--- title: "Bringing OSS runtime security to AWS: Falco integration with AWS Security Hub CSPM" url: https://daily.dev/posts/bringing-oss-runtime-security-to-aws-falco-integration-with-aws-security-hub-cspm-ge6ppaj3q source_url: https://webflow.sysdig.com/blog/bringing-oss-runtime-security-to-aws-falco-integration-with-aws-security-hub-cspm type: article source: "Sysdig Blog" published: 2026-05-31T07:43:53.734Z updated: 2026-05-31T08:16:56.482Z tags: ["security", "aws", "linux", "kubernetes"] reading_time: 6 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bringing OSS runtime security to AWS: Falco integration with AWS Security Hub CSPM **[Sysdig Blog](https://daily.dev/sources/sysdig-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary Falco, the CNCF-graduated open-source runtime security tool, can now be integrated with AWS Security Hub CSPM via an AWS Marketplace listing. The solution deploys Falco on EKS clusters using eBPF to monitor syscalls at the kernel level, forwarding alerts through FalcoSidekick → CloudWatch → Lambda → Security Hub in AWS Security Finding Format (ASFF). The Marketplace offering automates the entire setup — IAM roles, Lambda functions, CloudWatch log groups, and Falco Helm chart deployment — reducing what was previously a complex multi-service configuration to a ~10-minute deployment. Detections include shell spawns in containers, sensitive file access, privilege escalation, and unusual network activity, all surfaced as categorized findings in AWS Security Hub alongside GuardDuty, Inspector, and other AWS security services. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Falco Links Real-Time Detection with Forensic-Level Analysis in the Cloud Native Stack](https://daily.dev/posts/falco-links-real-time-detection-with-forensic-level-analysis-in-the-cloud-native-stack-ipnqiy7wu) · CNCF · 0 upvotes · 0 comments - [Amazon CloudWatch now supports ingesting Security Hub CSPM findings with organization-wide enablement](https://daily.dev/posts/amazon-cloudwatch-now-supports-ingesting-security-hub-cspm-findings-with-organization-wide-enablemen-hsnh7kwdp) · AWS · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#linux](https://daily.dev/tags/linux), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/bringing-oss-runtime-security-to-aws-falco-integration-with-aws-security-hub-cspm-ge6ppaj3q)