描（Trivy/Grype）","content_hash":"48959b470d801100b5577a8f785d3892b668f0935ef3fa2bf12328290bba224d","domain":"security","evidence_urls":["https://github.com/falcosecurity/falco"],"id":"falco","language":"C++","license":"Apache-2.0","name":"Falco","niche":"runtime security","repo":"https://github.com/falcosecurity/falco","source_updated_at":"2026-07-21T20:37:31Z","status":"active","summary":"云原生运行时安全检测，基于内核事件规则告警。","tags":["security"],"use_when":"K8s/主机要运行时异常行为检测","verification_status":"verified","verified_at":"2026-07-21T20:37:31Z"}