DOCSEARCHbyAlgolia
Submit Docs

Tetragon Documentation

website·Indexed 35 days ago

https://tetragon.io/docs

eBPF-based security observability and runtime enforcement tool. Provides real-time, kernel-aware monitoring for processes, files, and network activity, featuring TracingPolicy resources for Kubernetes and container-based deployments, gRPC API access, and a comprehensive policy library for detecting privilege escalation and security-sensitive events.

Tokens
151.7K
Snippets
775
Records
1.1K
Agent score
69%

What's inside Tetragon

  1. Overview of Tetragon bugtool data collection

    The tetra bugtool is used to capture environment information for debugging single Tetragon agent nodes. It collects the following key information:

    • Tetragon configuration
    • Network configuration
    • Kernel configuration
    • eBPF maps
    • Process traces (if tracing is enabled)

  2. Overview of Tetragon TracingPolicy

    Tetragon's TracingPolicy is a Kubernetes custom resource (CR) used to trace arbitrary kernel events and define actions based on matches. A policy consists of a hook point (supporting kprobes, tracepoints, and uprobes) and selectors used for in-kernel filtering and action specification. Because these policies provide low-level kernel configuration, users should have a strong understanding of the Linux kernel and containers to avoid issues such as Time-of-Check to Time-of-Use (TOCTOU) bugs.

  3. Overview of Linux process credentials

    Linux process credentials (also known as task privileges) are used by the kernel to perform security checks when a process acts on other objects. They consist of:

    • Traditional UNIX credentials: Real, Effective, Saved, and FS User IDs (UID) and Group IDs (GID), as well as supplementary groups.
    • Linux Capabilities: Sets of permitted, inheritable, effective, and bounding capabilities that define what privileged operations a process can perform.
    • Secure management flags (securebits): Govern how UIDs/GIDs and capabilities are manipulated and inherited during operations like execve(2).
    • Linux Security Module (LSM): A framework providing additional security hooks and controls on operations a task is allowed to perform.

  4. Overview of Linux process credentials monitoring

    Tetragon monitors process credentials (task privileges) to identify programs running with high privileges. Monitored attributes include:

    • Traditional UNIX credentials: Real, Effective, Saved, and FS User/Group IDs, and supplementary groups.
    • Linux Capabilities: Permitted, Inheritable, Effective, and Bounding sets.
    • Secure management flags (securebits).
    • Linux Security Module (LSM) controls.

    Credential changes can be monitored at the system call layer or via internal kernel functions (the latter is generally preferred).

  5. Overview of Tetragon Policy Enforcement

    Tetragon uses in-kernel filtering to monitor kernel functions and enforce restrictions. By performing filtering in the kernel, Tetragon reduces the volume of events sent to user space and can take immediate action against policy violations. For example, Tetragon can issue a SIGKILL to a process when a violation is detected, terminating the application immediately if the enforcement is triggered during a syscall.

  6. Overview of Cilium Tetragon capabilities

    Cilium Tetragon is a security observability and runtime enforcement tool that leverages eBPF to detect and react to security-significant events in real-time. It monitors process execution, system call activity, and I/O activity (including network and file access). In Kubernetes environments, Tetragon is Kubernetes-aware, allowing security event detection to be configured based on Kubernetes identities such as namespaces and pods.

  7. Overview of Tetragon Security Observability and Enforcement

    Tetragon is a Kubernetes-aware security observability and runtime enforcement tool that leverages eBPF to apply policy and filtering directly within the kernel. This approach reduces observation overhead and prevents TOCTOU (Time-of-Check to Time-of-Use) attack vectors by blocking malicious activities at the kernel level. It monitors processes, syscalls, file activity, and network communications, correlating threats with network data and exporting insights via JSON logs and a gRPC endpoint.

  8. Overview of Tetragon Network Observability

    Tetragon provides deep network observability by linking network events directly to the specific processes and workloads that initiate them. Unlike traditional monitoring that only captures connections, Tetragon tracks the entire socket lifecycle—including connections to local or external endpoints and the volume of sent/received bytes—enriched with Kubernetes identities such as pod labels and namespaces. This process-aware approach enables security teams to perform faster root-cause analysis and anomaly detection in cloud-native environments.

  9. Overview of Tetragon TracingPolicy

    A TracingPolicy is a Kubernetes custom resource (CR) used to define how Tetragon observes events in the kernel and userspace using eBPF. It allows users to specify hook points, in-kernel filtering selectors, and optional actions to execute upon a match. Supported hook points include kprobes, fentry/fexit, uprobes, tracepoints, LSM hooks, and USDTs. While structured as Kubernetes CRs, these policies can also be applied in non-Kubernetes environments using the Tetragon CLI or daemon flags.

  10. Overview of Cilium Tetragon capabilities

    Cilium Tetragon is a runtime security enforcement and observability tool that leverages eBPF to provide real-time monitoring and reaction to security-significant events directly within the Linux kernel. Key capabilities include:

    • Event Detection: Monitors process execution, system call activity, and I/O activity (including network and file access).
    • Kubernetes Awareness: In Kubernetes environments, Tetragon understands identities such as namespaces and pods, allowing security policies to be configured for specific workloads.
    • Kernel-Level Enforcement: Filtering, blocking, and reacting to events occurs in the kernel via eBPF, reducing overhead by avoiding expensive context switching to user-space agents.
    • Deep Kernel Hooking: Can hook into any Linux kernel function to filter on arguments, return values, and metadata, avoiding common syscall tracing issues like data manipulation by user-space applications.

  11. Overview of Cilium Tetragon capabilities

    Cilium Tetragon is an eBPF-based security observability and runtime enforcement tool. It detects and reacts to security-significant events in real-time, including process execution, system call activity, and I/O activity (network and file access). In Kubernetes environments, Tetragon is Kubernetes-aware, allowing security event detection to be configured based on Kubernetes identities such as namespaces and pods.

  12. Overview of Linux process credentials monitoring with Tetragon

    Tetragon allows developers and security operators to monitor Linux process credentials to identify programs running with high privileges. Process credentials (also known as task privileges) include user/group IDs, capabilities, secure management flags, keyrings, and LSM security settings. Tetragon exposes this data as a process_credentials object via its gRPC API.