cilium/tetragon

Features

• eBPF Security Tools - Provides eBPF-based runtime security by monitoring and blocking malicious system calls and network activity directly in the Linux kernel.
• Kernel Function Instrumentation - Hooks kernel functions and tracepoints using eBPF to observe system state and execute logic in kernel space.
• Kernel-Level Hooking - Executes code by dynamically hooking into any kernel function or system call to observe internal state.
• Runtime Security Enforcement - Blocks or alerts on security-significant events in real-time using predefined rules for processes, files, and network traffic.
• Container-Aware Auditing Agents - Ships an agent that maps low-level kernel events to Kubernetes pods and namespaces to provide container-aware security auditing.
• Process-to-Socket Mappings - Correlates active network sockets with specific local process identifiers to ensure visibility into socket ownership.
• Container Lifecycle Monitoring - Informs the monitoring agent when a container is created to provide context on images and metadata.
• Pod Event Mapping - Associates security events with specific pods by integrating with the container runtime and API.
• In-Kernel Event Filtering - Applies filtering logic directly within the kernel to reduce noise and avoid context switching.
• Network Stack Inspections - Extracts network packet and socket information including addresses, ports, and protocols from the network stack.
• Binary Execution Tracking - Monitors all binary executions across environments to attribute system behavior to specific binaries.
• BPF Map Structures - Uses kernel-resident BPF maps to track process lifecycles and network sockets for event correlation.
• In-Kernel Enforcement Engines - Implements an engine that blocks unauthorized system calls and terminates malicious processes directly in the kernel via eBPF.
• Structure Attribute Resolution - Extracts specific fields from complex kernel structures passed as parameters to hooks.
• Namespace Change Monitoring - Tracks Linux namespace operations to detect when processes attempt to switch namespaces.
• Kernel Data Extraction - Provides the ability to retrieve primitive integers, strings, and complex structures directly from kernel objects.
• Real-time Kernel Event Processing - Processes kernel events in real-time to reduce overhead and send only relevant data to agents.
• Kernel Function Return Value Modification - Intercepts kernel function calls and replaces return values with errors or constants to synchronously block malicious activity.
• Container Escape Auditors - Monitors kernel namespace changes to detect and alert on attempts by processes to escape container isolation.
• Runtime Identity Synchronization - Provides real-time synchronization of container identities into the kernel to ensure accurate policy enforcement before execution starts.
• Security Policy Enforcers - Leverages Linux Security Module (LSM) hooks to block system calls or terminate malicious processes in real-time.
• Intrusion Detection Systems - Detects privilege escalation, container escapes, and unauthorized kernel module loading through deep system tracing.
• Kernel Identity Injection - Injects container identity into the kernel to ensure security events are accurately mapped to Kubernetes pods and namespaces.
• Privilege Escalation Prevention - Identifies unauthorized changes to process credentials and namespaces to detect privilege escalation attempts.
• Process Credential Monitoring - Monitors changes to Linux process credentials to detect privilege escalation or unauthorized identity shifts.
• Runtime Event Filters - Performs real-time filtering of kernel events based on arguments and metadata to reduce noise before reaching userspace.
• Kernel-Cluster State Correlation - Joins low-level kernel state with orchestration metadata to annotate and enforce rules based on namespaces and capabilities.
• Container-Process Mapping - Correlates host system process IDs with container metadata to identify the specific container environment.
• Kernel Tracing Frameworks - Utilizes a framework for hooking into kernel functions and tracepoints to detect privilege escalation and container escapes.
• System Call Tracing - Specifies which kernel functions and system calls to monitor and defines the conditions that trigger security alerts.
• Tracepoint Monitoring - Provides high-efficiency retrieval of raw kernel tracepoint arguments by bypassing the performance event layer.
• File Modification Tracking - Tracks read and write operations on specific files using kernel-level filtering to detect unauthorized activity.
• Kernel Event Matching - Matches retrieved kernel data against specific values using equality, CIDR notation, or substring matches.
• Kubernetes Metadata Mapping - Links low-level kernel events to specific Kubernetes pods and namespaces to identify workloads causing security events.
• Kernel Tracing Policies - Defines policies for hooking into kernel functions, tracepoints, and user-space functions to monitor and react to system events.
• Container Identity Mapping - Maps low-level kernel events to Kubernetes pods and namespaces by synchronizing container runtime identity.
• Network Connection Tracking - Tracks TCP connect events and socket activity in real-time using kernel hooks for network visibility.
• Process Activity Correlation - Assigns unique identifiers to processes to link execution events with exit events across a runtime session.
• Process Metadata Inspection - Captures detailed runtime information including environment variables, namespace data, and credential changes.
• Process Termination Controls - Synchronously terminates malicious processes directly from the kernel before a system call completes.
