A local-first defensive security platform for Linux infrastructure. FALCO Guardian collects security telemetry, detects suspicious activity and turns events into actionable incidents — without exposing the protected node directly to the public Internet.
Built for defensive visibility, local control and practical incident detection on infrastructure you are authorized to protect.
Collect and correlate relevant host and network telemetry to provide continuous visibility into protected Linux assets.
Low-level Linux observability using eBPF components, designed to capture security-relevant events with minimal intrusion.
Detection logic for SSH brute-force, port scanning, anomalous logins, suspicious activity and potential data exfiltration.
FALCO Guardian turns collected security events into structured detections and incidents. The dashboard provides a clear view of events, incidents, assets, severity and asset risk while keeping the protected node local-first.
A local-first defensive architecture that keeps protected Linux nodes private while turning security telemetry into actionable detections and incidents.
Linux host and network telemetry is collected locally, including low-level eBPF security events.
Events flow through defensive detection logic and are correlated into structured incidents for investigation and response.
The protected node does not require direct public inbound exposure. Optional remote communication is designed to be outbound-only.
FALCO Guardian is being prepared for a public GitHub release. No subscriptions, no paid tiers: the project is intended to be freely available for defensive and authorized use.
Source code, project structure and installation material will be published openly so the community can inspect, learn from and improve the project.
The repository link below is provisional and can be replaced with the final GitHub URL as soon as the public repository is created.
Open GitHubIssues, documentation and contributions can evolve with the project. Security-sensitive deployment details remain under the operator's control.
Follow the project, inspect the source and contribute to an open defensive-security platform built around local control and practical detection.
View provisional GitHub repository