Tetragon has primarily been focused on giving teams deep, low-overhead visibility into their environments and workloads, from process executions, file access, network observability, and more. Tetragon 1.7 continues to advance along the trajectory of a deep visibility, low-overhead security observability and runtime enforcement tool that addresses the ever-evolving needs of today’s cloud native security landscape. This release introduces new attachment mechanisms, granular security policies for host and pod workloads, expanded platform support for ARM, improved performance, and user experience improvements that make it easier to write, reason about, and deploy tracing policies. If you are interested in learning about a specific feature, navigate directly to that feature using the section below. If you are curious about the implementation details, check the release note and explore the respective pull requests. What is new in Tetragon v1.7, TL;DR? Fentry sensor support – A new hook point similar to kprobes with the bonus of being comparatively lightweight. (more details) Environment variable collection – Pull environment variables into process events for richer execution context. (more details) matchParentBinaries selector – Filter tracing policies on the parent process binary, not just the executing one. (more details) CEL-in-BPF evaluation – Evaluate CEL expressions directly in eBPF for faster, in-kernel filtering decisions. (more details) Granular Policies with hostSelector Support – Apply to tracing policies to host, container or pod workloads only. (more details) Environment Variable Collection Tetragon now collects environment variables into process events, providing visibility into how processes are configured at runtime. This feature collects all the environment variables passed to a process when it starts executing. When you run a command like API_KEY=secretkey43 python main.py or docker run -e ENV=prod, this feature captures these environment variables (API_KEY=secretkey43 and ENV=prod) and any other environment variables the process inherits, storing them in the process_exec event. This feature is disabled by default but can be enabled with the --enable-process-environment-variables flag and supports a filtering option to capture only specific environment variables of interest using the ––filter-environment-variables flag. The environment variable collection feature integrates with the existing redaction filter, enabling the redaction of sensitive information such as passwords and API keys before it is exported. Environmental variables provide additional context that augments the transformation of raw process events into actionable, security-relevant signals. This enhancement builds on Tetragon’s foundation to continue delivering rich, context-aware telemetry with minimal overhead. In-Kernel Filtering with CEL Expression Compilation Tetragon now features a CEL(Common Expression Language) to BPF compiler that enables complex filtering logic to be evaluated directly in the kernel. This allows writing sophisticated filtering expressions using the familiar CEL syntax, which are then compiled into native BPF bytecode and executed in the kernel without userspace context-switching overhead. The implementation supports a comprehensive set of operations including arithmetic (+, -, *, /, >>, <<), comparison (==, !=, >, >=, <, <=), and logical operators (&&, ||, !) across 32-bit and 64-bit integer types, with direct access to function arguments through arg0, arg1, etc. Take this tracing policy for monitoring large file writes, for example: using the CEL expression, this comparison logic can be expressed, and events are generated only when the write size (arg2) is greater than 1024 bytes. The CEL logic is compiled directly into BPF bytecode and evaluated in the kernel. This zero-copy filtering approach eliminates the costly process of transferring event data to userspace for evaluation, reducing overhead while enabling more complex filtering logic than previously possible. The compiler intelligently adapts to different kernel versions (4.19 to 6.1+) and provides graceful fallbacks to ensure compatibility across various kernel versions. CEL expressions in BPF bring high-level language expressiveness to tracing policies at native speed, making Tetragon the most performant and expressive runtime security tool. Fentry Sensor Support Tetragon now supports fentry and fexit eBPF programs, delivering the next generation of tracing mechanisms that offer superior performance compared to traditional kprobes. This major enhancement leverages modern eBPF capabilities to attach directly to kernel functions without the overhead of breakpoint-based mechanisms such as kprobes, resulting in significantly reduced performance impact while maintaining the rich observability you expect from Tetragon. Kprobe-based tracing policies can easily be migrated by simply changing the hook from “kprobes” to “fentries”, with no changes required to the argument extraction or filtering logic. For example, this kprobe-based policy, which generates events when the sys_mount system call is executed by binaries other than /usr/bin/mount can be rewritten to its fentry equivalent by changing the hook point name. The fentry equivalent now becomes: The new fentry sensor solidifies Tetragon at the forefront of eBPF-based security observability and runtime enforcement, offering security teams the choice between the proven reliability of kprobes or the performance of fentry based on the specific requirements and kernel capabilities. N/B: The fentry sensor does not currently support enforcement policies. This means fentry-based tracing policies are currently limited to only monitoring use cases. For enforcement scenarios, you still need to use kprobe-based policies until enforcement support is added to the fentry sensor in future releases. Improved Parent Process Visibility with the matchParentBinaries Selector This release added a new selector, matchParentBinaries, that lets you filter events based on what process launched the current process, not just the process itself. This solves a common scenario where you want to monitor a specific binary only when it is used within certain contexts. Similar to the matchBinaries selector, the matchParentBinaries supports the followChildren option to match not just the direct parent processes but transitive parent processes up the process tree. Take this tracing policy to monitor shell executions. Instead of getting alerts every time there is a new shell execution, combining both the matchParentBinaries selector and the followChildren directive, you can filter for only when a shell is launched by a suspicious parent process, whether direct or transitive, while ignoring shells launched by legitimate login methods(SSH, login, sudo) This feature reduces false positives by enabling much more precise filtering that considers the process execution context by tracing parent-child process relationships across the entire process lineage. This feature also enhances behavioral analysis by enabling the crafting of security policies that can distinguish between legitimate and suspicious use of the same tool based on how it was invoked. Granular Policies with hostSelector Support Tetragon now offers intuitive, workload-aware scoping of security policies with the new hostSelector feature. This enhancement introduces a new selector: hostSelector, that complements the existing podSelector and containerSelector. These three selectors work in tandem to control which execution contexts your tracing policies are applied to. The hostSelector provides a cleaner and more intuitive approach to scoping policies to hosts or pods than using namespace filters. The spec currently supports two types of host selectors:” {}(which matches everything) and null(matches nothing). This capability can also be useful in compliance scenarios where different security requirements may apply to different execution contexts, and internal policies or regulatory guidance may require separate audit trails for “infrastructure operations” and “business application activities”. Conclusion Tetragon 1.7 brings five major features. The matchParentBinaries selector, contributed by community member @kobrineli, enables filtering based on the parent process relationship. Environment variable collection provides full visibility into how processes are configured at runtime. CEL expression evaluation brings powerful filtering logic into kernel space. The hostSelector feature introduces workload-aware policies that enable precise application of security policies to a host or container, and the fentry sensor support delivers superior performance compared to kprobes. Beyond these major features, Tetragon v1.7 packs 908 commits' worth of features and improvements. We fixed critical memory leaks that affected long-running deployments and improved metrics collection for better monitoring. The Tetragon gPRC server now uses UDS(UNIX domain sockets) instead of localhost binding for better security isolation. BPF programs now handle edge cases better with safer NULL pointer handling and more reliable userspace string matching. ARM platform support and uprobe functionality saw extensive improvement. These enhancements and feature sets reflect real needs from our growing community of users, security practitioners, and the entire cloud native security community. Keep up with the Tetragon community via the monthly community meetings. Join the Tetragon channel on the Cilium Slack Read more about the Tetragon 1.0 release – benchmarks, early use cases, and core principles behind the project.