Deploy Falco in a staging environment and generate a few known security-relevant actions, such as an unexpected shell in a container or a write to a sensitive path. Check that the alert includes enough process and workload context for an operator to respond.
Then replay normal application activity and measure false positives. Decide which alerts page someone, which only go to investigation, and how rules are updated. Runtime detection helps when alerts are actionable and the team can verify the event without drowning in noise.
Akousa