Runtime Visibility

Application Teams need rich live data

• Traditional tools don't tell the whole story

  • Traditional tooling is focused around IPs, ports, and OS logging.
  • This is not enough in container environments, where IPs are ephemeral, ports are meaningless and OS logging is only part of the picture.
  • Also, there are usually limited to no options to further refine the data aggregation during ongoing investigations.

• eBPF to the rescue

  • eBPF allows for an unprecedented depth of data.
  • Network flows between nodes, enriched with cloud native context.
  • System level insight into each node, from the code executions inside the container down to kernel level system call activity.
  • I/O activity including network & file access.

Cloud native insight at runtime

• Deep insight into networking and system calls without overhead.
• No delay, runtime analysis and forensics.
• No tool sprawling, all integrated into existing data plane.

Combining Network & Runtime Visibility

• Through eBPF, we gain insight across both the network and runtime
• Understanding of the binaries and processes
• Visibility of the traffic flows, with details of API and HTTPS requests
• Awareness of the Kubernetes objects, like namespaces and pods

Introducing Tetragon

Tetragon provides eBPF-based transparent security observability combined with real-time runtime enforcement. The deep visibility is achieved without requiring application changes and is provided at low overhead thanks to smart in-kernel filtering and aggregation logic built directly into the eBPF-based kernel-level collector. The embedded runtime enforcement layer is capable of performing access control on the system call and other enforcement levels.

• Introduction to Tetragon