In this video, learn what is a Tracing Policy for Tetragon, as Jeremy Colvin guides you through the fundamentals of this user-configurable custom resource. Tetragon, a sub-project of Cilium, helps you get deep runtime visibility and security at minimal overhead. Watch the video and explore our Tetragon resources to learn more or create your first Tracing Policy! What is a tracing policy? A tracing policy is a configurable custom resource that allows users to trace events in the kernel and define actions to take if there is a match. These are in the form of YAML files. Tracing policies consist of a hook point using kprobes, tracepoints, and uprobes, for example, and selectors for in-kernel filtering and specifying actions. A powerful feature of Tetragon tracing policy is using these selectors to filter on events captured by the hook point, to extract only a subset of events based on different properties. These selectors allow for in-kernel filtering with eBPF and allow you to take action on events. There are lots of filters to leverage with Tetragon, but an example of these selectors might be matching for a specific process ID, binary path, or even evaluating arguments for file monitoring. Once filtered, Tetragon can export events to a preferred logging SIEM or cloud provider, or even take enforcement action like killing a process directly in the kernel.