It's currently only passive, but that'd be an interesting feature. In order for that to happen we'd have to add that functionality to https://github.com/falcosecurity/libs/ along with the necessary plumbing in the UI.