The article did instrumentation such as this:

  #!/snap/bin/bpftrace
  
  #include <net/bluetooth/bluetooth.h>
  #include <net/bluetooth/hci_core.h>
  
  kprobe:mgmt_device_found
  {
  $dev=( struct hci_dev *) arg0;
  printf("%s\n", $dev->name);
  }

AFAIK that's way beyond Falco's capabilities.