While Falco is primarily for detection (alerting after an event), Tetragon (by Isovalent, the company behind Cilium) focuses on enforcement (blocking before an event completes) and deep kernel-level visibility.
The Fundamental Difference: Synchronous Enforcement
Falco's eBPF probe captures events and sends them to a user-space engine for rule evaluation. By the time the alert fires, the system call has already returned to the application. The file was opened. The process was spawned. The connection was made.
Tetragon uses LSM BPF hooks — the same enforcement points used by SELinux. When a Tetragon policy says "deny," the kernel function returns an error code before the operation completes. The application receives EPERM. Nothing happened.
For operations that can't be blocked via LSM hooks (e.g., a process that's already running and doing something malicious), Tetragon can send a SIGKILL signal to the process from within the kernel — faster than any user-space signal delivery.
Falco: "Hey, someone just read /etc/shadow!" (The file was already read.)
Tetragon: "Someone tried to read /etc/shadow. I returned EPERM." (The file is safe.)
TracingPolicy: Tetragon's Rule Language
Tetragon policies are Kubernetes CRDs (Custom Resource Definitions) written in YAML:
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: block-sensitive-file-reads
spec:
kprobes:
- call: "fd_install"
syscall: false
args:
- index: 1
type: "file"
selectors:
- matchArgs:
- index: 1
operator: "Prefix"
values:
- "/etc/shadow"
- "/etc/passwd"
- "/root/.ssh/"
matchActions:
- action: Sigkill
This policy attaches to the fd_install kernel function (called when a file descriptor is assigned to a process) and sends SIGKILL to any process that opens a path under /etc/shadow, /etc/passwd, or /root/.ssh/.
Deep Visibility: Function-Level Tracing
Tetragon's uprobes capability enables tracing at the library function level, not just the system call level. This means:
- Trace calls to
SSL_writeinsidelibsslto see what data a process is sending over TLS — even if the network traffic is encrypted. - Trace calls to specific functions inside a Go binary or a JVM without modifying the application.
- Correlate kernel-level events (which file was opened) with user-space context (which function in the application triggered it).
This level of visibility is impossible with user-space APM agents or traditional audit tools.
A common interview question: "What's the difference between Falco and Tetragon?" The precise answer: Falco is a detection tool — it observes system calls via eBPF and fires alerts, but cannot block operations. Tetragon is an enforcement tool — it uses LSM BPF hooks to synchronously deny operations and can kill processes from kernel space. In practice, many organizations run both: Falco for broad detection coverage and alerting integration, Tetragon for targeted enforcement of critical policies (e.g., blocking access to credential files).