Implementing eBPF Security Monitoring

When to Use

• When deploying kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters
• When you need sub-millisecond visibility into process execution, network connections, and file access
• When traditional userspace monitoring tools introduce unacceptable performance overhead
• When building detection pipelines that require in-kernel filtering before events reach userspace
• When enforcing runtime security policies (kill process, send signal) at the kernel level

Prerequisites

• Linux kernel 5.3+ with BTF (BPF Type Format) support enabled
• Kubernetes 1.24+ cluster (for Kubernetes deployment) or standalone Linux host
• Helm 3.x installed (for Kubernetes deployment)
• kubectl configured with cluster access
• tetra CLI installed for local event streaming
• Python 3.8+ with requests, kubernetes, pyyaml dependencies
• Root or CAP_BPF/CAP_SYS_ADMIN capabilities for eBPF program loading

Instructions

1. Install Tetragon on Kubernetes

Deploy Tetragon via Helm to get default process lifecycle observability:

helm repo add cilium https://helm.cilium.io
helm repo update
helm install tetragon cilium/tetragon -n kube-system \
  --set tetragon.enableProcessCred=true \
  --set tetragon.enableProcessNs=true

Verify the installation:

kubectl get pods -n kube-system -l app.kubernetes.io/name=tetragon
kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon -c export-stdout -f | head -20

2. Install Tetragon on Standalone Linux

For non-Kubernetes Linux hosts, install from the tarball release:

curl -LO https://github.com/cilium/tetragon/releases/latest/download/tetragon-linux-amd64.tar.gz
tar xzf tetragon-linux-amd64.tar.gz
sudo cp tetragon /usr/local/bin/
sudo cp tetra /usr/local/bin/

# Start tetragon daemon
sudo tetragon --btf /sys/kernel/btf/vmlinux &

# Stream events
tetra getevents -o compact

3. Monitor Process Execution (Default)

Tetragon generates process_exec and process_exit events by default without any TracingPolicy:

# Stream process events in compact format
tetra getevents -o compact

# Stream in JSON for SIEM ingestion
tetra getevents -o json | jq '.process_exec // .process_exit'

Example process_exec JSON event:

{
  "process_exec": {
    "process": {
      "binary": "/usr/bin/curl",
      "arguments": "https://malicious.example.com/payload",
      "cwd": "/tmp",
      "uid": 1000,
      "pod": {
        "namespace": "default",
        "name": "webapp-7b4d9f8c6-x2k9p"
      },
      "parent": {
        "binary": "/bin/bash",
        "pid": 1234
      }
    }
  }
}

4. Author TracingPolicy for File Access Monitoring

Create a TracingPolicy CRD to monitor access to sensitive files via the sys_openat kprobe:

# file-access-monitor.yaml
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: monitor-sensitive-file-access
spec:
  kprobes:
    - call: "fd_install"
      syscall: false
      args:
        - index: 0
          type: "int"
        - index: 1
          type: "file"
      selectors:
        - matchArgs:
            - index: 1
              operator: "Prefix"
              values:
                - "/etc/shadow"
                - "/etc/passwd"
                - "/etc/sudoers"
                - "/root/.ssh/"
                - "/etc/kubernetes/pki/"
          matchActions:
            - action: Post

Apply and observe:

kubectl apply -f file-access-monitor.yaml
tetra getevents -o compact --process-filter "event_set:PROCESS_KPROBE"

5. Author TracingPolicy for Network Connection Monitoring

Monitor outbound TCP connections using the tcp_connect kprobe:

# network-monitor.yaml
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: monitor-tcp-connections
spec:
  kprobes:
    - call: "tcp_connect"
      syscall: false
      args:
        - index: 0
          type: "sock"
      selectors:
        - matchActions:
            - action: Post

6. Author TracingPolicy for Privilege Escalation Detection

Detect setuid/setgid calls that may indicate privilege escalation:

# privilege-escalation-detect.yaml
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-privilege-escalation
spec:
  kprobes:
    - call: "__sys_setuid"
      syscall: false
      args:
        - index: 0
          type: "int"
      selectors:
        - matchArgs:

…