How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho
eBPF Security Monitoring and Sandboxing Agent Based on Aya
Cilium is a networking, security, and observability platform for containerized environments that leverages kernel-level data paths to process traffic. By executing programs directly within the Linux kernel, it provides high-performance packet filtering, routing, and load balancing without the need for traditional user-space proxies or context switching. The platform distinguishes itself through identity-based security enforcement, which filters traffic based on service labels rather than volatile IP addresses. It integrates containerized workloads with external physical or virtual infrastruct
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
The main features of cybereason-public/owlsm are: Networking and Security.
Projects with overlapping indexed features include: aquasecurity/tracee — Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events… bombinisecurity/bombini — eBPF Security Monitoring and Sandboxing Agent Based on Aya. cilium/cilium — Cilium is a networking, security, and observability platform for containerized environments that leverages… cilium/tetragon — Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments.… gen0sec/bpfjailer — Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks… alegrey91/harpoon — 🔍 Function-level tracing tool for Seccomp profiling, with eBPF.