• System Call Monitors - Tracks specific system calls and function calls in real-time to detect security events based on defined selectors.
• Security Event Monitoring - Enables real-time retrieval and monitoring of security events from remote agents via secure connections.
• Trace Event Filters - Implements granular event filtering using Kubernetes namespaces, pod labels, and container metadata to reduce kernel noise.
• Kernel Capability Profiling - Records kernel-level capability checks to determine the actual privileges required by specific pods or containers.
• Process Event Streams - Exports real-time process execution data, including binary arguments, via JSON logs or gRPC streams.
• Runtime State Interrogation - Offers a programmatic interface to interrogate and update the internal runtime state of security agents.
• gRPC Event Querying - Provides a standardized gRPC interface for querying real-time security events and internal agent state.
• gRPC Event Communication - Utilizes gRPC for encrypted communication between agents and clients to stream security events and manage state.
• BPF Program Introspection - Extracts metadata from BPF programs and maps to monitor the deployment and execution of BPF code.
• Dynamic Policy Management - Provides a system for defining and dynamically loading kernel-level tracing and enforcement rules without requiring system reboots.
• Kernel Module Security Monitoring - Tracks the loading and unloading of kernel modules and verifies cryptographic signatures to detect unauthorized kernel extensions.
• Shared Library Auditing - Logs versions of shared libraries loaded by binaries to detect potential security vulnerabilities or library hijacking.
• Dynamic Policy Refreshers - Supports the dynamic loading and unloading of observation rules at runtime via CLI or daemon flags.
• Binary Execution Restrictions - Restricts the execution of specific binaries from defined directories to prevent unauthorized code execution.
• Malicious Traffic Blocking - Terminates processes that attempt to establish TCP connections to unauthorized IP ranges or malicious destinations.
• Connection Auditing - Provides auditing of active network connections to identify unauthorized remote shells and outbound cluster traffic.
• Runtime Security Hooks - Triggers automated external reactions when specific runtime security conditions are met in the kernel.
• Secure Connection Managers - Establishes secure, authenticated, and encrypted communication channels between management components and remote agents.
• Kernel Hook Auditing - Tracks BPF program loading and kernel module activity using kernel-level hooks to identify malicious actors.
• Monitoring Policies - Loads security policies from files or directories to define the scope of system event monitoring.
• Path Access Restrictions - Prevents unauthorized access to sensitive files by synchronously terminating the requesting process in the kernel.
• Data Loss Prevention - Monitors and blocks unauthorized data transfers from orchestrated environments to external network destinations.
• BPF Performance Monitoring - Tracks execution counts and total run time for loaded BPF programs to identify system overhead.
• Execution Audit Trails - Captures detailed audit trails of process lifecycles, binary executions, and credential changes for security analysis.
• File Activity Auditing - Monitors filesystem interactions to detect unauthorized reads or modifications to sensitive system files.
• File Integrity Monitoring - Tracks modifications to critical files and directories to detect unauthorized tampering or system changes.
• In-Kernel Event Suppression - Executes defined actions on matches within the kernel without transmitting the event to user-space, reducing system overhead.
• Dynamic Kernel Probes - Allows for the runtime loading and unloading of tracing rules and filters without requiring system reboots.
• User-Defined Probes - Attaches to user statically-defined tracing probes (USDT) defined within application binaries.
• System Resource Tracking - Reports the amount of kernel memory used by sensors and the load state of security policies.
• System Call Metrics - Records totals for system calls and security events to monitor workload behavior and health.
• Application Health Monitors - Exposes metrics to monitor the internal operational health and performance of the security tool.
• eBPF-Based Collection - Ingests low-level kernel events from clusters for security analysis and log aggregation using eBPF.
• Scrape Configuration Automators - Provides pre-configured resources for the automatic discovery and scraping of metric endpoints.
• Observability Sensor Control - Enables, disables, or removes specific sensors to manage the collection of observability data from the kernel.
• Prometheus Metrics Exporters - Collects and exposes performance and security telemetry in a format compatible with Prometheus.
• Security Event Collection - Collects real-time security events in JSON or compact formats via log files or APIs.
• System Change Tracking - Tracks modifications to the host system to identify unauthorized configuration or environment changes.
• Kernel Stack Trace Capture - Dumps both kernel and user-space stack traces to provide deep visibility into the system call chain.
• User-Space Function Tracing - Executes code by hooking into functions within specific user-space binaries or libraries.
• Forensics and Incident Response - eBPF-based security observability and runtime enforcement.
• Networking and Security - Kubernetes-aware runtime security and enforcement.
• Observability and Monitoring - eBPF-based security observability and enforcement.

Star history