implementing-ebpf-security-monitoring

name	implementing-ebpf-security-monitoring
description	Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.
domain	cybersecurity
subdomain	security-operations
tags	["ebpf","tetragon","cilium","runtime-security","observability","kernel-security","kubernetes-security"]
version	1.0
author	mukul975
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
nist_csf	["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"]
mitre_attack	["T1078","T1190","T1059","T1685.002","T1685.005"]
source	https://github.com/mukul975/Anthropic-Cybersecurity-Skills
source_commit	04450304b12645cb2b974ab96d28c0664758a88d
note	Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics/threat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.

Implementing eBPF Security Monitoring

When to Use

• When deploying kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters
• When you need sub-millisecond visibility into process execution, network connections, and file access
• When traditional userspace monitoring tools introduce unacceptable performance overhead
• When building detection pipelines that require in-kernel filtering before events reach userspace
• When enforcing runtime security policies (kill process, send signal) at the kernel level

Prerequisites

• Linux kernel 5.3+ with BTF (BPF Type Format) support enabled
• Kubernetes 1.24+ cluster (for Kubernetes deployment) or standalone Linux host
• Helm 3.x installed (for Kubernetes deployment)
• kubectl configured with cluster access
• tetra CLI installed for local event streaming
• Python 3.8+ with requests, kubernetes, pyyaml dependencies
• Root or CAP_BPF/CAP_SYS_ADMIN capabilities for eBPF program loading

Instructions

1. Install Tetragon on Kubernetes

Deploy Tetragon via Helm to get default process lifecycle observability:

helm repo add cilium https://helm.cilium.io
helm repo update
helm install tetragon cilium/tetragon -n kube-system \
  --set tetragon.enableProcessCred=true \
  --set tetragon.enableProcessNs=true

Verify the installation:

kubectl get pods -n kube-system -l app.kubernetes.io/name=tetragon
kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon -c export-stdout -f | head -20

2. Install Tetragon on Standalone Linux

For non-Kubernetes Linux hosts, install from the tarball release:

curl -LO https://github.com/cilium/tetragon/releases/latest/download/tetragon-linux-amd64.tar.gz
tar xzf tetragon-linux-amd64.tar.gz
sudo cp tetragon /usr/local/bin/
sudo cp tetra /usr/local/bin/

# Start tetragon daemon
sudo tetragon --btf /sys/kernel/btf/vmlinux &

# Stream events
tetra getevents -o compact