Falco loads plugins based on configuration in falco.yaml . Currently, if a plugin with event sourcing capability is loaded then the only events processed are from that plugin; syscall events are disabled. There are other restrictions on loaded plugins (see below).
Docs: How Falco Uses Plugins
calendar_today
January 1, 2001
domain
falco