How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho
eBPF Security Monitoring and Sandboxing Agent Based on Aya
Cilium is a networking, security, and observability platform for containerized environments that leverages kernel-level data paths to process traffic. By executing programs directly within the Linux kernel, it provides high-performance packet filtering, routing, and load balancing without the need for traditional user-space proxies or context switching. The platform distinguishes itself through identity-based security enforcement, which filters traffic based on service labels rather than volatile IP addresses. It integrates containerized workloads with external physical or virtual infrastruct
bpflock - eBPF driven security for locking and auditing Linux machines
The main features of linux-lock/bpflock are: Networking and Security.
Open-source alternatives to linux-lock/bpflock include: aquasecurity/tracee — Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events… bombinisecurity/bombini — eBPF Security Monitoring and Sandboxing Agent Based on Aya. cilium/cilium — Cilium is a networking, security, and observability platform for containerized environments that leverages… cilium/tetragon — Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments.… cybereason-public/owlsm — Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities. alegrey91/harpoon — 🔍 Function-level tracing tool for Seccomp profiling, with eBPF.
