Falco Outputs

Falco can send alerts to one or more output channels:

• Standard Output
• A file
• Syslog
• A spawned program
• An HTTP/HTTPS endpoint
• A client via the gRPC API (deprecated)

The channels are configured via the Falco configuration file falco.yaml. See the Falco Configuration page for more details.

Find further information about how to configure each of those channels under Output Channels.

Integration with third parties

Falco alerts can easily be forwarded to third-party systems like off-host SIEM, databases, or Faas. While many tools can natively connect to the generic outputs channels that Falco provides such as files and standard output, a forwarder proxy, Falcosidekick, was created to facilitate integration with more than 50 different systems.