菜单
Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement. Use when implementing ebpf-based runtime security observability and enforcement in kubernetes clusters.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/oyi77/1ai-skills --skill implementing-runtime-security-with-tetragon命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Android and mobile application security testing — emulators, rooting, traffic interception, dynamic instrumentation. Use when testing mobile apps for vulnerabilities, reversing APKs, or bypassing security controls on Android.
Self-reflection + Self-criticism + Auto-learning from corrections + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when working with self improving.
Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities. Use when working with conducting full scope red team engagement.
基于 SOC 职业分类
正在显示 SKILL.md
| name | implementing-runtime-security-with-tetragon |
| description | Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement. Use when implementing ebpf-based runtime security observability and enforcement in kubernetes clusters. |
| domain | cybersecurity |
| subdomain | container-security |
| tags | ["tetragon","ebpf","runtime-security","kubernetes","cilium","container-security","observability","kernel-security","cncf"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_ai_rmf | ["MEASURE-2.7","MAP-5.1","MANAGE-2.4"] |
| atlas_techniques | ["AML.T0070","AML.T0066","AML.T0082"] |
| nist_csf | ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"] |
Tetragon is a CNCF project under Cilium that provides flexible Kubernetes-aware security observability and runtime enforcement using eBPF. By operating at the Linux kernel level, Tetragon can monitor and enforce policies on process execution, file access, network connections, and system calls with less than 1% performance overhead -- far more efficient than traditional user-space security agents.
Trigger phrases:
"implementing runtime security with tetragon"
"Implement eBPF-based runtime security observability and enforcement in Kubernete"
When deploying or configuring implementing runtime security with tetragon capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
This section covers core concepts for implementing runtime security with tetragon.
Tetragon attaches eBPF programs directly to kernel functions, enabling:
Tetragon uses TracingPolicy CRDs to define what kernel events to observe and what actions to take:
apiVersion: cilium.io/v1alpha1
kind:
Tetragon can take three types of actions directly in the kernel:
# Install required dependencies
sudo apt-get update && sudo apt-get install -y <tool-name>
helm repo add cilium https://helm.cilium.io
helm repo update
helm install tetragon cilium/tetragon \
--namespace kube-system \
--set tetragon.enableProcessCred=true \
--set tetragon.enableProcessNs=true \
--set tetragon.grpc.address="localhost:54321"
GOOS=$(go env GOOS)
GOARCH=$(go env GOARCH)
curl -L --remote-name-all \
https://github.com/cilium/tetragon/releases/latest/download/tetra-${GOOS}-${GOARCH}.tar.gz
tar -xzvf tetra-${GOOS}-${GOARCH}.tar.gz
sudo install tetra /usr/local/bin/
kubectl get pods -n kube-system -l app.kubernetes.io/name=tetragon
tetra status
This section covers practical implementation for implementing runtime security with tetragon.
Create a TracingPolicy to detect processes attempting to escape container namespaces:
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: detect-container-escape
spec:
kprobes:
- call: "__x64_sys_setns"
syscall: true
args:
- index: 0
type: "int"
- index: 1
type: "int"
selectors:
- matchNamespaces:
- namespace: Pid
operator: NotIn
values:
- "host_ns"
matchActions:
- action: Sigkill
Detect reads of sensitive credentials:
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: monitor-sensitive-files
spec:
kprobes:
- call: "security_file_open"
syscall: false
args:
- index: 0
type: "file"
selectors:
- matchArgs:
- index: 0
operator: "Prefix"
values:
- "/etc/shadow"
- "/etc/kubernetes/pki"
- "/var/run/secrets/kubernetes.io"
matchActions:
- action: Post
Prevent known crypto-mining binaries from executing:
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: block-cryptominers
spec:
kprobes:
- call: "security_bprm_check"
syscall: false
args:
- index: 0
type: "linux_binprm"
selectors:
- matchBinaries:
- operator: "In"
values:
- "/usr/bin/xmrig"
- "/tmp/xmrig"
- "/usr/bin/minerd"
matchActions:
- action: Sigkill
Stream runtime events in real-time:
# Watch all process execution events
kubectl exec -n kube-system ds/tetragon -c tetragon -- \
tetra getevents -o compact --process-only
# Filter events for a specific namespace
kubectl exec -n kube-system ds/tetragon -c tetragon -- \
tetra getevents -o compact --namespace production
# Export events in JSON for SIEM integration
kubectl exec -n kube-system ds/tetragon -c tetragon -- \
tetra getevents -o json | tee /var/log/tetragon-events.json
This section covers integration with siem and alerting for implementing runtime security with tetragon.
# tetragon-helm-values.yaml
export:
stdout:
enabledCommand: true
enabledArgs: true
filenames:
- /var/log/tetragon/tetragon.log
elasticsearch:
enabled: true
url: "https://elasticsearch.monitoring:9200"
index: "tetragon-events"
Tetragon exposes metrics at :2112/metrics:
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: tetragon-metrics
namespace: kube-system
spec:
selector:
matchLabels:
app.kubernetes.io/name: tetragon
endpoints:
- port: metrics
interval: 15s
| Metric | Description | Alert Threshold |
|---|---|---|
tetragon_events_total | Total security events observed | Spike > 3x baseline |
tetragon_policy_events_total | Events matching TracingPolicies | Any Sigkill action |
tetragon_process_exec_total | Process executions tracked | Anomalous new binaries |
tetragon_missed_events_total | Dropped events due to buffer overflow | > 0 sustained |
| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |