Falco is runtime threat detection for Linux hosts and containers. Clarion connects to a host over SSH to receive Falco’s alerts and to act on suspicious sessions.
Estimated time: 10 minutes. You will need SSH access to the host running Falco and the ability to create a dedicated key.
Prerequisites
- A host running Falco, reachable over SSH from Clarion
- A dedicated SSH user for Clarion, with only the access it needs
- An SSH private key for that user (a passphrase is supported)
Give Clarion its own SSH user rather than reusing an operator account. This integration can terminate sessions on the host, so the account’s blast radius is the integration’s blast radius.
Connect
- In Clarion, open Integrations and find Falco.
- Enter the Host — an IP address or hostname, e.g.
192.168.1.100 or host.example.com.
- Enter the SSH Username.
- Paste the SSH Private Key, and its passphrase if it has one.
- Click Connect.
Credentials are stored encrypted and never enter the agent sandbox.
What Clarion ingests
Falco runtime alerts — unexpected process execution, suspicious file access, container escapes, privilege escalation, and outbound connections that break policy. These feed the Infrastructure & Ops agent, alongside Grafana and Better Stack.
What agents can do
kill_sessions disconnects a live user. It is a containment action and is gated behind approval by default.
Disconnect
Click Disconnect on the integration page. The stored SSH credentials are deleted. 
