Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.
Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.
Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics/threat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.
Implementing eBPF Security Monitoring
When to Use
When deploying kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters
When you need sub-millisecond visibility into process execution, network connections, and file access
When traditional userspace monitoring tools introduce unacceptable performance overhead
When building detection pipelines that require in-kernel filtering before events reach userspace
When enforcing runtime security policies (kill process, send signal) at the kernel level
Prerequisites
Linux kernel 5.3+ with BTF (BPF Type Format) support enabled
Kubernetes 1.24+ cluster (for Kubernetes deployment) or standalone Linux host
Helm 3.x installed (for Kubernetes deployment)
kubectl configured with cluster access
tetra CLI installed for local event streaming
Python 3.8+ with requests, kubernetes, pyyaml dependencies
Root or CAP_BPF/CAP_SYS_ADMIN capabilities for eBPF program loading
Instructions
1. Install Tetragon on Kubernetes
Deploy Tetragon via Helm to get default process lifecycle observability:
