Bringing OSS runtime security to AWS: Falco integration with AWS Security Hub CSPM

This document outlines an AWS Marketplace solution that automates deploying Falco to EKS and integrates its runtime security alerts into AWS Security Hub CSPM. It details the deployment steps, architecture (Falco, FalcoSidekick, CloudWatch, Lambda, Security Hub), and example detections (shell spawns, sensitive file access, privilege escalation), emphasizing rapid time-to-value, centralized visibility, workflow management, and compliance alignment for DevOps and security teams.