Falco — runtime security — Arcivéo

Falco

Active

Events in 24h: 35

Critical

Events in 24h

Warnings

Notices: 4

Top rules

Total: 35

Top rules

Read sensitive file untrusted 6

Terminal shell in container 3

Write below etc 0

Detect outbound connections to common miner pools 0

Run shell untrusted 0

Recent events 35

                            notice
                            2026-08-13T22:54:22 notice A Detect outbound connections to common miner pools (user=root command=sh pid=1787)
                        

                            warning
                            2026-08-13T22:33:13 warning A Terminal shell in container (user=root command=sh pid=4625)
                        

                            notice
                            2026-08-13T22:18:08 notice A Read sensitive file untrusted (user=root command=sh pid=4012)
                        

                            warning
                            2026-08-13T21:43:34 warning A Terminal shell in container (user=root command=sh pid=5010)
                        

                            warning
                            2026-08-13T21:38:38 warning A Run shell untrusted (user=root command=sh pid=2840)
                        

                            warning
                            2026-08-13T19:03:32 warning A Read sensitive file untrusted (user=root command=sh pid=7562)
                        

                            notice
                            2026-08-13T22:13:10 notice A Read sensitive file untrusted (user=root command=sh pid=2924)
                        

                            warning
                            2026-08-13T20:45:13 warning A Read sensitive file untrusted (user=root command=sh pid=2227)
                        

                            warning
                            2026-08-13T21:15:26 warning A Terminal shell in container (user=root command=sh pid=9870)
                        

                            notice
                            2026-08-13T19:38:01 notice A Detect outbound connections to common miner pools (user=root command=sh pid=4096)
                        

                            warning
                            2026-08-13T15:12:22 warning A Terminal shell in container (user=root command=sh pid=5211)
                        

                            warning
                            2026-08-13T20:56:18 warning A Terminal shell in container (user=root command=sh pid=8624)
                        

                            warning
                            2026-08-13T17:06:34 warning A Read sensitive file untrusted (user=root command=sh pid=7507)
                        

Tuning: silence a false positive

The panel does not change the Falco config — it only shows the snippet and commands you apply on the server over SSH.

1. Create an override file with the exclusion:

# /etc/falco/rules.d/local-tuning.yaml
- rule: <EXACT RULE NAME from the list above>
  condition: and not fd.name = /path/to/exclude
  append: true

2. Check and restart Falco:

sudo nano /etc/falco/rules.d/local-tuning.yaml
sudo falco --validate /etc/falco/rules.d/local-tuning.yaml
sudo systemctl restart falco 2>/dev/null || sudo systemctl restart falco-modern-bpf

Use the exact rule name. If the list shows the message text instead of a name, enable JSON output in falco.yaml (json_output: true) so the dashboard receives exact rule names.

Demo mode