diff --git a/userspace/engine/evttype_index_ruleset.h b/userspace/engine/evttype_index_ruleset.h
index 6eac80786ed..9e7d14db396 100644
--- a/userspace/engine/evttype_index_ruleset.h
+++ b/userspace/engine/evttype_index_ruleset.h
@@ -24,11 +24,10 @@ limitations under the License.
 #include <map>
 
 #include "filter_ruleset.h"
-#include "sinsp.h"
-#include "filter.h"
-#include "event.h"
-
-#include "gen_filter.h"
+#include <libsinsp/sinsp.h>
+#include <libsinsp/filter.h>
+#include <libsinsp/event.h>
+#include <libsinsp/gen_filter.h>
 
 /*!
 	\brief A filter_ruleset that indexes enabled rules by event type,
diff --git a/userspace/engine/falco_common.h b/userspace/engine/falco_common.h
index dd4f07b4566..7a4476f9f8f 100644
--- a/userspace/engine/falco_common.h
+++ b/userspace/engine/falco_common.h
@@ -20,7 +20,7 @@ limitations under the License.
 #include <string>
 #include <exception>
 #include <mutex>
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 
 //
 // equivalent to an "unbounded queue" in TBB terms or largest long value
diff --git a/userspace/engine/falco_engine.cpp b/userspace/engine/falco_engine.cpp
index 34374b98a05..daa770d6b4a 100644
--- a/userspace/engine/falco_engine.cpp
+++ b/userspace/engine/falco_engine.cpp
@@ -32,8 +32,9 @@ limitations under the License.
 
 #include <nlohmann/json.hpp>
 
-#include <sinsp.h>
-#include <plugin.h>
+#include <libsinsp/sinsp.h>
+#include <libsinsp/plugin.h>
+#include <libsinsp/utils.h>
 
 #include "falco_engine.h"
 #include "falco_utils.h"
@@ -43,7 +44,6 @@ limitations under the License.
 
 #include "formats.h"
 
-#include "utils.h"
 #include "evttype_index_ruleset.h"
 
 const std::string falco_engine::s_default_ruleset = "falco-default-ruleset";
diff --git a/userspace/engine/falco_engine.h b/userspace/engine/falco_engine.h
index 69eece862e7..61a58238223 100644
--- a/userspace/engine/falco_engine.h
+++ b/userspace/engine/falco_engine.h
@@ -30,7 +30,7 @@ limitations under the License.
 
 #include <nlohmann/json.hpp>
 
-#include "gen_filter.h"
+#include <libsinsp/gen_filter.h>
 #include "filter_ruleset.h"
 #include "rule_loader.h"
 #include "rule_loader_collector.h"
diff --git a/userspace/engine/falco_rule.h b/userspace/engine/falco_rule.h
index d2028bfe9d3..6636ce72283 100644
--- a/userspace/engine/falco_rule.h
+++ b/userspace/engine/falco_rule.h
@@ -21,7 +21,7 @@ limitations under the License.
 #include <string>
 #include "falco_common.h"
 
-#include <filter/ast.h>
+#include <libsinsp/filter/ast.h>
 
 /*!
 	\brief Represents a list in the Falco Engine.
diff --git a/userspace/engine/falco_utils.cpp b/userspace/engine/falco_utils.cpp
index fa415f9eb76..75a3f80145b 100644
--- a/userspace/engine/falco_utils.cpp
+++ b/userspace/engine/falco_utils.cpp
@@ -21,7 +21,7 @@ limitations under the License.
 #include <iomanip>
 
 #include "falco_utils.h"
-#include "utils.h"
+#include <libsinsp/utils.h>
 
 #include <re2/re2.h>
 
diff --git a/userspace/engine/filter_details_resolver.h b/userspace/engine/filter_details_resolver.h
index 4030537b712..38c3154f8c2 100644
--- a/userspace/engine/filter_details_resolver.h
+++ b/userspace/engine/filter_details_resolver.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include <filter/parser.h>
+#include <libsinsp/filter/parser.h>
 #include <string>
 #include <unordered_set>
 #include <unordered_map>
diff --git a/userspace/engine/filter_macro_resolver.h b/userspace/engine/filter_macro_resolver.h
index e7377705ffe..2f4a9c6af70 100644
--- a/userspace/engine/filter_macro_resolver.h
+++ b/userspace/engine/filter_macro_resolver.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include <filter/parser.h>
+#include <libsinsp/filter/parser.h>
 #include <string>
 #include <unordered_set>
 #include <unordered_map>
diff --git a/userspace/engine/filter_ruleset.h b/userspace/engine/filter_ruleset.h
index e84af57f285..2ee75f45450 100644
--- a/userspace/engine/filter_ruleset.h
+++ b/userspace/engine/filter_ruleset.h
@@ -18,11 +18,11 @@ limitations under the License.
 #pragma once
 
