SecOps Fleet Overview
Active system errors, real-time high-priority threats, autonomous host telemetry, and audit activity
Live Fleet Resource Utilization
Live host metricsRecent High-Priority Threats
View All Alerts| Time | Severity | Rule | Host | Details | Actions |
|---|---|---|---|---|---|
| No recent threats detected. | |||||
System & Audit Activity
Fleet Host Inventory & Agent Management
Click any registered agent to open its dedicated management page, or use Quick Inspect for rapid edits
| Name | Hostname & Agent ID | Description | IP & Status | Resources (CPU / RAM / Disk) | Active Containers | Sensors & Rule Sync | Detection Group Tags | Actions |
|---|---|---|---|---|---|---|---|---|
| Loading registered hosts... | ||||||||
Agent Management
Manage host identity, detection group tags, custom monitors, effective Falco rules, and FIM paths
Host Identity & Description
Assigned Detection Group Tags
Manage Tag LibraryDetection Group tags determine which Falco rule bundles and FIM policies are automatically compiled and delivered to this agent.
Live Host Telemetry
Active Container Workloads
Green = Running • Red = Exited/StoppedAssigned Custom Health Monitors
Isolated Python test scripts executed by this agent on every heartbeat
| Monitor Name & Script | Scope | Interval / Timeout | Status & Latency | Last Trigger | Last Output | Actions |
|---|---|---|---|---|---|---|
| Loading agent monitors... | ||||||
Effective Falco Rules Applied to This Agent
Compiled from global rules + assigned Detection Group tags
| Rule ID | Name | Detection Group Tag | Description | Actions |
|---|---|---|---|---|
| Loading effective rules... | ||||
View Compiled Agent Falco YAML Bundle
Watched FIM Paths & SHA-256 Baseline Status
Files monitored for unauthorized modification or deletion on this host — investigate diffs or accept baseline changes below
| File Path | Baseline Status | SHA-256 Digest | Last Checked | Investigation & Baseline Actions |
|---|---|---|---|---|
| Loading FIM status... | ||||
File Integrity Monitoring (FIM) Policies & Baselines
Assign critical files to watch via the UI and apply policies globally, by Detection Group tag, or to individual hosts
Configured FIM Watch Path Policies
Delivered dynamically to agents on every heartbeat| Watched File Path | Scope Type | Target Tag / Host | Description | Status | Actions |
|---|---|---|---|---|---|
| Loading FIM policies... | |||||
Fleet Host FIM Baseline & Drift Matrix
Click any host row or "📂 Drill Down Files" to inspect all watched paths, SHA-256 digests, unified diffs, and baseline controls
| Host | Tags | Overall FIM Status | Watched Paths Summary | Last Verified | Investigation & Baseline Actions |
|---|---|---|---|---|---|
| Loading fleet FIM status... | |||||
System Status & Custom Health Monitors
Dropbox Statuspage-style operational view, Git monitor template library, last trigger history, and isolated Python checks
Monitor Library (monitors/library)
Built-in & custom Python monitors saved to disk in monitors/library — select monitors via checkboxes or use the multi-group tag dropdown to assign to multiple Detection Groups
| Monitor & Script File | Type | Description | Deployment State | Assigned Tag Groups | Actions | |
|---|---|---|---|---|---|---|
| Loading Monitor Library (monitors/library)... | ||||||
Deployed Host Health Checks (Organized by Host)
All health check scripts actively deployed to registered agents — one row per (Host, Check) pair, grouped by host
Configured Custom Monitor Scripts & Scope Assignments
Assign monitors to Global, a Host Configuration Group Tag, an Individual Host, or keep unassigned in the library
| Monitor | Assignment Scope | Deployment State | Public (:8081) | Interval | Timeout | Threshold | Last Check Result | Last Trigger | Actions |
|---|---|---|---|---|---|---|---|---|---|
| Loading monitors... | |||||||||
Past Incidents (14-Day Chronological History)
Falco Rules, Detection Group Tags, & Official Rule Library
Full CRUD for Detection Group tags, active rule tuning, and upstream falcosecurity/rules library
Host Configuration Groups (Unified Tags for Falco, FIM & Health Monitors)
Create, edit, or delete group tags used to apply Falco rules, FIM watch paths, and Custom Health Monitors across fleet hosts
Active Scoped Falco Rules (Deployed to Hosts / Tag Groups)
Click any Host Configuration Group card above to filter rules, or select multiple rules below to move or remove them in bulk
| Rule ID | Name | Scope Tag (Group / Host) | Description | Rule Status | Actions | |
|---|---|---|---|---|---|---|
| Loading rules... | ||||||
🗂️ Saved Custom Rules Library (Unassigned / Draft Custom Rules)
Dedicated workspace for your custom-written or tuned Falco rules that are saved for reuse and separate from the official upstream library
| Rule ID | Custom Rule Name | Description | Library State | Deploy to Group / Actions |
|---|---|---|---|---|
| No saved custom rules in library yet. Click "+ New Saved Custom Rule" or "Move to Custom Library" on any active rule. | ||||
Per-Host Rule Validation & Delivery Status
| Hostname | Assigned Detection Groups | Bundle State | Sync Status | Validation Message | Last Sync Attempt |
|---|---|---|---|---|---|
| Loading fleet validation status... | |||||
Official Upstream Falco Rule Library (github.com/falcosecurity/rules)
Search all 3 official Falco rule feeds (Stable, Incubating, Sandbox), assign them to any Detection Group tag, and tune YAML
| Official Rule | Priority | Feed | Upstream Tags | Description | Actions | |
|---|---|---|---|---|---|---|
| Loading official Falco rule library... | ||||||
Security Alert Explorer
Falco runtime security stream, debouncing deduplication, and forensic audit feed (50 alerts per page)
| Timestamp | Severity | Rule Name | Source Host | Details | Actions |
|---|---|---|---|---|---|
| Loading security alerts... | |||||