Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.
When deploying kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters
When you need sub-millisecond visibility into process execution, network connections, and file access
When traditional userspace monitoring tools introduce unacceptable performance overhead
When building detection pipelines that require in-kernel filtering before events reach userspace
When enforcing runtime security policies (kill process, send signal) at the kernel level
Common Misconfigurations & Verification
No BTF = silent no-load: Tetragon needs kernel BTF (/sys/kernel/btf/vmlinux) or a matching external BTF for kprobe arg typing. On older/stripped kernels (no CONFIG_DEBUG_INFO_BTF) probes fail to attach and you get zero kprobe events while process_exec still flows — masking the gap. Verify ls /sys/kernel/btf/vmlinux and check kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon for attach errors.
Ring-buffer/event drops under load: high event volume overflows the perf/ring buffer and Tetragon drops events — a coverage hole that looks like "nothing happened." Watch tetragon_*_events_total and missed/map_errors metrics, scope policies with in-kernel matchArgs/matchBinaries selectors (filter in-kernel, not in userspace), and avoid an unfiltered tcp_connect Post on a busy host.
Probe coverage gaps: a syscall-name hook (sys_execve) can be bypassed by a different entry point or arch (compat/32-bit, execveat); matching on a fragile Postfix/Prefix string (e.g., xmrig) is trivially evaded by renaming the binary. Prefer hashes/paths and hook stable internal funcs (commit_creds, fd_install) over syscall names where possible.
Namespaced policy scoping mistakes: a TracingPolicyNamespaced only applies to its namespace — host-level or other-namespace activity goes unmonitored if you assumed cluster-wide.
Enforcement risk: a Sigkill action on a too-broad selector can kill legitimate processes — stage every enforcement policy in Post (observe) mode first and review events before switching to Sigkill.
Verification: apply a policy, then deliberately trip it (e.g., cat /etc/shadow, curl to an external IP, exec a renamed xmrig) and confirm the matching process_kprobe event appears in tetra getevents -o json and lands in your SIEM sink before trusting the control.
Prerequisites
Linux kernel 5.3+ with BTF (BPF Type Format) support enabled
Kubernetes 1.24+ cluster (for Kubernetes deployment) or standalone Linux host
Helm 3.x installed (for Kubernetes deployment)
kubectl configured with cluster access
tetra CLI installed for local event streaming
Python 3.8+ with requests, kubernetes, pyyaml dependencies
Root or CAP_BPF/CAP_SYS_ADMIN capabilities for eBPF program loading
Instructions
1. Install Tetragon on Kubernetes
Deploy Tetragon via Helm to get default process lifecycle observability:
