Keynote: Picture this! Solving Security Problems Visually with eBPF
summary
eBPF instruments the kernel to produce rich events that are turned into graphs and dashboards using Cilium Hubble flows, Prometheus policy verdict metrics, and Tetragon logs hooked into Grafana. Examples shown: a service communication graph built from Hubble, network policy debugging via verdict counts, discovery of a pod running netcat with exact pod ID, SQL injection signals from Pixie, file access and exfiltration alerts, and privilege escalation detection — all used to find and fix real security incidents.
AI-written summary · about
chapters (5)
- 0:00Introduction to eBPF
- 1:37Observing the Empire
- 3:41Managing network policies
- 8:11Runtime threat detection
- 8:46Visualizing security data
related talks
35mKeynote: Cloud Native Superpowers with eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
30mObservability in Kubernetes: Unlocking the Power of eBPF
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
26mTriaging Real-time Security Threats with eBPF-powered Observability
10mKeynote: eBPF - Everything You Need to Know in 5 Minutes
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
32mExploring the Power of eBPF for System Observability