cilium/tetragon

Tetragon is a security monitoring tool for Linux systems and Kubernetes clusters. Its job is to watch what is happening inside a running system at a very deep level: which programs are being started or stopped, which files are being read or written, and what network connections are being made. When it detects activity that matches a security rule, it can either record the event or actively block it in real time. The technology behind this is called eBPF, which is a way to run small inspection programs directly inside the Linux kernel, the core of the operating system. Because these programs run at the kernel level, they can observe activity that would be invisible to tools sitting higher up in the software stack. There is no need to modify the applications being monitored or install agents inside them. When running in a Kubernetes environment, which is a system for running many containerized applications across multiple servers, Tetragon understands Kubernetes concepts like namespaces and pods. This means you can write rules tied to a specific application or workload, rather than just to a machine. For example, you could monitor one service for unusual file access without that rule affecting other services running on the same server. The events Tetragon produces are enriched with context from both Linux and Kubernetes, so a security team reviewing logs can see not just what happened at the system level but also which application and which part of the cluster was involved. Out of the box it records process start and exit events. More advanced rules can be added to trace specific kernel functions, system calls, or user-space functions. Tetragon is part of the Cilium project, an open source networking and security project for Kubernetes. It is available under Apache 2.0, BSD, and GPL licenses depending on the component.