Tools
tetragon
cilium/tetragon
Tetragon is Cilium's eBPF-based security observability and runtime enforcement component. It captures process, syscall and I/O events in real time and applies Kubernetes-aware detection and enforcement policies.
Topics
Related projects
cilium25.8kAn eBPF-based networking, security, and observability platform for Kubernetes, providing CNI networking, load balancing, and identity-aware network policies.
tracee4.7kTracee is an open-source Linux runtime security and forensics tool from Aqua Security. Using eBPF, it collects system events and detects suspicious behavior, with Docker and Kubernetes deployment for runtime threat detection.
falco9.6kFalco is a CNCF cloud-native runtime security tool that monitors kernel and container events against custom rules to detect and alert on threats in real time.- hubble4.4kAn eBPF-powered observability platform for Kubernetes networking and security, offering service dependency maps, flow tracing, metrics, and network policy visibility.
- pwru3.8kAn eBPF-based Linux kernel packet tracer that shows exactly where packets travel or drop for debugging.
KubeArmor2.6kA cloud-native runtime security enforcement system that uses AppArmor, SELinux or BPF-LSM to restrict process, file and network behavior of pods, containers and nodes.