Falco can read events via an ebpf program (instead of the falco-probe kernel module). https://github.com/draios/sysdig/wiki/eBPF So, falco will work on GKE and COS
Falco can read events via an ebpf program (instead of the falco-probe kernel module). https://github.com/draios/sysdig/wiki/eBPF So, falco will work on GKE and COS