Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
The main features of cybereason-public/owlsm are: Networking and Security.
Open-source alternatives to cybereason-public/owlsm include: aquasecurity/tracee — Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events… bombinisecurity/bombini — eBPF Security Monitoring and Sandboxing Agent Based on Aya. cilium/cilium — Cilium is a networking, security, and observability platform for containerized environments that leverages… cilium/tetragon — Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments.… gen0sec/bpfjailer — Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks… alegrey91/harpoon — 🔍 Function-level tracing tool for Seccomp profiling, with eBPF.
Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho
eBPF Security Monitoring and Sandboxing Agent Based on Aya
Cilium is a networking, security, and observability platform for containerized environments that leverages kernel-level data paths to process traffic. By executing programs directly within the Linux kernel, it provides high-performance packet filtering, routing, and load balancing without the need for traditional user-space proxies or context switching. The platform distinguishes itself through identity-based security enforcement, which filters traffic based on service labels rather than volatile IP addresses. It integrates containerized workloads with external physical or virtual infrastruct
