diff --git a/deploy/iso/minikube-iso/package/Config.in b/deploy/iso/minikube-iso/package/Config.in
index 75aaaf10c62c..8cf3106fd214 100644
--- a/deploy/iso/minikube-iso/package/Config.in
+++ b/deploy/iso/minikube-iso/package/Config.in
@@ -13,4 +13,5 @@ menu "System tools"
     source "$BR2_EXTERNAL_MINIKUBE_PATH/package/gluster/Config.in"
     source "$BR2_EXTERNAL_MINIKUBE_PATH/package/vbox-guest/Config.in"
     source "$BR2_EXTERNAL_MINIKUBE_PATH/package/containerd-bin/Config.in"
+    source "$BR2_EXTERNAL_MINIKUBE_PATH/package/falco-probe/Config.in"
 endmenu
diff --git a/deploy/iso/minikube-iso/package/falco-probe/Config.in b/deploy/iso/minikube-iso/package/falco-probe/Config.in
new file mode 100644
index 000000000000..b8e8b80369a9
--- /dev/null
+++ b/deploy/iso/minikube-iso/package/falco-probe/Config.in
@@ -0,0 +1,6 @@
+config BR2_PACKAGE_FALCO_PROBE
+	bool "falco-probe"
+	default y
+	depends on BR2_LINUX_KERNEL
+	select BR2_PACKAGE_NCURSES
+	select BR2_PACKAGE_LIBYAML
diff --git a/deploy/iso/minikube-iso/package/falco-probe/falco-probe.hash b/deploy/iso/minikube-iso/package/falco-probe/falco-probe.hash
new file mode 100644
index 000000000000..efe14c52333b
--- /dev/null
+++ b/deploy/iso/minikube-iso/package/falco-probe/falco-probe.hash
@@ -0,0 +1,4 @@
+# falco
+sha256 87c60273c35d544256e471b403497be33f24df662673338236ec92ba3fc1f8b7 0.19.0.tar.gz
+# sysdig
+sha256 6e477ac5fe9d3110b870bd4495f01541373a008c375a1934a2d1c46798b6bad6 146a431edf95829ac11bfd9c85ba3ef08789bffe.tar.gz
diff --git a/deploy/iso/minikube-iso/package/falco-probe/falco-probe.mk b/deploy/iso/minikube-iso/package/falco-probe/falco-probe.mk
new file mode 100644
index 000000000000..593ca5f41b3b
--- /dev/null
+++ b/deploy/iso/minikube-iso/package/falco-probe/falco-probe.mk
@@ -0,0 +1,34 @@
+########################################################################
+#
+# Falco probe (driver) kernel module
+#
+########################################################################
+
+FALCO_PROBE_VERSION = 0.19.0
+FALCO_PROBE_SITE = https://github.com/falcosecurity/falco/archive
+FALCO_PROBE_SOURCE = $(FALCO_PROBE_VERSION).tar.gz
+FALCO_PROBE_DEPENDENCIES += ncurses libyaml
+FALCO_PROBE_LICENSE = Apache-2.0
+FALCO_PROBE_LICENSE_FILES = COPYING
+
+# see cmake/modules/sysdig-repo/CMakeLists.txt
+SYSDIG_VERSION = 146a431edf95829ac11bfd9c85ba3ef08789bffe
+FALCO_PROBE_EXTRA_DOWNLOADS = https://github.com/draios/sysdig/archive/${SYSDIG_VERSION}.tar.gz
+
+define FALCO_PROBE_SYSDIG_SRC
+	sed -e 's|URL ".*"|URL "'$(BR2_DL_DIR)/falco-probe/$(SYSDIG_VERSION).tar.gz'"|' -i $(@D)/cmake/modules/sysdig-repo/CMakeLists.txt
+endef
+
+FALCO_PROBE_POST_EXTRACT_HOOKS += FALCO_PROBE_SYSDIG_SRC
+
+FALCO_PROBE_CONF_OPTS = -DFALCO_VERSION=$(FALCO_PROBE_VERSION)
+FALCO_PROBE_CONF_OPTS += -DSYSDIG_VERSION=$(SYSDIG_VERSION)
+FALCO_PROBE_CONF_OPTS += -DUSE_BUNDLED_DEPS=ON
+
+FALCO_PROBE_MAKE_OPTS = driver KERNELDIR=$(LINUX_DIR)
+FALCO_PROBE_INSTALL_OPTS = install_driver
+FALCO_PROBE_INSTALL_STAGING_OPTS = INSTALL_MOD_PATH=$(STAGING_DIR) install_driver
+FALCO_PROBE_INSTALL_TARGET_OPTS = INSTALL_MOD_PATH=$(TARGET_DIR) install_driver
+
+$(eval $(kernel-module))
+$(eval $(cmake-package))