 #include "falco_rule.h"
-#include <filter/ast.h>
-#include <filter.h>
-#include <event.h>
-#include <gen_filter.h>
-#include <events/sinsp_events.h>
+#include <libsinsp/filter/ast.h>
+#include <libsinsp/filter.h>
+#include <libsinsp/event.h>
+#include <libsinsp/gen_filter.h>
+#include <libsinsp/events/sinsp_events.h>
 
 /*!
 	\brief Manages a set of rulesets. A ruleset is a set of
diff --git a/userspace/engine/filter_warning_resolver.cpp b/userspace/engine/filter_warning_resolver.cpp
index 45e477a765d..730a5d97737 100644
--- a/userspace/engine/filter_warning_resolver.cpp
+++ b/userspace/engine/filter_warning_resolver.cpp
@@ -15,7 +15,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 #include "filter_warning_resolver.h"
 
 using namespace falco;
diff --git a/userspace/engine/filter_warning_resolver.h b/userspace/engine/filter_warning_resolver.h
index 8479b7e491d..1dc0d645c36 100644
--- a/userspace/engine/filter_warning_resolver.h
+++ b/userspace/engine/filter_warning_resolver.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include <filter/parser.h>
+#include <libsinsp/filter/parser.h>
 #include <string>
 #include <set>
 #include <memory>
diff --git a/userspace/engine/formats.h b/userspace/engine/formats.h
index a4306b4e353..6babbcf9143 100644
--- a/userspace/engine/formats.h
+++ b/userspace/engine/formats.h
@@ -19,7 +19,7 @@ limitations under the License.
 
 #include <string>
 #include <map>
-#include <gen_filter.h>
+#include <libsinsp/gen_filter.h>
 #include "falco_engine.h"
 
 class falco_formats
diff --git a/userspace/engine/rule_loader.h b/userspace/engine/rule_loader.h
index cad99361755..78716cbd767 100644
--- a/userspace/engine/rule_loader.h
+++ b/userspace/engine/rule_loader.h
@@ -24,7 +24,7 @@ limitations under the License.
 #include "falco_source.h"
 #include "falco_load_result.h"
 #include "indexed_vector.h"
-#include "version.h"
+#include <libsinsp/version.h>
 
 namespace rule_loader
 {
diff --git a/userspace/engine/rule_loader_collector.cpp b/userspace/engine/rule_loader_collector.cpp
index 5ec5e5795af..2e0cb4e6a65 100644
--- a/userspace/engine/rule_loader_collector.cpp
+++ b/userspace/engine/rule_loader_collector.cpp
@@ -16,7 +16,7 @@ limitations under the License.
 */
 
 #include <string>
-#include <version.h>
+#include <libsinsp/version.h>
 
 #include "falco_engine.h"
 #include "rule_loader_collector.h"
diff --git a/userspace/engine/rule_loader_reader.cpp b/userspace/engine/rule_loader_reader.cpp
index 1983583c635..32ae9ec73c7 100644
--- a/userspace/engine/rule_loader_reader.cpp
+++ b/userspace/engine/rule_loader_reader.cpp
@@ -20,7 +20,7 @@ limitations under the License.
 
 #include "rule_loader_reader.h"
 #include "falco_engine_version.h"
-#include "logger.h"
+#include <libsinsp/logger.h>
 
 #define THROW(cond, err, ctx)    { if ((cond)) { throw rule_loader::rule_load_exception(falco::load_result::LOAD_ERR_YAML_VALIDATE, (err), (ctx)); } }
 
diff --git a/userspace/engine/rule_loader_reader.h b/userspace/engine/rule_loader_reader.h
index 378556c1dbf..76fb7cb30a0 100644
--- a/userspace/engine/rule_loader_reader.h
+++ b/userspace/engine/rule_loader_reader.h
@@ -19,8 +19,8 @@ limitations under the License.
 
