Tetragon

<a href="https://tetragon.io"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/assets/icons/logo.svg" width="400"> <img src="docs/assets/icons/logo-dark.svg" width="400"> </picture> </a>

---

Cilium’s new Tetragon component enables powerful
real-time, eBPF-based Security Observability and Runtime Enforcement.

Tetragon detects and is able to react to security-significant events, such as

• Process execution events
• System call activity
• I/O activity including network & file access

When used in a Kubernetes environment, Tetragon is Kubernetes-aware - that is,
it understands Kubernetes identities such as namespaces, pods and so on - so
that security event detection can be configured in relation to individual
workloads.

See more about how Tetragon is using eBPF.

Getting started

Refer to the official documentation of Tetragon.

To get started with Tetragon, take a look at the getting started
guides to:

• Try Tetragon on Kubernetes
• Try Tetragon on Linux
• Deploy Tetragon
• Install the Tetra CLI

Tetragon is able to observe critical hooks in the kernel through its sensors
and generates events enriched with Linux and Kubernetes metadata:

1. Process lifecycle: generating process_exec and process_exit events
   by default, enabling full process lifecycle observability. Learn more about
   these events on the process lifecycle use case page.
2. Generic tracing: generating process_kprobe, process_tracepoint and
   process_uprobe events for more advanced and custom use cases. Learn more
   about these events on the TracingPolicy concept page
   and discover multiple use cases like:
   • 🌏 network observability
   • 📂 filename access
   • 🔑 credentials monitoring
   • 🔓 privileged execution

See further resources:

• Conference Talks, Books, Blog Posts, and Labs
• Frequently Asked Question
• References

Join the community

Join the Tetragon 💬 Slack channel and the
📅 Community Call to chat with
developers, maintainers, and other users. This is a good first stop to ask
questions and share your experiences.

How to Contribute

For getting started with local development, you can refer to the
Contribution Guide. If
you plan to submit a PR, please "sign-off"
your commits.

Adopters

A list of adopters of the Tetragon project and who is deploying it in
production, and of their use cases, can be found in the
USERS.md file.