Lightweight Runtime Monitoring for Edge Devices – Possible Complement to Falco?

[MicroAI-Inc]

I’ve been working with a lightweight runtime monitoring tool that’s designed specifically for embedded systems, IoT devices, and edge infrastructure — where running a full container stack or kernel module isn’t always possible.

The project is called MicroAI Security & Monitoring, and it focuses on delivering real-time behavioral monitoring, file integrity alerts, and resource telemetry from devices running Linux or Windows — especially in environments with limited compute, memory, or network access.

What makes it relevant here:

• It performs agent-level anomaly detection based on system activity (processes, file changes, users, etc.)
• Exposes data in Prometheus-compatible format for observability pipelines
• Includes a Grafana dashboard for quick visualization
• Designed for non-containerized or constrained devices at the edge

We’re looking to fill the gap in edge and embedded environments where Falco might not be deployable due to kernel constraints or lack of container infrastructure.

Curious if anyone here has explored:

• Complementary setups using Falco for core/container infrastructure and lighter agents at the edge
• Sending data from remote devices into centralized threat detection pipelines
• Use cases where resource-aware runtime monitoring is needed outside Kubernetes

Would love any feedback or thoughts from this community. Here’s the repo if you’re curious:
👉 https://github.com/MicroAIInc/MicroAI-Security-and-Monitoring

Thanks in advance!