 #include "rule_loader.h"
 #include "rule_loader_collector.h"
-#include "logger.h"
-#include "version.h"
+#include <libsinsp/logger.h>
+#include <libsinsp/version.h>
 #include "falco_engine_version.h"
 
 namespace rule_loader
diff --git a/userspace/falco/app/actions/helpers_generic.cpp b/userspace/falco/app/actions/helpers_generic.cpp
index 2a199158a1a..0f779e9fdcc 100644
--- a/userspace/falco/app/actions/helpers_generic.cpp
+++ b/userspace/falco/app/actions/helpers_generic.cpp
@@ -16,7 +16,7 @@ limitations under the License.
 */
 
 #include "helpers.h"
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 #include <unordered_set>
 
diff --git a/userspace/falco/app/actions/helpers_inspector.cpp b/userspace/falco/app/actions/helpers_inspector.cpp
index d35c8e8832c..1cc029fafcc 100644
--- a/userspace/falco/app/actions/helpers_inspector.cpp
+++ b/userspace/falco/app/actions/helpers_inspector.cpp
@@ -19,7 +19,7 @@ limitations under the License.
 #include <sys/stat.h>
 #include <fcntl.h>
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 #include <configuration.h>
 
 #include "helpers.h"
diff --git a/userspace/falco/app/actions/init_falco_engine.cpp b/userspace/falco/app/actions/init_falco_engine.cpp
index 358c60e2c70..a81f7ec7d5d 100644
--- a/userspace/falco/app/actions/init_falco_engine.cpp
+++ b/userspace/falco/app/actions/init_falco_engine.cpp
@@ -16,7 +16,7 @@ limitations under the License.
 */
 
 #include "actions.h"
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;
diff --git a/userspace/falco/app/actions/init_inspectors.cpp b/userspace/falco/app/actions/init_inspectors.cpp
index 110c0db7a0e..503af19a60e 100644
--- a/userspace/falco/app/actions/init_inspectors.cpp
+++ b/userspace/falco/app/actions/init_inspectors.cpp
@@ -20,7 +20,7 @@ limitations under the License.
 
 #include <unordered_set>
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;
diff --git a/userspace/falco/app/actions/list_plugins.cpp b/userspace/falco/app/actions/list_plugins.cpp
index 8c9c6702cac..aeda72c26a9 100644
--- a/userspace/falco/app/actions/list_plugins.cpp
+++ b/userspace/falco/app/actions/list_plugins.cpp
@@ -18,7 +18,7 @@ limitations under the License.
 #include "actions.h"
 #include "helpers.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;
diff --git a/userspace/falco/app/actions/load_plugins.cpp b/userspace/falco/app/actions/load_plugins.cpp
index 2d2cd95b8e0..d492d84a29b 100644
--- a/userspace/falco/app/actions/load_plugins.cpp
+++ b/userspace/falco/app/actions/load_plugins.cpp
@@ -16,7 +16,7 @@ limitations under the License.
 */
 
 #include "actions.h"
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;
diff --git a/userspace/falco/app/actions/load_rules_files.cpp b/userspace/falco/app/actions/load_rules_files.cpp
index f38af052b49..68d0244d7e1 100644
--- a/userspace/falco/app/actions/load_rules_files.cpp
+++ b/userspace/falco/app/actions/load_rules_files.cpp
@@ -18,7 +18,7 @@ limitations under the License.
 #include "actions.h"
 #include "helpers.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 #include <unordered_set>
 
diff --git a/userspace/falco/app/actions/print_plugin_info.cpp b/userspace/falco/app/actions/print_plugin_info.cpp
index 8251ef1f620..4c52e39177e 100644
--- a/userspace/falco/app/actions/print_plugin_info.cpp
+++ b/userspace/falco/app/actions/print_plugin_info.cpp
@@ -18,7 +18,7 @@ limitations under the License.
 #include "actions.h"
 #include "helpers.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;
diff --git a/userspace/falco/app/actions/process_events.cpp b/userspace/falco/app/actions/process_events.cpp
index 72f916a2d24..5f942eac63d 100644
--- a/userspace/falco/app/actions/process_events.cpp
+++ b/userspace/falco/app/actions/process_events.cpp
@@ -35,7 +35,7 @@ limitations under the License.
 #include "../../falco_outputs.h"
 #include "../../event_drops.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 using namespace falco::app;
 using namespace falco::app::actions;
diff --git a/userspace/falco/app/options.h b/userspace/falco/app/options.h
index 4a568e3d801..4d0dc661f73 100644
--- a/userspace/falco/app/options.h
+++ b/userspace/falco/app/options.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include <event.h>
+#include <libsinsp/event.h>
 
 #include <string>
 #include <vector>
diff --git a/userspace/falco/app/state.h b/userspace/falco/app/state.h
index 7b420ad917a..1d23aac6a55 100644
--- a/userspace/falco/app/state.h
+++ b/userspace/falco/app/state.h
@@ -28,7 +28,7 @@ limitations under the License.
 #include "../webserver.h"
 #endif
 
