diff --git a/content/en/docs/concepts/event-sources/_index.md b/content/en/docs/concepts/event-sources/_index.md index 1d1d7b878..d9a0e2fcc 100644 --- a/content/en/docs/concepts/event-sources/_index.md +++ b/content/en/docs/concepts/event-sources/_index.md @@ -81,7 +81,7 @@ This enables only the `syscall` and `k8s_audit` sources. ### Using the `syscall` source without a driver -By default, Falco enables the `syscall` source and relies on a [kernel driver](/docs/concepts/event-sources/kernel/)) to capture events. However, there are times—such as when testing, debugging, or running plugins that generate `syscall` events—when you may want to run Falco without a driver. +By default, Falco enables the `syscall` source and relies on a [kernel driver](/docs/concepts/event-sources/kernel/)) to capture events. However, there are times — such as when testing, debugging, or running plugins that generate `syscall` events — when you may want to run Falco without a driver. To disable the driver and still use the `syscall` source, run Falco with: