Lightning Talk: Falco, Tracee and Tetragon: eBPF Runtime Observability and Security...
summary
Falco targets IDS use cases with an advanced rule engine and a modern eBPF probe that uses ring buffers and BTF-enabled raw tracepoints (requires ~5.8); Tracee prioritizes forensic data collection and exposes many hooks to capture memory, network, files, and syscall-level events — Tracee collects memory, network, and file artifacts for forensics; Tetragon is a low‑level programmable toolkit that configures tracepoint/kprobe/uprobe hooks via YAML and supports kernel‑level actions. Libraries differ: Falco/Tracee use libbpf, Tracee has a Go wrapper, Tetragon uses pure Go iBPF.
AI-written summary · about
related talks
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
31meBPF-Driven Security for Kubernetes: The Tetragon Story
20mThink eBPF for Kernel Security Monitoring
32mReal Time Security - eBPF for Preventing attacks
20mClosing Perspectives
36meBPF for Runtime Security
31meBPF for Observability: The Good, the Bad, and the Ugly
22mFalco & eBPF: Is the only Limit the Sky?