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 
 #include <string>
 #include <memory>
diff --git a/userspace/falco/event_drops.h b/userspace/falco/event_drops.h
index 2b27ffc8971..9caf5a3a3bf 100644
--- a/userspace/falco/event_drops.h
+++ b/userspace/falco/event_drops.h
@@ -19,8 +19,8 @@ limitations under the License.
 #include <memory>
 #include <unordered_set>
 
-#include <sinsp.h>
-#include <token_bucket.h>
+#include <libsinsp/sinsp.h>
+#include <libsinsp/token_bucket.h>
 
 #include "logger.h"
 #include "falco_outputs.h"
diff --git a/userspace/falco/falco_outputs.h b/userspace/falco/falco_outputs.h
index 5e0577a8b36..be2e603dfeb 100644
--- a/userspace/falco/falco_outputs.h
+++ b/userspace/falco/falco_outputs.h
@@ -20,7 +20,7 @@ limitations under the License.
 #include <memory>
 #include <map>
 
-#include "gen_filter.h"
+#include <libsinsp/gen_filter.h>
 #include "falco_common.h"
 #include "falco_engine.h"
 #include "outputs.h"
diff --git a/userspace/falco/logger.h b/userspace/falco/logger.h
index 2dab04b4c8b..ec7aeb6c760 100644
--- a/userspace/falco/logger.h
+++ b/userspace/falco/logger.h
@@ -17,7 +17,7 @@ limitations under the License.
 
 #pragma once
 
-#include "sinsp.h"
+#include <libsinsp/sinsp.h>
 #ifndef _WIN32
 #include <syslog.h>
 #endif
diff --git a/userspace/falco/outputs.h b/userspace/falco/outputs.h
index ac00f4544fa..70291fac026 100644
--- a/userspace/falco/outputs.h
+++ b/userspace/falco/outputs.h
@@ -21,7 +21,7 @@ limitations under the License.
 #include <map>
 
 #include "falco_common.h"
-#include "gen_filter.h"
+#include <libsinsp/gen_filter.h>
 #include <nlohmann/json.hpp>
 
 namespace falco
diff --git a/userspace/falco/stats_writer.cpp b/userspace/falco/stats_writer.cpp
index 1a414e2abed..da5180fc6be 100644
--- a/userspace/falco/stats_writer.cpp
+++ b/userspace/falco/stats_writer.cpp
@@ -29,7 +29,8 @@ limitations under the License.
 #include "stats_writer.h"
 #include "logger.h"
 #include "config_falco.h"
-#include "strl.h"
+#include <libscap/strl.h>
+#include <libscap/scap_vtable.h>
 
 // note: ticker_t is an uint16_t, which is enough because we don't care about
 // overflows here. Threads calling stats_writer::handle() will just
diff --git a/userspace/falco/stats_writer.h b/userspace/falco/stats_writer.h
index b126367b532..451cf245521 100644
--- a/userspace/falco/stats_writer.h
+++ b/userspace/falco/stats_writer.h
@@ -21,7 +21,7 @@ limitations under the License.
 #include <string>
 #include <unordered_map>
 
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 
 #ifndef __EMSCRIPTEN__
 #include "tbb/concurrent_queue.h"
diff --git a/userspace/falco/versions_info.cpp b/userspace/falco/versions_info.cpp
index 678ea76c2e5..84719729c5a 100644
--- a/userspace/falco/versions_info.cpp
+++ b/userspace/falco/versions_info.cpp
@@ -20,7 +20,7 @@ limitations under the License.
 #include "config_falco.h"
 #include "falco_engine_version.h"
 
-#include <plugin_manager.h>
+#include <libsinsp/plugin_manager.h>
 
 // todo: move string conversion to scap
 static std::string get_driver_api_version(const std::shared_ptr<sinsp>& s)
diff --git a/userspace/falco/versions_info.h b/userspace/falco/versions_info.h
index 570a6b3f550..7316b90c5e6 100644
--- a/userspace/falco/versions_info.h
+++ b/userspace/falco/versions_info.h
@@ -20,7 +20,7 @@ limitations under the License.
 #include <memory>
 #include <string>
 #include <unordered_map>
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 #include <nlohmann/json.hpp>
 
 namespace falco
diff --git a/userspace/falco/webserver.h b/userspace/falco/webserver.h
index ad00beee687..7498b120574 100644
--- a/userspace/falco/webserver.h
+++ b/userspace/falco/webserver.h
@@ -21,7 +21,7 @@ limitations under the License.
 #include <httplib.h>
 #include <thread>
 #include <memory>
-#include <sinsp.h>
+#include <libsinsp/sinsp.h>
 #include "configuration.h"
 
 class falco_webserver