---
title: 'Addon: falco'
description: Canonical makes open source secure, reliable and easy to use, providing
  support for Ubuntu and a portfolio of enterprise-grade technologies. Founded in
  2004, Canonical operates globally with team members in over 80 countries.
url: https://canonical.com/microk8s/docs/addon-falco?format=md
---

*Submit*

# Addon: falco

**Compatibility**:
**Source**: See [falco](https://falco.org/) website for details.

Falco is a cloud-native security tool designed for Linux systems. It employs custom rules on kernel events, which are enriched with container and Kubernetes metadata, to provide real-time alerts. Falco helps you gain visibility into abnormal behavior, potential security threats, and compliance violations, contributing to comprehensive runtime security.

To enable the addon:

```
microk8s enable falco
```

The addon can be disabled at any time with:

```
microk8s disable falco
```

Last updated 2 years ago. [Help improve this document in the forum](https://discuss.kubernetes.io/t/addon-falco/26227).