> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Falco

> Runtime security on your hosts over SSH — ingest Falco alerts and let agents inspect and kill suspicious sessions.

Falco is runtime threat detection for Linux hosts and containers. Clarion connects to a host over SSH to receive Falco's alerts and to act on suspicious sessions.

<Note>
  **Estimated time:** 10 minutes. You will need SSH access to the host running Falco and the ability to create a dedicated key.
</Note>

## Prerequisites

* A host running **Falco**, reachable over SSH from Clarion
* A dedicated SSH user for Clarion, with only the access it needs
* An SSH private key for that user (a passphrase is supported)

<Warning>
  Give Clarion its own SSH user rather than reusing an operator account. This integration can terminate sessions on the host, so the account's blast radius is the integration's blast radius.
</Warning>

## Connect

1. In Clarion, open **Integrations** and find **Falco**.
2. Enter the **Host** — an IP address or hostname, e.g. `192.168.1.100` or `host.example.com`.
3. Enter the **SSH Username**.
4. Paste the **SSH Private Key**, and its **passphrase** if it has one.
5. Click **Connect**.

Credentials are stored encrypted and never enter the agent sandbox.

## What Clarion ingests

Falco runtime alerts — unexpected process execution, suspicious file access, container escapes, privilege escalation, and outbound connections that break policy. These feed the [Infrastructure & Ops](/learn/agents/our-agents) agent, alongside Grafana and Better Stack.

## What agents can do

| Tool            | What it does                     |
| --------------- | -------------------------------- |
| `list_sessions` | List active sessions on the host |
| `kill_sessions` | Terminate one or more sessions   |

<Warning>
  `kill_sessions` disconnects a live user. It is a containment action and is gated behind approval by default.
</Warning>

## Disconnect

Click **Disconnect** on the integration page. The stored SSH credentials are deleted.