# Blog: Integrate Runtime Security into Your Environment with Falcosidekick

DevFeed: [Blog: Integrate Runtime Security into Your Environment with Falcosidekick](<https://devfeed.tech/articles/blog-integrate-runtime-security-into-your-environment-with-falcosidekick-32519.md>)

Original publisher: [Read original article](<https://falco.org/blog/integrate-runtime-security-with-falcosidekick/>)

Published: 2023-10-24T00:00:00Z

Content type: article

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [Security](<https://devfeed.tech/topics/security.md>), [threat detection](<https://devfeed.tech/topics/threat-detection.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Cloud Native Ecosystem](<https://devfeed.tech/topics/cloud-native-ecosystem.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>), [AWS Lambda](<https://devfeed.tech/topics/aws-lambda.md>), [Cloud Functions](<https://devfeed.tech/topics/cloud-functions.md>), [Cloud Run](<https://devfeed.tech/topics/cloud-run.md>), [Kafka](<https://devfeed.tech/topics/kafka.md>), [RabbitMQ](<https://devfeed.tech/topics/rabbitmq.md>)

Tags: [aws-lambda](<https://devfeed.tech/tags/aws-lambda.md>), [cloud-functions](<https://devfeed.tech/tags/cloud-functions.md>), [cloud-native](<https://devfeed.tech/tags/cloud-native.md>), [cloud-run](<https://devfeed.tech/tags/cloud-run.md>), [falco](<https://devfeed.tech/tags/falco.md>), [falcosidekick](<https://devfeed.tech/tags/falcosidekick.md>), [integrations](<https://devfeed.tech/tags/integrations.md>), [kafka](<https://devfeed.tech/tags/kafka.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [notifications](<https://devfeed.tech/tags/notifications.md>), [rabbitmq](<https://devfeed.tech/tags/rabbitmq.md>), [runtime-security](<https://devfeed.tech/tags/runtime-security.md>), [security](<https://devfeed.tech/tags/security.md>), [tool](<https://devfeed.tech/tags/tool.md>)

## AI overview

This article explains how Falcosidekick extends Falco's limited default output options by forwarding runtime-security events to services such as Slack, PagerDuty, email, AWS Lambda, cloud functions, and message queues. It describes configurable notifications and automated responses for suspicious activity in cloud, container, and Kubernetes environments.

## Source excerpt

If you're looking to integrate runtime security into your existing environment, Falco is an obvious choice. Falco is a Cloud Native Computing Foundation backed open source project that provides real-time threat detection for cloud, container, and Kubernetes workloads. With over 80 million downloads Falco has been adopted by some of the largest companies in the world. However, what many Falco users discover early on is that Falco's default event output is rather limited. Out of the box, Falco can only send output to five different endpoints: syslog, stdout, stderr, and gRPC or HTTPS endpoints. While these outputs might be enough to get you started, most practitioners want to integrate Falco with the tooling they already use. This is where Falcosidekick comes in. Falcosidekick is a companion (i.e. a side-kick ;)) project for Falco that allows Falco events to be forwarded to 60 different services (with more being added all the time) allowing practitioners to monitor and react to Falco events with the tools they are already using. For example, if you'd like to receive immediate notifications of suspicious activity you can forward Falco events to chat programs such as Slack or Telegram, alerting platforms like PagerDuty or AlertManager, or, of course, email. In order to minimize noise, you can expressly set the level on which to notify, for example, warning-level events might be delivered via email, while critical or higher-level events are sent via chat or directed to your alerting platform. If you want to programmatically address certain events, Falcosidekick integrates with a bunch of different services including functions as a service platforms like AWS Lambda, GCP Cloud Run and Cloud Functions, or Knative. Alerts can also be sent to message queues like Amazon SNS, Apache Kafka, or RabbitMQ. These integrations offer almost endless possibilities for building out response systems for events. For instance, let's say you're running Falco on your Kubernetes cluster, and F